Boko Haram Built AI Units for Explosives Design, Attack Planning as ISIS Taught Jailbreaks

A landmark Cambridge study published Friday by the University of Cambridge has confirmed what AI safety researchers feared but could not document until now: a named terrorist organization has institutionalized frontier AI tools into its military command structure, ISIS operatives have been delivering in-person jailbreak training to its commanders since at least 2023, and the voluntary safety commitments made by the world's largest AI companies have repeatedly failed to stop it.

The research — conducted by Antonia Jülich, International Security Lead at Cambridge's Programme on AI Science and Policy (CASP) — is based on 57 face-to-face interviews with 27 former members of Boko Haram conducted in northeast Nigeria over 2025 and 2026. It documents that both major factions of the Nigerian jihadist group — Islamic State West Africa Province (ISWAP) and Jamā'at Ahl as-Sunnah lid-Da'wah wa'l-Jihād (JAS) — have created dedicated AI units, use every major chatbot platform on the market, and received structured training on how to break past those platforms' safety filters. The exploitation is not incidental or experimental. It is organized, trained, and ongoing.

Before any AI company's response to this study is evaluated, one finding must be stated plainly: every platform named in the research — ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek — prohibits use for terrorism or violent purposes. Every platform named in the research failed to prevent that use, repeatedly. And the mechanism of failure — social engineering of safety filters by trained users who techniques, rotate accounts, and query six systems simultaneously — is not a bug that the model update will patch. It is a structural property of how general-purpose AI models work.

Policymakers and readers who have been told that AI companies are "continuously strengthening" their safety measures now have empirical data on what "continuously strengthening" means in the field: it means the safeguards were defeatable when Boko Haram members learned to bypass them in 2023, remained defeatable when more platforms were added, and remained defeatable when the Cambridge study concluded in 2026.

The organizational structure Jülich documents is the study's single most significant finding. Both ISWAP and JAS did not simply permit individual fighters to use AI tools. They created specialist units whose explicit mandate is to query AI systems, translate outputs into operational guidance for the chain of command, and run internal training sessions for commanders.

These units manage accounts and paid subscriptions across multiple platforms, with logistical support from Islamic State-linked contacts outside Nigeria. Access within the groups is deliberately rationed: lower-ranking fighters were generally not permitted to use the platforms themselves. Questions were escalated up the hierarchy to commanders or AI unit members, who used the systems and fed answers back down.

"They assembled the top people in a room and used a projector to show how it works on a big screen," Jülich told The Decoder .

This is not the picture of scattered opportunistic misuse that prior assessments described. It is the picture of a capability that has been institutionalized — given people, devices, payment infrastructure, and access rules — in a way that makes it more durable than the knowledge of any single member.

The most alarming detail in the study is not the use of AI itself but the mechanism by which that knowledge spread. From at least 2023 through 2025, Islamic State operatives provided in-person AI training to Boko Haram commanders — covering not just basic prompting, but specifically how to defeat the safety filters deployed by AI companies.

One documented training session brought together approximately 30 to 50 ISWAP leaders and selected fighters from across the faction's territory. Foreign operatives provided laptops, explained how to prompt the models, and demonstrated jailbreak techniques. JAS members received similar training through separate jihadist contacts .

Jülich's study characterizes this as transnational knowledge transfer through established jihadist networks — the same routes that have long carried weapons skills, drone expertise, and battlefield tactics between armed groups across Africa and beyond. That framing is significant: it means the governance tools designed to intercept physical weapons transfers (export controls, border monitoring, sanctions) do not apply to this knowledge category at all. A jailbreak technique is a document, or a set of prompts. It travels at zero cost, requires no materials, and leaves no physical trace.

Former Boko Haram members described using AI across the full operational cycle — before attacks, during operations, and after them.

Before attacks, AI tools were used to identify seized military hardware, design more powerful explosive devices, and troubleshoot weapons in the field. One former member described the progression: "Before, the bomb explosion was not that big, but then they studied it. AI told us what chemicals to put in that made the explosion heavier," according to the Cambridge study .

