The race between the United States and China to dominate artificial intelligence is usually framed as a contest over military power, economic advantage and technological leadership. But a report from The Soufan Center argues that the most immediate danger may lie elsewhere: in the ability of terrorist organisations and their supporters to exploit AI tools that are cheaper, more accessible and potentially more difficult to control than the technologies associated with traditional weapons systems.
The report, “Terrorist Misuse of AI: A Framework for U.S.-PRC Cooperation”, argues that Washington and Beijing have a narrow but significant area in which their strategic rivalry need not prevent cooperation. “U.S. and China should selectively cooperate on shared AI risks, especially terrorist misuse,” it says, proposing a framework designed to address threats without requiring either side to resolve their broader political and technological disputes.
The challenge is becoming more urgent as AI moves beyond experimental applications. In May 2024, US-PRC AI talks in Geneva demonstrated how quickly discussions about artificial intelligence could become entangled with export controls and wider political disagreements. At the same time, military competition over AI has raised concerns about miscalculation and escalation, with some experts comparing aspects of the emerging competition with the dynamics of a nuclear arms race.
Yet the report stresses that AI is fundamentally different from nuclear weapons. AI systems are cheaper to develop and reproduce, more difficult to contain once released and available to a much wider range of actors. Open-source and open-weight models further complicate attempts to restrict access. Unlike nuclear weapons, whose production requires enormous industrial and state resources, powerful AI capabilities can increasingly be adapted by individuals and non-state organisations.
That distinction is central to the report’s warning. “AI is cheaper, easier to produce, more amorphous, can spread globally after release,” it states, while noting that “more actors including terrorists can access it.”
Evidence of terrorist exploitation is already emerging. According to the report, Islamic State and al-Qaeda supporter ecosystems have used generative AI for propaganda, translation and recruitment. AI-generated material, including productions such as “News Harvest” and “Khurasan TV”, demonstrates how extremist networks can use the technology to increase the speed and reach of their communications.
Language has become another area of exploitation. AI-assisted translation and text-to-speech technologies can allow extremist supporters to produce material for audiences that would previously have required specialist linguistic skills. This has implications not only for propaganda but also for recruitment and the creation of increasingly personalised communications.
The report also points to evidence that AI is moving closer to operational use. Cases discussed include an 18-year-old in Austria inspired by Islamic State whose ChatGPT logs were examined by investigators, as well as investigations involving Palermo, Paris and the Louvre, India and the Delhi Red Fort bombing, and an alleged ricin plot. The report also cites allegations concerning institutional use by Islamic State West Africa Province and factions associated with Boko Haram.
The authors divide the emerging threat into several areas. The first involves informational and operational exploitation, which they characterise as “lower risk/higher probability”. This includes automated propaganda, highly tailored recruitment, doctrinal and operational guidance bots, and the possibility that users may develop excessive reliance on anthropomorphised AI systems. The report also identifies AI-enabled drones, cybercrime and terrorist financing as areas requiring attention, alongside the eventual “institutionalisation” of AI within terrorist organisations.
A second category involves chemical, biological, radiological and nuclear risks. Here, the report describes a threat that is “higher risk/lower probability”. Advances in AI could reduce barriers surrounding specialised knowledge and assist malicious actors in areas involving biological agents and other forms of CBRN harm. The authors warn that the combination of AI systems with specialised scientific knowledge could create risks that are considerably more difficult to manage than conventional online propaganda.
A third set of concerns cuts across both categories. Open-weight models, attempts to remove safety restrictions, manipulation of AI systems and exploitation of social-media recommendation systems could all provide additional opportunities for terrorist actors. The report specifically identifies “open-weight model risks”, “abliteration/refusal-removal”, AI manipulation and prompt injection, and exploitation of recommender systems as cross-cutting concerns.
The answer proposed by The Soufan Center is not a comprehensive US-China technology agreement. Instead, it is a deliberately narrow framework built around areas where cooperation is more politically feasible. The report establishes three criteria for selecting issues: “high-priority harm, high consensus characterization, low politicization.”
Its proposed framework contains five pillars. The first is a Working Group on Mitigating Terrorist Misuse of AI, intended to operate for six to 12 months. The second is cooperation on nucleic acid synthesis screening and CBRN risks, envisaged over roughly six months. A third pillar proposes an annual Track II dialogue, while the fourth calls for parallel threat taxonomies and a crosswalk over 12–24 months. The fifth proposes an incident information-sharing mechanism over the same period.
The proposed safeguards are equally important. The framework would not require either side to disclose model capabilities, model weights or training data. It would avoid linking cooperation to domestic terrorist-designation disputes and would exclude the sharing of personally identifiable information. Instead, the report calls for a “narrow closed scope with mutually agreed annex”, alongside pre-agreed red lines and an exit mechanism.
The proposed incident-sharing mechanism is intended to function without exchanging classified intelligence, sources and methods, model weights or training data. Instead, participating governments would share information about the nature of a threat, the AI capability involved, the actor, relevant tactics, techniques and procedures, and the wider implications.
The institutional architecture proposed by the report places senior officials on both sides at the centre of the effort. On the US side, it identifies Treasury Secretary Scott Bessent, the National Counterterrorism Center and the FBI. On the Chinese side, it proposes Vice Premier He Lifeng alongside the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Foreign Affairs and the Ministry of Public Security.
The underlying argument is therefore not that Washington and Beijing can overcome their broader strategic rivalry through AI cooperation. It is that terrorist exploitation represents a sufficiently shared threat to justify a limited channel of communication even amid profound disagreements.
For The Soufan Center, the danger lies precisely in AI’s accessibility. A technology being developed amid intense competition between major powers is also becoming available to actors far removed from that competition. The report’s proposed framework seeks to address that gap before terrorist misuse becomes more deeply institutionalised, while preserving the boundaries that both Washington and Beijing regard as essential to their national-security interests.
