During UNGA, our Executive Director Adam Hadley joined @farairesearch to discuss a question that is still not getting the attention it deserves: what about the use of AI by bad actors such as a terrorists and hostile nation states and how are we evaluating AI models for vulnerability to this sort of exploitation? Regardless of whether you're focussed on frontier / existential risks, it still boils down to the question of whether AI safety guardrails are adequate. For the most part we do not know. That's why Tech Against Terrorism built the first terrorism benchmark (CT-AI.org) In the session with FAR.AI I asked: what would it take for AI safety guardrails to be adopted and implemented at an international scale? How can we help to create a marketplace for safety using safety benchmarks as a forcing mechanism? What can we do? I provided three suggestions: 1) Sanctions: Proscribed terrorist organisations are subject to sanctions regimes. AI labs, interference providers, open weight model repo hosts, all elements of the AI infrastructure stack are working to prevent distillation attacks. I argue the same due diligence needs to be applied to prevent sanctioned entities or high-risk users paying for access to closed and open models. KYC is boring but important. 2) Abliteration: With open-weight models, safeguards are not merely circumvented; they are removed. Abliteration strips the refusal behaviour out of a model entirely, and it requires modest skill and modest compute. We should restrict the access to dangerous abliterated models where possible to reduce population-level proliferation. We must improve how we filter training data to remove harmful content from AI models. We should invest more in abliteration resistance research. 3) Benchmarks: We should create an ecosystem of safety and security benchmarks and invest political and social capital into ensuring they are taken seriously. This would ensure the AI labs are rewarded for good performance and held to account for failures. What has our CT AI benchmark found? The first round, published in July, graded 2,339 outputs from 27 leading models against almost 2,500 prompts drawn from real terrorist use cases. Only 57% were full refusals. Around a third of responses gave a would-be attacker genuinely usable assistance, beyond anything a web search already offers. In 15% of cases the model refused and then supplied the content anyway: a refusal that performs safety without delivering it. Version 2, which we previewed in New York and will publish next week, using 100,00 prompts, tests the full taxonomy of over 150 prompt types and examines whether a model offers meaningful uplift to someone who already intends harm. My thanks to FAR.AI for convening, and to my fellow panellists for an insightful exchange. #counterterrorism #aisafety #ctai ct-ai.org