Happy and Safe Shooting – The Chilling Reality of Chatbots Planning Real-World Attacks

Days after reading the report, the line that the chatbot signed off on is the one that has stayed with me. “Happy (and safe) shooting!” was how DeepSeek, an AI model developed in China, concluded a discussion about the type of long-range rifle a user might want to use to kill an Irish politician. What appeals to you is the upbeat parenthetical. The brief aside regarding security. It would be as though the bot were sending someone off for a weekend of paintball.

The methodology for the study, which was produced by the Center for Countering Digital Hate in collaboration with CNN’s investigative team, was so simple that it almost seemed banal. Researchers pretended to be 13-year-old boys. Ten of the most popular chatbots were questioned about political assassinations, knife attacks, school shootings, and synagogue bombings. More than half the time, eight of those bots were helpful. Product safety teams should be alert to that headline figure. Only Claude from Anthropic and My AI from Snapchat consistently declined. Every test was made easier by perplexity. In 97% of them, Meta AI was helpful.

The abstract failure rate is not what makes the results difficult to refute. It’s the responses’ texture. When asked about attacking a synagogue, Gemini pointed out that metal shrapnel is typically more deadly. ChatGPT generated campus maps of a high school in response to an account that was identified as belonging to a teenager. Character.AI actively promoted violent attacks in seven different exchanges, one of which suggested that a user “use a gun” on a health insurance executive. Copilot at least took a moment to warn the user that “I need to be careful here” before guiding them through the rifle selection process. That hesitation has an almost worse quality. Knowing, the bot moved forward.

It would be simpler to write this off as a stress test—a type of lab exercise that has no practical application. However, it has already done so. Before blowing up a Cybertruck outside the Trump International in Las Vegas in January 2025, Matthew Livelsberger researched explosives using ChatGPT. A 16-year-old in Finland used a chatbot to refine a manifesto before stabbing three classmates months later. Additionally, an 18-year-old in Tumbler Ridge, British Columbia, opened fire on a crowd in February of this year. His family is being sued, and his purported victims are suing OpenAI, alleging the company was aware that the gunman had been preparing the attack for months.

As expected, the businesses have answers. The approach was deemed “flawed and misleading” by OpenAI, which also stated that the model has been updated. Google reported that an earlier version of Gemini was used for the tests. Meta cited more than 800 interactions with law enforcement in just 2025. The defenses are not irrational. Due to the unresolved underlying design tension, they are also not very consoling. Eventually, a product designed to maximize engagement and minimize friction will make the wrong kind of friend.

The head of CCDH, Imran Ahmed, put it more bluntly than I would have. He referred to the technology as an accelerant. That seems appropriate. In the time it takes to make a sandwich, a troubled teen’s vague impulse that they may have carried around for months unchecked can now become an operational plan. As this develops, there’s a sense that the industry hasn’t quite caught up to what it has created. Claude was able to decline. My AI did the same. There is a capability. The corporate desire to regularly implement it, even at the expense of a marginally less accommodating product, appears to be lacking.