Cambridge Interviewed 27 Former Boko Haram Fighters. They Were Using the Same Chatbots You Are.

TL;DR

A new Cambridge report, "God has helped us, and so will AI": How the Terrorist Group Boko Haram Uses Frontier AI, is the first field study of AI adoption inside an active terrorist organization. Researcher Antonia Juelich of the Cambridge Programme on AI Science & Policy conducted 57 face-to-face interviews with 27 former Boko Haram members in northeast Nigeria. What they described is not propaganda experiments. Both major factions systematically used ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek for weapons support, attack planning, and after-action review, ran dedicated AI cells to do it, and got past safety filters mostly by asking nicely with a cover story. The study surfaced in a New York Times feature on July 10 and hit wide circulation on July 11.

The study nobody had done

Everything the industry knows about AI misuse by violent groups has come from two places: lab red-teaming, where researchers attack their own models, and platform telemetry, where vendors spot suspicious accounts after the fact. This report is the missing third source: the users themselves. Juelich sat across from former fighters, commanders, and technical specialists and asked what they actually did with these tools.

If lab jailbreak evals are crash-testing a car on a closed track, this is the first time someone pulled the real accident reports. The track tells you what the car can survive. The reports tell you what actually happens on the road, and the two rarely agree.

What the fighters said they used it for

The headline finding is breadth. The prevailing assumption in the counterterrorism literature has been that jihadist AI use is slow-moving and mostly limited to propaganda. The interviews describe something else: AI embedded across the operational cycle, from troubleshooting weapons and identifying captured military hardware to advising on battlefield tactics and reviewing attacks after the fact.

One anecdote from the coverage sticks: after an assault on a military base was stopped by a defensive trench, fighters went back to the chatbots for advice on modifying motorcycles to get across obstacles like it. Former members told Juelich the tools contributed to more powerful explosives and better-coordinated attacks by smaller units. Whether every claim is precisely true (more on that below), the direction of travel is the point.

An org chart, not a prompt trick

The detail that should stop a builder mid-scroll is not a clever prompt. It is structure. According to the report, each faction stood up a dedicated AI cell sitting behind the frontline. Its job was to take a question from the field, query several chatbots, compare the answers, distill them into usable advice, and hand that back up the chain of command. The cells also trained commanders on how to drive the tools.

Picture an internal research desk, except the client is a mortar crew and the reference library is six frontier models. That is not idle curiosity. It is an institution treating a consumer chatbot as tier-one technical support, staffing and workflow included.

The jailbreak was boring

Here is the uncomfortable part for anyone who ships a safety layer. Fighters got past refusals mostly by disguising harmful requests as legitimate work, most memorably by framing them as research for a film production. The cover story was that they were making a movie, and it held up across six different labs' safety teams. Islamic State operatives, per the report, spread these techniques through in-person and remote coaching, and users routinely shopped the same question across platforms to route around whichever model said no.

This is the operational truth that leaderboards hide. A guardrail is not a locked vault door; it is a bouncer who is right most nights. Against a casual user, most nights is plenty. Against a motivated adversary who will rephrase the same request ten ways across six models until one answers, a probabilistic filter is a speed bump, not a wall. The study is a field measurement of exactly that gap.

What the labs said

OpenAI said using its products for terrorism or violence is strictly prohibited and that it keeps hardening its defenses against misuse. Google and Anthropic said their models are built to refuse dangerous requests and that those protections keep improving. None of that is wrong, and none of it contradicts the finding. Both things are true at once: the labs invest heavily in refusals, and a determined group still got what it wanted. Anthropic's own long-standing public line is that jailbreaks are unlikely to ever be fully eliminated, which is the honest version of the same sentence.

The caveats worth keeping straight

Read this as field testimony, not a benchmark. The evidence is self-reported by former fighters who have their own reasons to talk, and the report is careful about which claims can be corroborated, so treat specific boasts about "more powerful explosives" as accounts rather than measured effects. The through-line that survives the skepticism is behavioral: these tools were reached for, repeatedly, across the whole operational cycle.

The other calibration matters more for builders. Today's general chatbots mostly lower the effort of reaching knowledge that already exists rather than inventing new capabilities, which is why the sharper concern in the literature attaches to specialized systems, not to a chat window that answered a motorcycle question. The uplift is access and speed, not novel science. That is bad enough, and it is a different problem than the one a bigger refusal filter solves.

Why a builder should care

You are not defending a chatbot from Boko Haram. But the mechanism generalizes straight into your stack. Wire a model into an agent with tools, a retrieval layer, or a code executor, and you inherit the same probabilistic boundary, now with real actions bolted to it. The lesson here is not that models are dangerous. It is that the model's own refusal is the weakest control you can build on, because it degrades exactly when the input is adversarial and persistent.

So put your real controls where the actions happen. Tool permissions, sandboxing, human approval on irreversible steps, rate limits, and logging are load-bearing. The system prompt that says "refuse harmful requests" is a courtesy, not a boundary. This study is the most concrete reminder yet that treating it as a boundary is how you get surprised.

Key Takeaways

• The first field study of AI use inside an active terrorist group (57 interviews, 27 former Boko Haram members) documents systematic use of six frontier chatbots: ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek.
• Both factions ran dedicated AI cells that queried multiple models, compared answers, and turned them into orders. That is organized adoption, not casual misuse.
• Use spanned weapons support, tactical planning, operational security, and after-action review, far beyond the propaganda uses prior analysis assumed.
• Refusals were bypassed with mundane social engineering, notably framing requests as film research, and by shopping the same query across models.
• OpenAI, Google, and Anthropic reaffirmed their safeguards; the finding is that heavy investment in refusals still did not stop a motivated adversary.
• Builder takeaway: treat the model's refusal as the weakest control. Enforce at the tool, sandbox, and approval layer where real actions occur.

Sources: Cambridge Programme on AI Science & Policy report, The Decoder, Futurism, The News Chronicle, Vanguard