After attacks, the AI units were used to review what went wrong and suggest improvements. One former fighter described a shift in tactical doctrine: "We sent 200 fighters because we had a lot of strength, but then 60 got killed. With the help of AI, we learned that it sometimes makes sense to only send 20. We learned more well-coordinated attacks and deployment of smaller units."

The motorcycle assault episode illustrates both the utility and the limits of this approach. When an ISWAP assault on a military base was stopped by a defensive trench, the group turned to AI chatbots for a solution.

"We saw in a movie how motorcycles can jump over bridges," a former ISWAP commander told Jülich. "We used AI to learn how to do this. We gave it information, like what motorcycles we use and the distance we need to jump and so on, and it gave us steps on what we have to do."

Mechanics modified the group's motorcycles for higher acceleration and top speed. Fighters dug practice pits, filled them with broken glass and fire, and rehearsed the jump — at fatal cost. Eighteen fighters died during training. Eight successfully completed the jump. The group went on to execute a follow-up assault using the technique.

The chatbot generated no novel engineering knowledge. It synthesized existing information and delivered it in conversational, step-by-step form, tailored to the specific parameters provided. That synthesis proved operationally useful in a way that generic web likely would not have been.

Understanding why these failures occurred requires a brief explanation of the technology. The safety guardrails on major AI chatbots are built on top of reinforcement learning from human feedback (RLHF), a training process in which human raters evaluate model responses and the model learns to optimize for what raters prefer.

RLHF creates models that are structurally biased toward helpfulness and cooperative interpretation of user intent. That same quality makes them exploitable. The training does not give a model a robust internal understanding of what is harmful versus what is not; it gives it a learned preference for giving users what they appear to want. A sufficiently patient adversary who frames a harmful request as a legitimate one — bomb-making research as a film production project, weapons troubleshooting as academic inquiry — can often get past the refusal behavior that RLHF trained in.

Academic research on this attack surface , known as intent manipulation, has documented success rates of 88 to 97 percent against the most advanced chain-of-thought safety defenses on current frontier models. The Boko Haram members described exactly these techniques: "You type in the question... and it gives you a detailed answer," one former member said. "We used it a lot." The group regularly disguised dangerous requests as legitimate activities.

The platform-agnostic approach compounded the problem. Experienced Boko Haram members deliberately cross-referenced multiple systems, comparing responses from ChatGPT, Claude, Gemini, Grok, and DeepSeek to identify which gave the most useful or least restricted answers to a given query. When one platform refused a request, another was queried. When one account was flagged, a new one was created. Each company's safety team monitors its own logs. None monitors the aggregate pattern of the same adversary group querying all six simultaneously.

OpenAI, Google, and Anthropic each stated that their platforms prohibit use for terrorism or violent purposes and that safety measures are continuously being improved.

OpenAI spokesperson Drew Pusateri said the company would "continue strengthening our defenses" against bad actors. Google and Anthropic both confirmed their models are designed to reject dangerous requests.

None of the three companies disputed the study's central findings.

That measured non-denial matters. It confirms that the Cambridge study's documentation of repeated successful jailbreaks is accepted, not contested, by the platforms whose filters failed.

Daniel Byman, director of the Warfare, Irregular Threats, and Terrorism Program at the Center for Strategic and International Studies , co-published an independent brief on AI and terrorism on the same day as the Cambridge study. He confirmed from a separate research track that extremist groups were "mixing and matching" AI systems specifically to avoid technical guardrails.

The Cambridge and CSIS findings together illuminate a governance problem that has no precedent in prior dual-use technology policy. Export controls, the Wassenaar Arrangement, sanctions, and physical interdiction were all designed around one assumption: that dangerous knowledge requires dangerous materials that can be seized, monitored, or denied at borders. AI jailbreak knowledge requires none of these. It is a set of prompts and techniques that travels as text, costs nothing to reproduce, and is undetectable in transit.

