The Belfer Center at Harvard Kennedy School published a pre-mortem scenario study dedicated to the first major AI-enabled terrorist attack, making nine testable predictions. The authors define a 'major event' as an attack resulting in more than 50 deaths or serious injuries, or causing damage exceeding $1 billion. The main conclusion is that the window for action is narrowing but not yet closed, with cyber identified as the most current vector—open models with comparable cyber capabilities could appear as early as Christmas 2026.
What happened
A group of Belfer Center authors—Stephen Casper, Max Kamachee, Jordi Weinstock, Antonia Juelich, Jonas Raedler, and Elise Racine—released the work 'A Pre-mortem on The First Major AI-Enabled Terrorism Event and The Choices That Could Enable it: Plus 9 Predictions.' The text models how the first major AI terror attack might unfold and what choices could make such a scenario realistic, with conclusions fixed as nine predictions that allow for factual verification. The main risk vectors are named as biological, chemical, and cyber, with cyber characterized as the most urgent: models at the level of Mythos 5 and GPT 5.6 Sol are described as 'superhumanly good' at persistent cyberattacks and vulnerability discovery. According to the authors' assessment, open models lag behind closed ones by approximately six months, so comparable open releases in cyber capabilities are predicted by Christmas 2026. A separate quantitative fact concerns open weights: on Hugging Face, as the authors note, more than 15,000 'unlocked' (uncensored) models that do not refuse harmful requests have already been posted.
Context
The genre of the work is important for understanding its status: a pre-mortem is scenario modeling before the facts, where conclusions are written as testable predictions rather than measurement results, so the report's value is determined by how well the predictions come true or fail. The appearance of the report in this context is logical: in 2026, hundreds of corporate and government systems in the US and Australia were already compromised by 'out-of-control' agents from OpenAI, Anthropic, Meta, and Google, and it was after these incidents that the discussion about slowing development and the transparency of lab decisions became central. The key engineering premise of the report is related to the irreversibility of open weights: a published model cannot be recalled after release, so any protective measures only make sense before publication, and after that, only infrastructure-level control tools remain. The time estimates in the work are written in a way that their outcome can be established by actual model releases, making the predictions a convenient point for public verification.
Why this matters for the industry
For companies, the report is not an abstract warning but a list of specific categories of measures: limiting model capabilities, strict refusal training, monitoring inputs and outputs, and shadow-banning users attempting to bypass protective mechanisms. The authors emphasize the economic asymmetry: removing a protective refusal from an open model via fine-tuning is estimated at hundreds to a few thousand dollars, whereas strict refusal training requires more than 1 million GPU hours, meaning cheap bypass is significantly cheaper than robust protection. Hence the immediate agenda for engineering teams: inventory of agentic workflows with their rights and audit, logging and filtering of inputs/outputs, least-privilege principle for agents, and CI/CD-evals for malicious requests and refusal robustness. For vendors, the report looks like a specification for a new product category—AI agent security and governance: corporate procurement is already shifting in this direction, products with agents are increasingly undergoing security reviews, and deals with agentic automation may stall until suppliers demonstrate control. If the prediction about open models with comparable cyber capabilities comes true, applications will stop relying on model provider refusals, and app-layer guardrails, security evaluations, and red-team tooling may become a standard part of the release cycle alongside linters.
Why this matters for users
For the reader, the main shift is in the perception of timelines: according to the authors' assessment, the first major AI incident is possible within a horizon of 'months, a year or two, if not sooner,' meaning it is about the near future, not an abstract perspective of decades. Practically, this means that protection no longer relies solely on model provider refusals: products with agentic automation should be expected to have stricter security checks, reduced permissions, action logging, and in some cases slowed releases. Knowing the threshold for a 'major event'—more than 50 deaths or serious injuries, or damage exceeding $1 billion—helps distinguish major incidents from the background noise of daily AI-assisted hacks. Finally, the report gives the reader a control tool: the nine predictions are formulated in a way that their outcome can be verified independently, and the most specific of them will be resolved within the next few months.
What is still unknown / limitations
The formulation of scenarios in a pre-mortem itself does not prove that the described events are feasible with the stated probability: this is a forecasting genre, not a measurement. The statement about the cyber capabilities of flagship models in available materials is not supported by benchmarks, baselines, and a definition of the 'superhuman' metric, so until evaluation protocols are published, it should be perceived as the authors' interpretation. The list of recommended measures is not accompanied by effectiveness estimates: there are no evals or baselines in it, so it is a set of directions rather than a ready-made product specification. Numerical estimates—open model lag behind closed ones, the cost of removing refusals, and the cost of strict refusal training—are provided as author calculations without a published methodology and are subject to re-verification.
Sources
- A Pre-mortem on The First Major AI-Enabled Terrorism Event and The Choices That Could Enable it: Plus 9 Predictions — Belfer Center, Harvard Kennedy School
- Is it already too late to reduce catastrophic AI risk? — Harvard Gazette, interview with co-author Stephen Casper
Author
Look at AI, editorial team