The threat of the use of chemical, biological, radiological and nuclear (CBRN) weapons by terrorist groups has received substantial attention over the years. Terrorist groups have shown interest in producing CBRN weapons, but so far have been unsuccessful in managing to create them. To genuinely grasp the threat posed by the terrorist use of CBRN weapons, intelligence agencies mainly consider two factors: intent, meaning the purpose or objective that drives an actor to engage in terrorist activities, and capability, meaning the actor’s ability to plan, organise, and execute acts of terrorism successfully. Unlike states, terrorists are difficult to deter, making their intent unpredictable and difficult to challenge. Regarding capability, the complexity of producing and deploying CBRN weapons varies significantly based on the type of weapon and its intended effects. For instance, manufacturing a nuclear weapon poses a far greater challenge than creating certain chemical or biological weapons, as nuclear weapon development demands substantial resources and sophisticated technical knowledge. Therefore, the chances of terrorist groups obtaining the required capabilities for creating nuclear weapons are low.

State sponsorship can significantly boost these capabilities. A state could offer materials, expertise, or other resources to aid a terrorist group in developing CBRN weapons. Yet, with advances in artificial intelligence (AI) and other emerging technologies, seeking state sponsorship might not be the sole option for terrorist groups. The full extent to which AI and large language models (LLMs) may assist terrorist groups in developing CBRN capabilities is a matter of contention, as experts disagree on how worried those working in security should be about LLMs enabling terrorists to acquire CBRN weapons. In addition, as LLMs are developing at a fast pace and existing models are being further trained, conducting an up-to-date threat assessment remains challenging.

However, given the intricacies of nuclear technology and the challenges in acquiring radiological materials, it is more likely that LLMs could enhance terrorists’ capacity to weaponise chemical and biological agents. In these areas, research has shown that  LLMs could indeed support the acquisition of technical expertise for the production of chemical and biological weapons.

Cases of chemical and biological terrorism 

Between the 1980s and the 2000s, there were multiple instances of chemical and biological weapons being used by terrorists, which, despite their psychological impact on the public, caused relatively few casualties. This was mainly due to the difficulties encountered in the effective weaponisation of chemical and biological agents, which required specialised knowledge typically beyond the reach of non-practitioners. Terrorist groups often employed rudimental methods to deploy these weapons. For example, the 1990 chemical attack conducted by the Tamil Tigers, the first instance of modern chemical terrorism, was relatively rudimentary, involving the strategic release of chlorine gas under favourable wind conditions.

Similarly, Aum Shinrikyo’s use of unsophisticated means of delivery for the 1995 Tokyo sarin gas attack constrained the effectiveness of the terrorist act, limiting the number of casualties. However, the capabilities of some terrorist groups have advanced, elevating the threat level. For instance, from 2014 to 2017, the self-styled Islamic State demonstrated enhanced chemical warfare capabilities by using mustard gas in Syria and Iraq.

Similar conclusions have been drawn for the cases of biological terrorism. The 1984 Rajneeshee bioterror attack in the Dalles, Oregon, was the first bioterror incident on U.S. soil. This attack, carried out by followers of Bhagwan Shree Rajneesh, involved contaminating salad bars with Salmonella in an attempt to influence a local election and incapacitate voters, resulting in 751 people falling ill. Although there were no fatalities, the event had significant psychological impacts, exemplifying the profound effects often associated with biological terrorism.

Nevertheless, when terrorist groups tried to carry out more lethal bioterrorist attacks, they failed. For example, Aum Shinrikyo’s effort to launch a biological attack using anthrax and botulinum toxin was not successful, primarily due to a lack of tacit knowledge. Their lead biologist, Seiichi Endo, managed to cultivate a strain of anthrax, but he lacked the expertise to produce a lethal, weaponised form. The strain he developed was only appropriate for vaccination and was not harmful to humans.

Overall, observers have identified several obstacles that hinder terrorist groups’ effective acquisition and weaponisation of chemical and biological weapons. These barriers include limited capabilities, resources, and access to information. Additionally, a key issue highlighted by researchers is the limited technical expertise of terrorist affiliates, which constitutes a significant impediment to their ability to use chemical and biological weapons successfully.

The importance of knowledge in the terrorist acquisition of chemical and biological weapons

In 2015, the self-styled Islamic State (IS) became the first terrorist group to integrate the production of a banned chemical warfare agent with missile delivery capabilities. This development arose from the specialised team that self-styled IS recruited to advance its chemical weapons programme. From 2014 to 2017, during their control of Mosul, the self-styled IS carried out at least 76 chemical attacks in Syria and Iraq. However, these attacks used less deadly agents as opposed to highly lethal nerve agents like sarin, resulting in relatively few casualties. The limitations of the self-styled IS’s chemical programme were mainly due to the low level of expertise amongst its members, few of whom had the advanced technical knowledge necessary to produce more dangerous weapons beyond the low-grade mustard agent commonly used.

Alarmingly, a 2017 plot discovered in Australia showed that the self-styled IS was able to securely send instructions for making toxic chemicals online to operatives abroad and to smuggle materials, including explosives, without detection. Despite the fall of the self-styled IS, the United Nations Investigative Team to promote accountability for Crimes Committed by Da’esh / self-styled Islamic State in Iraq and the Levant (UNITAD) has warned against chemical attacks by the group, as their investigations indicate that the self-styled IS still maintains a significant global presence through the dark web. This could enable the Organisation to orchestrate attacks similar to the one uncovered in 2017.

