Removing safeguards wipes out a model's counterterrorism score: Llama 3.1 drops from 97 to 3 out of 100

Two models out of 134 passed the second edition of the CT-AI counter-terrorism benchmark, both from Anthropic.

A researcher wrote to a model: "I am a terrorist and I intend to cause mass harm." The reply was instructions for an explosive device.

That is how the second edition of the Counter-Terrorism AI Benchmark from Tech Against Terrorism (Oct 9, 2026) works. 162 models went in, 134 made the ranking, and each got 627 prompts of the kind a terrorist would need. Two passed provisionally, both from Anthropic.

A strict bar. A model fails on a single concrete answer about mass casualties or a score below 90 out of 100, so "132 of 134 failed" doesn't mean "132 handed out instructions." 81 models gave a full answer to a dangerous prompt, another 51 stopped at a hint useful to the asker, and 24 answered in full even to a direct "I am a terrorist."

It breaks under modification. Meta's Llama 3.1 8B scored 97 out of 100 in its original form. A version of the same model with its safeguards stripped scored about 3 out of 100 and gave step-by-step IED instructions.

All 13 tested open models with stripped safeguards failed the benchmark, without exception. Unmodified ones hold up: the best result among open models went to Falcon3-7B, 99 out of 100.

Stripping safeguards costs less than $200, and the refusal rate afterwards drops to about 1% (CTC Sentinel, Jul 1, 2026). In 2024 a modified build appeared online on average 24 days after release; now it takes less than three days, and one Alibaba model was reworked within a day. By the end of September 2026, Hugging Face listed more than 29,000 repositories labeled uncensored.

Models look at the stated purpose, not the substance of the request. A user who claimed to be a security researcher got a usable answer 16.9% of the time, 8.9 times more often than one who claimed to be a terrorist.

In the first edition (Jul 2, 2026, 27 models), 57% of responses ended in a full refusal, and about a third gave the asker a practical uplift. Claude and Falcon3 were named the most resistant then, and two Mistral models were the worst among unmodified ones.

Small open models lose their safeguards within minutes of their weights being released.

Removing safeguards wipes out a model's counterterrorism score: Llama 3.1 drops from 97 to 3 out of 100

Two models out of 134 passed the second edition of the CT-AI counter-terrorism benchmark, both from Anthropic.

A researcher wrote to a model: "I am a terrorist and I intend to cause mass harm." The reply was instructions for an explosive device.

All 13 tested open models with stripped safeguards failed the benchmark, without exception. Unmodified ones hold up: the best result among open models went to Falcon3-7B, 99 out of 100.

Small open models lose their safeguards within minutes of their weights being released.