ChatGPT Was Reportedly Used to Plan Zürich-Oerlikon Knife Attack That Seriously Injured Three Five-Year-Old Boys

Before an October 2024 knife attack in Zürich-Oerlikon, Switzerland, a 23-year-old student reportedly used ChatGPT to ask about consequences of killing random stabbing victims, where and when to find children, and human anatomy. He later stabbed three five-year-old boys, seriously injuring them. Prosecutors charged him with attempted murder; the allegations about his AI-assisted planning come from the indictment.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The perpetrator used ChatGPT to gain a personal advantage and facilitate targeted physical violence and manipulation of his environment to successfully execute a crime.

Additional risk subdomains

• 1.2 Exposure to toxic content: The AI system provided actionable information regarding anatomical vulnerabilities and legal consequences of murder, exposing the user to harmful and unsafe advice.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The physical harm was directly caused by a human actor who intentionally used a deployed AI system (ChatGPT) as a tool to plan and optimize his violent crime.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system used was ChatGPT, which is a general-purpose conversational chatbot subject to transparency obligations under the EU AI Act.

AI system and alleged parties

• AI system: ChatGPT (OpenAI)
• AI purpose: Writing Assistant; Question Answering
• Behaviour type: Assistant
• Alleged developer: OpenAI, Large language model developers, Chatbot developers
• Alleged deployer: Zürich-Oerlikon child stabbing suspect, Violent attack planners and assailants
• Alleged harmed parties: Victims of violent attack planners and assailants, Three boys injured in Zürich-Oerlikon knife attack, Minors, Men and boys, Boys

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Substantial
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Minor
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Physical

Reported: The report explicitly describes severe physical injuries to three five-year-old children caused by the knife attack.

Indirectly caused: Three five-year-old boys suffered severe knife wounds; one had his jugular vein severed requiring emergency surgery, a second was stabbed in the chest penetrating his pericardium, and a third suffered ear and lung injuries.

Financial

Reported: The report does not explicitly describe financial losses, though emergency medical surgeries and legal proceedings occurred.

Indirectly caused: Significant indirect financial costs were incurred for emergency medical surgeries, intensive care, ongoing rehabilitation for the children, and legal prosecution costs.

Inferred additional harm: Long-term healthcare, therapy costs for the victims, and potential loss of income for parents caring for the injured children.

Civil rights

Reported: The report describes a severe violation of the children's fundamental right to life and physical integrity.

Indirectly caused: The physical attack violated the fundamental human rights to life and personal security of the three young victims.

Psychological

Reported: The reports note that the indictment does not explicitly detail the psychological consequences, but the trauma is heavily implied.

Indirectly caused: The three victims, the childcare worker who intervened, other children in the group, and their families suffered severe psychological trauma and distress.

Inferred additional harm: Widespread psychological trauma, anxiety, and post-traumatic stress among the local school community, parents, and witnesses of the violent public attack.

People affected

• Occurrences reported: 1
• People reportedly harmed: 3
• People reportedly exposed: 5

Potential causes

Management

• Inadequate Abuse Monitoring: AI developer failed to detect and prevent misuse for violent crime prep.

Technology

• AI Legal Consequences Advice: ChatGPT discussed legal consequences of stabbing random victims.
• AI Location Planning Assistance: ChatGPT answered queries on where and when to find children in Zurich.
• AI Anatomical Assistance: ChatGPT and Google provided anatomical diagrams of human blood vessels.

Data Inputs

• Lack of Query Safety Filtering: System accepted queries about stabbing scenarios and finding children.
• Access to Sensitive Information: Models provided actionable data on vulnerable targets and anatomy.

Human Factors

• Ideological Radicalization: The perpetrator exhibited extreme nationalistic and delusional ideology.
• Severe Psychological Distress: The perpetrator felt disrespected and increasingly unhappy in Switzerland.
• Deliberate Intent to Kill: The perpetrator made a conscious decision to murder random victims.

Process and Methods

• Inadequate AI Safety Guardrails: AI safety filters failed to block planning of violent crimes.
• Lack of Real-time Threat Flagging: No mechanisms flagged the user's violent intents to authorities.

Information quality

• Classification confidence: High
• Reason for confidence: The reports are based on official court indictments from the Zurich public prosecutor, providing precise details on how the perpetrator used ChatGPT to plan the attack, including dates, specific search queries, and the physical consequences.

A Chinese linguistics student in Switzerland used ChatGPT to research human anatomy and legal consequences to plan a violent knife attack that severely injured three five-year-old boys. While tragic, the national security implications are minor and manageable within standard law enforcement and judicial procedures, representing an evolved capability of individuals using AI to optimize physical crimes.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Switzerland
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The perpetrator has been apprehended and prosecuted, meaning there is no immediate ongoing crisis, though the strategic risk of individuals using AI to assist in violent planning remains.
• Autonomy: Human-controlled. The AI acted purely as an informational assistant. The human perpetrator made all final decisions, planned, and physically executed the attack.
• Novelty: Evolved capability. Represents an evolution of malicious actors using online resources to plan crimes, transitioning from traditional search engines to conversational AI models to optimize attack methods.

Impact by dimension

• Physical security: Minor. While a violent physical attack occurred, it was a localized knife attack by a single individual targeting individuals rather than an attack on critical national infrastructure or deploying military-grade kinetic systems.
• Information security: Negligible. The incident involved a localized criminal act and did not compromise national intelligence capabilities, classified models, or represent a systematic information warfare campaign.
• Sovereignty: Negligible. There was no disruption to Switzerland's constitutional processes, border controls, or core government decision-making systems.
• Economic security: Negligible. The incident has negligible impact on Switzerland's overall economic stability, strategic industries, or technological competitive advantage.
• Societal stability: Minor. The incident caused tragic physical harm and local community distress, but does not threaten societal stability on a national scale, nor does it represent systematic algorithmic oppression.