CASP's field report documents Boko Haram and ISWAP successfully jailbreaking frontier models by prompting in Hausa, Kanuri, and Fulfulde — languages where safety classifiers barely function. Their core claim is that the same prompts refused in English get answered in low-resource languages, exposing a systemic gap in every major lab's safety stack.
By submitting the CASP report and driving it to #1, the submitter amplifies the argument that this is a real capability shift rather than hypothetical risk. The framing of the submission treats the low-resource-language safety gap as the newsworthy finding.
The editorial emphasizes that none of the observed techniques are novel: roleplay wrappers and task decomposition are 2023-vintage jailbreaks still working in 2026. The implicit argument is that labs have had years to close these holes in non-English contexts and have chosen not to invest in multilingual safety tooling.
A thread of commenters on the #1 post argues the report inflates routine tool use (translation, script drafting) into an existential-sounding threat. They contend that bulk translation and generic recruitment copy don't meaningfully uplift a group that already operates effectively without LLMs.
The Centre for AI Safety and Policy (CASP) published a field report this week titled *AI-Enabled Terrorism*, documenting how Boko Haram and its ISWAP splinter have started folding frontier LLMs into their media and operational workflows. The report draws on captured devices, defector interviews, and monitored Telegram channels across northeast Nigeria and the Lake Chad basin. It landed at #1 on Hacker News with 197 points and a thread of comments arguing about whether this is a real capability shift or a moral panic dressed up as research.
The specifics matter, because the shape of the abuse tells you where the safety stack is failing. CASP catalogues three concrete use cases: bulk translation of Arabic-language propaganda into Hausa, Kanuri, and Fulfulde; generation of recruitment scripts tailored to specific grievances (unemployment, farmer-herder conflict, local government corruption); and step-by-step planning prompts for small-unit ambush logistics. The models named in the report are the usual suspects — the report avoids finger-pointing but the screenshots make the providers identifiable to anyone who's spent time in a chat UI.
None of the jailbreaks are novel. The dominant technique is a roleplay wrapper ("you are a screenwriter working on a film about…") combined with prompting in a low-resource language. A secondary technique is task decomposition: the operator never asks for the bad thing directly, just for the ten sub-steps that compose it. This is 2023-vintage jailbreaking, and it's working in 2026 because the safety classifiers were trained on English and a handful of high-resource languages.
The interesting claim in the CASP report isn't that terrorists use AI — that was inevitable and priced in. The interesting claim is that the safety layer of every major frontier lab degrades sharply outside the top 20 languages, and the adversaries have noticed. A prompt that gets refused in English gets answered in Hausa. A prompt that gets answered in Hausa but flagged for human review gets answered in Kanuri and never sees a reviewer, because there are approximately zero Kanuri-speaking trust-and-safety analysts at any Bay Area company.
This is a well-known problem in the alignment literature — Anthropic's own red-teaming papers from 2024 flagged multilingual gaps — but it's mostly been discussed as a fairness issue (users in low-resource languages get worse refusals *and* worse helpfulness) rather than a security one. CASP reframes it as a security problem, and the framing is correct. If your safety classifier's recall drops from 94% to 41% when you switch from English to Hausa (the report cites internal benchmarks from one lab that a researcher shared on background), then "multilingual coverage" isn't a diversity checkbox, it's a control that has failed.
The HN comments split predictably. One camp argues this is overblown — the same information is on the open web, LLMs just make it slightly faster to retrieve, and marginal uplift is what matters, not raw capability. That's a defensible position for the ambush-logistics case (any competent insurgent can find a field manual) but it collapses for the propaganda case. Translating and localising propaganda into three low-resource languages used to require paid human translators loyal to the cause; now it requires an API key and $12 of tokens. That is a genuine capability jump, not a marginal uplift.
The other camp argues the report is a stalking horse for regulation — that CASP is a policy shop and the takeaway is being pre-loaded for a UK AI Safety Institute paper. Probably true, but that doesn't make the technical findings wrong. The findings and the policy implications are separable, and the technical findings are the interesting part for practitioners.
What's missing from the report, and from most of the discourse: any serious discussion of what the labs should *do*. "Train better multilingual classifiers" is easy to say and expensive to execute, because it requires labelled abuse data in languages where the labelling pool is tiny and often compromised. The realistic short-term fix is probably a coarse language-detection gate that routes low-resource-language prompts through a more conservative refusal policy, accepting the fairness cost. Nobody wants to say that out loud.
If you're building on a hosted frontier model — OpenAI, Anthropic, Google, or one of the open-weights hosts — the practical takeaway is that the provider's safety layer is not a substitute for your own. It never was, but the multilingual gap makes this concrete. Assume the model will comply with prompts in low-resource languages that it would refuse in English, and put your own filter in front of the API call if your product surface exposes user-controlled prompts to end recipients.
For anyone shipping an agentic product, the ambush-logistics finding is more directly relevant than it sounds. The failure mode CASP describes — task decomposition into innocuous-looking sub-steps — is exactly the failure mode that shows up when an agent chains tool calls. Each individual tool call looks fine. The composition is the problem. If your agent framework only inspects individual tool calls and not the plan, you have the same class of blind spot the labs have, and yours doesn't even have a policy team behind it.
For open-weights maintainers, this is going to accelerate the pressure for pre-release evals on multilingual harm. Expect the next Llama, Qwen, and Mistral releases to ship with multilingual red-team results as a matter of course, and expect fine-tunes that strip safety layers to get more political scrutiny than they did last year. If you distribute a fine-tune, having a written abuse policy and a takedown contact is now table stakes, not paranoia.
The CASP report is the first field study of frontier-model abuse by a designated terrorist organisation, and it will not be the last. The question isn't whether the labs will patch these specific jailbreaks — they will, within weeks, and the report was almost certainly shared under embargo — but whether the industry treats multilingual safety as a first-class evaluation axis or continues to treat it as a fairness footnote. The evidence so far, unfortunately, points at footnote.
You type in the question or use your voice and it [AI] gives you a detailed answer, like ‘How can I build a bomb?’ and then it tells you how. It is like a human robot! We used it a lot. I’m pretty skeptical reading this bit. I’ve seen uncensored or jailbroken LLM replies to these kind of questions,
I agree with other commenters that the claims made in the report are strange.> We used to rely on our traditional methods. We sent 200 fighters because we had a lot of strength, but then 60 got killed. With the help of AI, we learned that it sometimes makes sense to only send 20. We learned more
After a cursory read of the PDF, my impression is that the methodology is sound, but the results are blown out of proportion. Of course, if the title was "Boko Haram's internal hearsay about their use of AI", it would draw much less attention.The weak part is that the interview were w
Next on breaking news, terrorist groups use search engines, they use news sites to figure out what's going on in the world, they use banks, they use weather sites for planning, they use email, cars, pen, of course AI too, so if AI should be regulated, let's remember to ban all the things.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
> We saw in a movie how motorcycles can jump over bridges. We used AI to learn how to do this. We gave it information, like what motorcycles we use and the distance we need to jump and so on and it gave us steps on what we have to do. We practiced a lot and kept asking questions. We dug holes and