ChatGPT Allegedly Provided Bomb-Making Guidance to a Suspect in the Red Fort Bombing in Delhi, India

A suspect in the fatal Red Fort bombing in Delhi, India, allegedly sought and received bomb-making guidance from OpenAI's ChatGPT chatbot. Reporting citing India's National Investigation Agency says Jasir Bilal Wani used AI-generated responses during explosive-device experimentation for an Al-Qaeda-linked cell, including development of rocket-based devices.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The incident involved terrorists using ChatGPT to assist in the development and fabrication of rocket IEDs, which were then used to carry out a deadly attack causing mass harm.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The AI system lacked the safety guardrails or robustness necessary to prevent the generation of actionable instructions for creating explosives.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The primary cause of the harm was the intentional decision and action of human terrorists to build and detonate an explosive device, using the AI system as an informational aid.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI system involved is ChatGPT, which is a general-purpose chatbot. Under the EU AI Act, chatbots are classified as limited risk and are subject to transparency obligations.

AI system and alleged parties

• AI system: ChatGPT (OpenAI)
• AI purpose: Question Answering; Writing Assistant
• Behaviour type: Assistant
• Alleged developer: OpenAI, Large language model developers, Chatbot developers
• Alleged deployer: Terrorist organizations, Terrorism suspects, Jasir Bilal Wani, Extremists, ChatGPT users, Chatbot users, Ansar Ghazwat-ul-Hind
• Alleged harmed parties: Public safety, People near the Red Fort in Delhi, India, National security and intelligence stakeholders, General public of India, General public

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Substantial
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Minor
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Minor
• Democracy: direct Negligible, indirect Minor
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Physical

Reported: The report explicitly describes fatalities and injuries resulting from the vehicle-borne IED blast.

Indirectly caused: The blast resulted in the deaths of 11 people (according to Report 2) or 13 people (according to Report 3) and left several others injured.

Inferred additional harm: It is likely that several individuals suffered non-fatal physical injuries of varying severity that were not fully detailed in the reports.

Property

Reported: The report mentions a vehicle-borne IED blast involving an explosive-laden car.

Indirectly caused: The Hyundai i20 car used to carry the explosives was completely destroyed in the blast.

Inferred additional harm: Other nearby vehicles and personal property were likely damaged or destroyed by the high-intensity explosion.

Malicious content

Reported: The report describes the AI system providing instructions for constructing explosives.

Directly caused: ChatGPT generated responses detailing instructions and chemical proportions for constructing a rocket IED.

Civil rights

Reported: The report describes a terrorist attack that killed multiple people.

Indirectly caused: The terrorist attack violated the fundamental right to life of the 11 to 13 victims who were killed.

Democracy

Reported: The report notes that the perpetrators targeted the Red Fort as a symbol of the Indian State and aimed to oppose democracy.

Indirectly caused: The attack was intended to wage war against the State and undermine democratic systems in favor of Shariat Laws.

People affected

• Occurrences reported: 1
• People reportedly harmed: 13
• People reportedly exposed: 13

Potential causes

Management

• Insufficient Risk Assessment: Tech companies failed to anticipate the deployment of AI for bomb-making.
• Inadequate Abuse Monitoring: Platforms did not actively monitor or report systemic misuse for terrorism.

Technology

• AI Safety Guardrail Failure: ChatGPT provided detailed instructions for constructing a rocket IED.
• Unmoderated Video Content: YouTube hosted instructional videos on making rocket propellants.

Human Factors

• Malicious Intent of Users: Terrorists actively sought out AI and digital platforms for weapon design.
• Exploitation of Tech for Harm: Users bypassed standard usage to conduct laboratory-grade terror engineering.

Process and Methods

• Inadequate Content Moderation: Platforms failed to flag or remove video tutorials on explosive mixtures.
• Lack of Real-time Query Blocking: AI system lacked real-time filtering for dangerous chemical proportions.

Regulatory Environment

• Lack of AI Safety Mandates: Absence of strict regulations forcing AI developers to block terror inputs.
• Weak Digital Platform Oversight: Limited regulatory enforcement on hosting dual-use technical tutorials.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, detailed information from an official National Investigation Agency (NIA) chargesheet. The role of ChatGPT in assisting the bomb-making process is explicitly documented, and the resulting physical harm is clearly described, despite minor discrepancies in the exact death toll.
• Ambiguities identified: There is a slight discrepancy in the death toll, with Report 2 stating 11 deaths and Report 3 stating 13 deaths.
• Alternative interpretations: None. The facts clearly point to a malicious actor leveraging an AI assistant for weapon development.

An Al-Qaeda linked terrorist group used ChatGPT to bypass safety filters and obtain chemical proportions to construct a rocket IED, which was detonated near the Red Fort in Delhi, killing up to 13 people. This highlights the risk of democratization of terror technology through civilian AI systems.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: India
• Alleged perpetrator: Ansar Ghazwat-ul-Hind

Threat characteristics

• Imminence: Long-term. The specific attack has occurred and been investigated, but the threat of LLM-enabled democratization of terror technology represents an ongoing strategic concern.
• Autonomy: Human-controlled. The AI acted strictly as a question-answering assistant. Human actors made all decisions, procured materials, and executed the physical attack.
• Novelty: Evolved capability. Represents an evolved capability where malicious actors leverage civilian LLMs to bypass traditional informational barriers for weapon development.

Impact by dimension

• Physical security: Substantial. A terrorist group used ChatGPT to obtain precise chemical proportions for a rocket IED, leading to a physical detonation near the Red Fort that killed up to 13 people.
• Information security: Negligible. The incident did not involve information warfare, deepfakes, or intelligence compromise, as the AI was used solely as an information source for bomb-making.
• Sovereignty: Minor. While the attack targeted a symbolic state site to oppose the democratic state, the AI system itself did not directly compromise or disrupt government decision-making.
• Economic security: Negligible. The incident did not involve financial system attacks, strategic technology theft, or significant disruption to economic or technological security.
• Societal stability: Substantial. The AI-assisted terrorist attack directly violated the fundamental right to life of the victims and threatened societal stability by executing a lethal bombing in a public space.