When ISIS trained Boko Haram commanders in weapons construction or drone operation in prior years, those training events involved physical materials with supply chains governments could monitor. When ISIS trained Boko Haram commanders in AI jailbreaking in 2023, the training materials were documents and laptop demonstrations that passed through any border the trainers crossed without triggering any interdiction mechanism. That distinction is not yet reflected in any country's counter-proliferation framework.

The Cambridge study is careful what it claims. Jülich and other researchers cited in the report note that AI chatbots in their current form mostly make existing knowledge easier and faster to locate — they do not typically generate genuinely novel dangerous information that could not be found through other means.

The Boko Haram use documented so far is, in Jülich's characterization, "conventional" — it has aided traditional weapons and tactics, not weapons of mass destruction. But the study raises an explicit warning the trajectory: "Former members described strong enthusiasm for AI, and some said the group had previously considered mass-casualty weapons. Though Boko Haram's use of AI remains conventional, this should be a warning to take seriously the risk of terrorists pursuing AI assistance for chemical and biological weapons."

The more serious concern flagged by researchers is not general-purpose chatbots but specialized AI systems in life sciences and chemistry — models with deep domain expertise that could provide genuinely novel uplift to groups seeking to develop biological or chemical weapons. The Cambridge study provides empirical grounding for taking that risk seriously.

For the governance debate, Jülich argues for two specific changes: mandatory third-party pre-deployment safety evaluation of general-purpose AI models, and structured information sharing between AI companies and security agencies misuse patterns in the field. Both exist in nascent forms in some regulatory proposals; neither is currently legally required anywhere.

"The terrorists are not waiting for us to make AI safe," Jülich said . "They are able to use them now and train them to cause harm. Governments, AI companies and researchers need to move faster, evidence sooner, and test these systems against trained groups that methods, switch accounts and keep coming back."

Both factions created dedicated units whose role was to query AI platforms on behalf of commanders and translate outputs into operational guidance. Former members described querying ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek across a range of tasks: identifying seized military hardware, designing more powerful explosive devices, troubleshooting weapons in the field, advising on small-unit battlefield tactics, and reviewing past operations to learn from failures. Access was tightly controlled — lower-ranking fighters generally could not use the tools themselves, and questions were passed up to AI unit members who used the systems and fed answers back down the hierarchy.

Yes, and the Cambridge study documents exactly how it happened. Trained Boko Haram users employed social engineering — framing dangerous requests as legitimate activities like film research or academic projects — which exploits a structural property of how AI models are trained. These models are optimized for helpfulness and cooperative interpretation of user intent, which makes them vulnerable to intent disguise. Additional techniques included account rotation when flagged, cross-referencing six platforms to find the least restricted response, and direct training from ISIS operatives on specific jailbreak approaches. Academic research on this attack surface shows success rates of 88 to 97 percent against current safety defenses on frontier models.

Each company's safety team monitors its own platform. No mechanism exists for cross-platform intelligence sharing, so when the same adversary group queries ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek in sequence to find the most permissive response, no single company's system sees the full pattern. An improvement at one company provides only partial protection when five others are available. Additionally, open-source AI models with no meaningful safety constraints — there were over 368,000 text-generation models on Hugging Face as of May 2026 — provide a permanently available alternative that no commercial platform's policies can address. The Cambridge study argues that mandatory third-party safety evaluation and structured government-company intelligence sharing are necessary because self-regulation has not survived with organized, persistent, trained adversaries.

When terrorist networks transferred prior weapons knowledge — bomb-making techniques, drone operation, firearms maintenance — those transfers involved physical materials, equipment, or the physical presence of trainers who crossed borders with detectable training materials. AI jailbreak knowledge transfers as text, at zero cost, in ways that pass through any existing border control or interdiction mechanism without triggering any surveillance. Export controls, the Wassenaar Arrangement, sanctions regimes, and physical interdiction tools were all designed around the assumption that dangerous knowledge requires dangerous materials. AI jailbreaking requires none. No country's counter-proliferation framework currently addresses this gap, which the Cambridge and CSIS studies together identify as the most urgent structural challenge in AI terrorism governance.