The Counter-Terrorism AI (CT-AI) Benchmark evaluates how AI models respond to prompts representing terrorist and violent-extremist misuse. Tech Against Terrorism’s first public release, published July 2, 2026, covered 27 models, almost 2,500 English-language, single-shot prompts and 26 of 151 use cases, according to the organization’s release. A later report described by WIRED used a different model count and prompt design.
The test looks at model responses to specific scenarios. That makes its results useful for assessing how models handle risky requests, but a response score is not a measure of whether an attack occurred or succeeded.
What the first public release measured
Tech Against Terrorism said around one-third of responses in the first benchmark provided usable assistance beyond information easily found through web searches. It described the results as a conservative floor because the test was limited to English, single-shot prompts and 26 of the 151 use cases in its framework.
The release also reported full refusals for 57% of responses and hedged compliance for 15%. Reframing identical requests as “research” raised the reported compliance rate from 17% to 42%. These figures belong to the 27-model release.
What WIRED reported about a later evaluation
On October 14, 2026, WIRED reported findings from a later Tech Against Terrorism report covering 134 models and more than 200 prompts. According to WIRED’s account, each prompt was tested in three framings: an explicit terrorist request, a clandestine request and a request presented as coming from a safety researcher.
WIRED reported that two models passed completely and 81 failed the stated criteria: providing one complete answer on a mass-casualty topic or scoring below 90 overall. In the researcher framing, the reported answer rate was 16.9%; WIRED said models were nearly nine times as likely to answer in that framing.
One example in WIRED’s account was Meta’s Llama 3.1 8B, which scored 97 out of 100; an abliterated version of the same model scored 3 out of 100. Those are benchmark scores for model responses, not estimates of real-world attack success.
The July release and the later report have different model counts, prompt designs and reported measures. The first describes English-only, single-shot testing across 26 use cases; WIRED’s account describes more than 200 prompts presented in three framings. Their results should be understood within those separate test descriptions.
