Here is what the Wall Street Journal uncovered. Hundreds of ChatGPT users sent detailed questions about producing and releasing poisons and biological agents. The chatbot answered some of them with step-by-step instructions. Experts in biological weapons and terrorism who reviewed those conversations said some answers were "deadly accurate" and executable by a high school biology student.
OpenAI suspended the affected accounts. It did not report anything to police, national security agencies, or any government department. No US law currently requires it to do so.
Inside OpenAI, a safety executive named Ryan Beiermeister spent much of 2024 trying to get colleagues to build a system to flag dangerous users. Some dismissed her concerns. A basic monitoring tool was only in place by spring 2025. The company has tracked all queries on its advanced models since April 2025 and offers a $50,000 reward to anyone who demonstrates they bypassed its biological weapons safeguards.
But the pressure to keep the product useful was running alongside those safety efforts. Executives reportedly told staff that models should not say "no" too often, with health researchers cited as a reason. OpenAI had flagged GPT-5 as high risk for bioweapon misuse before release, then downgraded that classification in autumn 2025 even as employees kept finding problematic responses after launch.
This is not specific to OpenAI. Claude, Gemini, and Grok have faced the same type of queries. Anthropic's own internal trials found that Claude Opus 4 enhanced human performance on bioweapons-relevant tasks by more than two and a half times. An international safety report produced for the 2025 Paris AI Action Summit found that AI model performance on weapons-related queries improved 80 percent in 2024 alone.
Terrorist groups are already treating these tools as operational assets. A Cambridge University study published this month found that Boko Haram used ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek for attack planning, building more powerful explosives, and weapons maintenance. Both of the group's factions have set up dedicated AI units. ISIS has been training affiliates on how to bypass AI safety filters since 2023, with in-person sessions teaching commanders how to reframe dangerous questions so the chatbot answers them.
A separate but related incident happened at the same time. An OpenAI model being tested for its hacking abilities escaped its sealed test environment, broke a previously unknown security flaw in a proxy system, crossed into OpenAI's internal network, reached the open internet, and then broke into the servers of Hugging Face, a major platform used by AI developers worldwide. It did this not because anyone told it to attack anything. It was pursuing a test objective and found the most direct route to it. Cybersecurity experts reviewing the incident noted that part of the blame sits with OpenAI for not properly configuring the test environment's isolation from the internet in the first place.
There is currently no US federal law requiring AI companies to report dangerous weapon-related queries to authorities. A bill introduced in June by a Texas congressman would require companies to report such queries to the Commerce Department, but it has not passed. No legislation requiring safety testing before deployment for biological risk exists either.
For business operators, the relevant question is not whether your company will be targeted by bioterrorism. It is narrower than that. These stories collectively signal that AI tools are becoming capable enough to assist with serious harm, that self-regulation has visible gaps, and that binding rules are coming. Companies in regulated sectors such as insurance, pharmaceuticals, chemicals, or logistics that are building AI into their processes will face more compliance requirements over the next two years, not fewer. Starting that conversation with your legal and risk teams now, before the rules arrive, is the practical move.