Three Steps To Prevent Terrorist Misuse Of AI | Brian Tse (Concordia AI)

Brian Tse (Concordia AI) on the gap between what AI evaluations measure and what threat actors can actually do, and three steps for the international community. A lightning talk at a FAR.AI convened discussion at the United Nations during UNGA 81. Tse opens with a mismatch. The technical AI safety community asks what models can do. The counterterrorism and national security community asks who a threat actor is, what their intent is, and what they could realistically carry out. Both are assessing the same threat at different levels, and he argues the gap between them has to close before either can mobilize global action. He gives three reasons the question is urgent now. The first is that dual-use capability is expanding faster than safeguards. Concordia AI's frontier risk monitoring platform has evaluated more than 40 large language models on troubleshooting real-world wet lab protocols, and by early 2026 several leading models were scoring above human experts holding biology PhDs on that task. Capability, though, is only half the picture: on the safety side, the worst-performing models complied with over 95% of malicious prompts, including from users explicit about terrorist intent. The second is that misuse is no longer hypothetical. He cites a Cambridge field study published in July, the first of its kind, documenting a designated terrorist organization using six frontier models across the attack chain, from operational planning onward, with members also expressing interest in chemical threats. The third is that the opening exists. Concordia AI has tracked AI safety and policy in China for several years, and Tse reports that preventing non-state actor misuse ranks among the top priorities in Chinese AI governance, a point also raised at the World AI Conference in Shanghai. His read is that no country has an interest in terrorist misuse of AI, whatever models are involved. From there he sets out the framework Concordia AI developed for catastrophic risk, which assesses red line scenarios along three dimensions rather than one: what the model can do, the deployment environment it operates in, and who the threat actors capable of triggering harm actually are. For terrorist actors, he notes, model capability is rarely the binding constraint. Access to precursor materials, physical laboratories and financing usually is. He closes with three steps: secure the physical choke points through universal screening of DNA synthesis orders and equivalent controls on chemical precursors; establish clear international guidance on high-risk training data, bringing the public health, non-proliferation and AI communities together; and align evaluation standards against shared red line scenarios, creating a common floor for AI safety. Chapters 0:00 Opening 0:15 Two communities asking different questions about the same threat 1:08 Dual-use capability is outpacing safeguards 1:34 Evaluating 40 models on wet lab protocol troubleshooting 1:57 The safety side: compliance with malicious prompts 2:24 Why misuse is no longer hypothetical 3:14 China, the United States, and a shared interest 4:08 Bridging model evaluations and operational reality 4:52 A framework built on three dimensions, not one 5:34 Step one: secure the physical choke points 6:05 Step two: establish clear data controls 6:30 Step three: align evaluation standards Brian Tse (Concordia AI) argues that model capability is rarely the binding constraint for terrorist actors, and that assessing risk along deployment environment and threat actor as well as capability gives policymakers something they can act on. More AI safety research: https://far.ai FAR.AI is a research nonprofit working to ensure the safe development of advanced AI. We host the Alignment Workshop series and publish frontier alignment research.