Meta’s BlenderBot 3 Chatbot Demo Made Offensive Antisemitic Comments

The publicly launched conversational AI demo BlenderBot 3 developed by Meta was reported by its users and acknowledged by its developers to have “occasionally” made offensive and inconsistent remarks such as invoking Jewish stereotypes.

Risk classification

• Primary risk domain: 1 Discrimination & Toxicity
• Primary risk subdomain: 1.2 Exposure to toxic content

The chatbot exposed public users to toxic and offensive content, specifically regurgitating antisemitic tropes and stereotypes.

Additional risk subdomains

• 3.1 False or misleading information: The chatbot generated false and misleading information, including election denial claims and bizarre personal hallucinations.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The offensive and incorrect outputs were generated by the AI system itself after it was deployed as a public demo, representing an unintended outcome of its conversational goals.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is a chatbot, which under the EU AI Act is subject to specific transparency obligations to ensure users are aware they are interacting with an AI.

AI system and alleged parties

• AI system: BlenderBot 3 3 (Meta)
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: Meta
• Alleged deployer: Meta
• Alleged harmed parties: Jewish people, BlenderBot 3 users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly exposed: 70000

Potential causes

Management

• Accepting Public Safety Risks: Management deployed live bot despite knowing it would make mistakes.

Technology

• Large Language Model Mimicry: Model mimics biased or offensive remarks from training.
• Model Hallucinations: Chatbot generates false claims such as being a human plumber.
• Imperfect Safety Safeguards: Existing safety filters failed to block all offensive outputs.

Data Inputs

• Open Internet Training: Model searches the web and mimics unvetted online information.
• Unfiltered User Queries: Public users manipulated responses with biased conversation inputs.

Human Factors

• Adversarial User Prompts: Users intentionally tested chatbot boundaries with sensitive topics.

Process and Methods

• Public Deployment for Feedback: Using the public as live testers to identify model safety flaws.

Regulatory Environment

• US-Centric Free Speech Laws: US regulations allowed launching chatbot despite offensive outputs.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, consistent, and detailed accounts of the chatbot's behavior, its release context, and the specific offensive outputs it generated. There are no major contradictions between the sources.

Meta's public demo of BlenderBot 3 generated offensive content, including antisemitic tropes and election misinformation, after learning from public interactions. While illustrating ongoing challenges in AI alignment and toxicity, the incident represents a minor national security concern, lacking coordinated foreign influence or systemic disruption.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding AI safety and alignment rather than an active crisis requiring immediate national security response.
• Autonomy: Human-supervised. The chatbot generated responses autonomously based on user prompts, but operated within a monitored research demo environment with Meta oversight.
• Novelty: Established threat. Large language models generating toxic outputs, hallucinations, and repeating internet biases is a well-established vulnerability.

Impact by dimension

• Physical security: Negligible. No kinetic threat, physical harm, or critical infrastructure disruption was reported in connection with this chatbot demo.
• Information security: Minor. The chatbot generated election denial claims and antisemitic tropes, but this was a public research demo rather than a coordinated foreign information operation or intelligence compromise.
• Sovereignty: Negligible. No compromise to government decision-making, electoral systems, or constitutional processes occurred during this incident.
• Economic security: Negligible. No strategic technology theft, financial market disruption, or critical supply chain vulnerabilities were reported.
• Societal stability: Minor. The chatbot generated offensive antisemitic tropes and election misinformation, but it did not cause large-scale civil unrest or systematic rights violations.