18-Year-Old Islamic State Supporter in Vienna, Austria, Reportedly Sought and Received Explosives Advice From ChatGPT Amid Disputed Embassy and Mosque Attack Allegations

An 18-year-old Islamic State supporter in Vienna, Austria, reportedly sought and received explosives advice from ChatGPT amid allegations of plans to attack the Israeli embassy and a Shiite Islamic center. He was convicted of terrorist association, threats, and coercion. The court acquitted him of terrorist training and instruction charges and found no evidence of preparations for a specific crime.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The user leveraged ChatGPT to obtain instructions for manufacturing explosives and to discuss plans for carrying out terrorist attacks, representing a malicious use of AI to facilitate weapon development and potential mass harm.

Additional risk subdomains

• 1.2 Exposure to toxic content: The AI system failed to restrict or filter instructions on manufacturing explosives, exposing the user to dangerous and illegal content.
• 5.1 Overreliance and unsafe use: The radicalized youth relied heavily on ChatGPT as a conversational partner and 'best friend' to validate and discuss his extremist ideas and plans.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was driven by a human user who intentionally utilized a deployed AI system to assist in planning terrorist activities and obtaining instructions for manufacturing explosives.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system involved is ChatGPT, which is a general-purpose chatbot. Under the EU AI Act, chatbots are classified as Limited Risk (Level 3) and are subject to transparency obligations to ensure users know they are interacting with AI.

AI system and alleged parties

• AI system: ChatGPT (OpenAI)
• AI purpose: Chatbot; Writing Assistant
• Behaviour type: Assistant
• Alleged developer: OpenAI, Large language model developers, Chatbot developers
• Alleged deployer: Terrorism suspects, ISIS supporters, Extremists, ChatGPT users, Chatbot users
• Alleged harmed parties: Shia Muslims, Religious communities, Muslims, Imam Ali Islamic Center (Vienna, Austria), Government of Israel, Embassy of Israel in Austria, Diplomats

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report explicitly describes the user obtaining bomb-making instructions and discussing extremist plans.

Directly caused: The AI system directly generated and provided instructions on the ingredients and methods for manufacturing explosives at home to the user.

People affected

• Occurrences reported: 1
• People reportedly exposed: 100

Potential causes

Management

• Insufficient Risk Assessment: Management failed to anticipate or mitigate dual-use chemical risks.

Technology

• Inadequate Safety Guardrails: ChatGPT failed to block queries about manufacturing explosives.
• Flawed Intent Detection: The model did not recognize malicious intent in bomb-making queries.

Data Inputs

• Harmful Training Data: Model training data included detailed chemical synthesis recipes.

Human Factors

• Malicious User Intent: An individual actively sought instructions to build bombs and plan attacks.
• AI Anthropomorphism: The user treated the AI as a 'best friend', deepening radicalization.

Process and Methods

• Deficient Red Teaming: Testing failed to identify bypasses for weapon and explosive queries.
• Weak Real-time Monitoring: The platform lacked live oversight to flag active terror planning.

Regulatory Environment

• Lack of AI Safety Mandates: No strict regulations exist to enforce blocking of hazardous instructions.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear and consistent details regarding the user's actions, his trial, his use of ChatGPT to obtain bomb-making instructions, and his arrest. The role of the AI is explicitly stated, and there are no major conflicting accounts of the core events.
• Ambiguities identified: The exact prompts used and the precise nature of the bomb-making instructions provided by ChatGPT are not fully detailed.

An Austrian teenager used ChatGPT to plan terrorist attacks and obtain bomb-making instructions. The plot was successfully disrupted by law enforcement, resulting in no physical harm. The incident highlights the evolved threat of AI being utilized for personalized online radicalization and tactical planning, though the overall national security impact remains minor due to successful interdiction.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Austria
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The suspect has been arrested and sentenced, making this an ongoing strategic concern regarding AI-enabled radicalization rather than an active crisis.
• Autonomy: Human-controlled. The AI acted strictly as an assistant and conversational partner, with the human user retaining full control over decision-making and execution.
• Novelty: Evolved capability. Represents an evolution of online radicalization and weapon-recipe seeking from web forums to interactive, personalized AI chatbots.

Impact by dimension

• Physical security: Minor. A planned attack on an embassy and religious center was foiled by authorities. AI was used to obtain bomb-making instructions, but no physical damage occurred.
• Information security: Negligible. No significant intelligence compromise or information warfare operations occurred.
• Sovereignty: Minor. The plot targeted a foreign embassy on sovereign Austrian soil, but was successfully disrupted by law enforcement before causing disruption to government functions.
• Economic security: Negligible. No significant threats to economic stability or strategic technological assets were identified.
• Societal stability: Minor. The threat targeted a religious minority center, which could have impacted social cohesion, but timely intervention prevented societal disruption.