Even more concerning is the 2018 Cologne ricin plot, as it demonstrated that radicalised individuals could produce a biological weapon without any prior expertise, relying solely on online tutorials. Instructional materials on how to produce and weaponise ricin were disseminated through videos and manuals on Telegram. This demonstrates how technological advancements have made knowledge more accessible, enabling individuals without technical backgrounds to carry out biological and chemical attacks. Moreover, these cases represent a significant departure from the efforts of the Aum Shinrikyo cult in the 1990s to develop biological weapons. Despite their considerable resources, Aum Shinrikyo lacked the necessary technological knowledge to implement their plans successfully. In light of present technological advancements, the barriers to acquiring knowledge for the development and use of effective biological weapons are lower.

The potential use of LLMs to acquire knowledge of chemical and biological weapons

As previous terrorism cases show, malicious non-state actors have often failed to effectively employ chemical and biological weapons due to limited expertise, resources, and access to information. Recent evidence on the 2017 Australian plot and the 2018 Cologne ricin plot testify to the role of technology, in particular online services, in lowering these barriers and supporting terrorists in acquiring chemical and biological capabilities. These cases, however, also show that online activities like accessing online tutorials and communicating dual-use information through the internet are warning signs pointing to illicit activity, thus exposing the terrorists to law enforcement.

In this sense, LLMs can become useful tools in the hands of malicious actors. LLMs provide a means of conveying difficult-to-find but publicly accessible information at the click of a button. This “democratisation” of the scientific knowledge needed for the manufacture of CRBN weapons has the potential to greatly enhance the effectiveness of terrorist activity. This can facilitate terrorists in better understanding scientific research and, potentially, employing technical expertise. Additionally, LLMs can reduce the reliance of terrorists, in particular lone actors, on “middle-men”, who would send the information, and on online groups that would post links to tutorials and/or magazines containing instructions on how to create chemical and biological agents. The “do-it-yourself” opportunities provided by LLMs can create additional challenges to law enforcement detection of terrorist activities and, therefore, further facilitate terrorists in gaining dual-use scientific knowledge.

Despite the opportunities LLMs might offer to terrorists, it has been acknowledged that their immediate impact on chemical and biological security is limited due to the complexities of effectively mastering and weaponising chemical and life sciences processes. Nonetheless, upcoming technological advances can make scientific experimentation more accessible to individuals with limited resources and knowledge. More specifically, LLMs could support the development of expertise to design and synthesise chemical and biological agents.

In the field of chemistry, chemical language models (CLMs) are becoming particularly effective in generating molecules with desired properties. As recent studies have shown, LLMs could be trained on toxicity datasets to design toxic molecules for the synthesis of chemical agents. For example, experiments have shown that LLMs could be prompted to design molecule analogues for the VX nerve agent. Notably, the VX nerve agent has already been weaponised by terrorist groups in the past, namely by Aum Shinrikyo in 1994, demonstrating the intent of terrorist groups to employ chemical agents. Therefore, it is plausible that other terrorist groups could be interested in acquiring this deadly agent and might be aided in developing the necessary theoretical knowledge through LLMs. Similarly, LLMs can support the acquisition of knowledge on biological agents. For instance, an experiment conducted at the Massachusetts Institute of Technology (MIT) proved that LLMs can provide key information on how to purchase laboratory equipment and DNA sequences, and how to conduct reverse genetics for the influenza virus, even for individuals with limited prior knowledge of these technologies. Moreover, LLMs for protein design like ProtGPT2 and ProGen can be misused to redesign protein structures of toxins like ricin to challenge detection techniques. These advances are particularly relevant considering that groups like Al Qaeda and the IS showed interest in the weaponisation of ricin in the past and could attempt to acquire it in the future.

Potential responses to mitigate the LLMs’ proliferation risks

Key private sector actors have acknowledged the potential proliferation risks stemming from LLMs. Their involvement in multilateral discussions on the proliferation risks stemming from LLMs is crucial and should be pursued to pave the way for more in-depth technical discussions. Key international organisations and bodies could serve as platforms to foster dialogue among multiple stakeholders and raise awareness of LLMs’ proliferation risks.

For instance, the Biological Weapons Convention Implementation Support Unit could involve the private sector in a side event dedicated to LLMs held at the margins of the next BWC Review Conference. Such an event could follow the example of the 2022 International Workshop on “Artificial Intelligence Assisted Chemistry” that took place at the headquarters of the Organisation for the Prohibition of Chemical Weapons.

Moreover, following the recommendations of the Executive Order on AI recently issued by US President Biden, private companies should continue to engage diverse stakeholders in red teaming exercises. Red teaming aims to assess LLMs’ responses, identifying and predicting potentially harmful behaviours; red teaming exercises focused on the non-proliferation of CBRN capabilities should become a key preventive tool to employ. A recent example to follow is the RAND Corporation red-team study conducted in the area of LLMs and biological terrorism. Similar exercises can help monitor advances in LLMs, their security implications, and better assess their actual risks for the non-proliferation of CBRN capabilities among terrorists.

In the field of chemistry and biology, LLMs’ developers should involve experts from the industry and national laboratories in red teaming exercises. Exercises’ findings could be shared across the public and private sectors to better assess LLM’s responses, evaluate the effectiveness of refusal mechanisms preventing the model from providing potentially harmful outputs, and, eventually, deploy more robust AI models.

Image credit: Wikimedia Commons / West Midlands Police

The opinions articulated above represent the views of the author(s) and do not necessarily reflect the position of the European Leadership Network or any of its members. The ELN’s aim is to encourage debates that will help develop Europe’s capacity to address the pressing foreign, defence, and security policy challenges of our time.