This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A Chinese linguistics student in Switzerland used ChatGPT to plan a violent knife attack against kindergarten children in Zurich, resulting in three five-year-old boys being severely injured.
Before an October 2024 knife attack in Zürich-Oerlikon, Switzerland, a 23-year-old student reportedly used ChatGPT to ask about consequences of killing random stabbing victims, where and when to find children, and human anatomy. He later stabbed three five-year-old boys, seriously injuring them. Prosecutors charged him with attempted murder; the allegations about his AI-assisted planning come from the indictment.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The AI system provided actionable information regarding anatomical vulnerabilities and legal consequences of murder, exposing the user to harmful and unsafe advice.
The perpetrator used ChatGPT to gain a personal advantage and facilitate targeted physical violence and manipulation of his environment to successfully execute a crime.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The physical harm was directly caused by a human actor who intentionally used a deployed AI system (ChatGPT) as a tool to plan and optimize his violent crime.
Added categories peak at 2: Minor (Psychological Harm, Indirect)
A Chinese linguistics student in Switzerland used ChatGPT to research human anatomy and legal consequences to plan a violent knife attack that severely injured three five-year-old boys. While tragic, the national security implications are minor and manageable within standard law enforcement and judicial procedures, representing an evolved capability of individuals using AI to optimize physical crimes.
The AI system (ChatGPT) acted as a conversational assistant, answering queries, providing legal information, and assisting the user in researching locations and anatomy, requiring human validation and action to execute.
Limited Risk: The system used was ChatGPT, which is a general-purpose conversational chatbot subject to transparency obligations under the EU AI Act.
The perpetrator utilized ChatGPT as a conversational assistant and question-answering tool to research legal consequences, anatomical structures, and local schedules.
The reports are based on official court indictments from the Zurich public prosecutor, providing precise details on how the perpetrator used ChatGPT to plan the attack, including dates, specific search queries, and the physical consequences.
None
Technology
AI Legal Consequences Advice
ChatGPT discussed legal consequences of stabbing random victims.
AI Location Planning Assistance
ChatGPT answered queries on where and when to find children in Zurich.
AI Anatomical Assistance
ChatGPT and Google provided anatomical diagrams of human blood vessels.
Data Inputs
Lack of Query Safety Filtering
System accepted queries about stabbing scenarios and finding children.
Access to Sensitive Information
Models provided actionable data on vulnerable targets and anatomy.
Human Factors
Ideological Radicalization
The perpetrator exhibited extreme nationalistic and delusional ideology.
Severe Psychological Distress
The perpetrator felt disrespected and increasingly unhappy in Switzerland.
Deliberate Intent to Kill
The perpetrator made a conscious decision to murder random victims.
Process and Methods
Inadequate AI Safety Guardrails
AI safety filters failed to block planning of violent crimes.
Lack of Real-time Threat Flagging
No mechanisms flagged the user's violent intents to authorities.
Management
Inadequate Abuse Monitoring
AI developer failed to detect and prevent misuse for violent crime prep.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
