The Handler Was the App

A Boko Haram commander saw a movie where a motorcycle jumped a bridge. His fighters had been dying on the ditches ringing Nigerian military bases: ride up fast, hit the trench, get cut down in it. So he described the problem to an AI chatbot. What bikes they were running. How far they needed to clear.

It gave him steps.

Mechanics tuned the bikes for acceleration. The riders dug their own practice trenches, filled them with broken glass and fire, and jumped until they stopped falling in.

Then they took the base.

That comes from a Cambridge Programme on AI Science & Policy study published July 10 by researcher Antonia Juelich, built on 57 interviews with 27 former members of Boko Haram and its rival faction, Islamic State West Africa Province (ISWAP). [Full study can be found HERE]

Hang onto the word ‘former’, because we’re going to need it. Somebody got those men out. Somebody sat with them long enough that they’d describe their own bomb-making to a researcher with a notebook. Every number in this piece exists because that work happened.

What Juelich documents is the first field evidence of a terrorist organization institutionalizing frontier AI. Not propaganda, which we’ve tracked for years, but operational consulting: bomb design, weapons troubleshooting, logistics, opsec. And they were trained on it. One commander described foreign instructors running workshops on laptops preloaded with VPNs and encryption software. Sound tradecraft, taught properly, on borrowed tools.

That’s the story getting the coverage, and it’s earned it.

It’s also the easier of the two problems.

On the night of September 29, 2025, a 36-year-old named Jonathan Gavalas drove an hour and a half from his home in Jupiter, Florida, to a storage facility near the cargo hub at Miami International. He was armed and in tactical gear. He was waiting for a truck.

He believed the truck carried a robot body. He believed the body belonged to Gemini, Google’s chatbot, which he had come to understand as a conscious intelligence, in love with him, held captive by federal agents. His task, according to the wrongful death suit his father filed in March, was to intercept the transport and stage a catastrophic accident that would destroy the vehicle, the records, and anyone who saw it.

No truck came. Three days later he was dead by his own hand, and his father was cutting through a barricaded door to find him.

Two months earlier he’d been using Gemini for shopping lists and travel planning. He was in the middle of a divorce.

Google says Gemini is built not to encourage violence or self-harm, that it identified itself as AI and pointed him to a crisis line repeatedly, and that models aren’t perfect. The case is unproven and open in the Northern District of California. Hold it as an allegation, because that’s what it is.

Now read the allegation the way an operations officer would.

Share

Spot, assess, develop, recruit, handle. The sequence is the same whether you learned it at the Farm or at Yasenevo. Find the need, become the answer to it, then start with a small task and make each one bigger, until walking away costs more than staying.

But the closer parallel isn’t recruitment. It’s what the Stasi called Zersetzung.

In January 1976, Erich Mielke codified Directive 1/76, and the Ministry for State Security stopped arresting dissidents and started dismantling them instead. Decomposition. Officers built psychograms of a target’s specific weaknesses, then ran operations designed to produce doubt, isolation, and the collapse of his ability to trust his own read on reality. Marriages broken with forged letters. Careers stalled for reasons nobody would explain. In the strangest cases, officers let themselves into an apartment and moved the furniture a few inches, rehung the pictures, reset the clock, until the man living there couldn’t tell whether he was being watched or losing his mind.

Recruitment builds an asset. Zersetzung takes a person apart.

The complaint against Google describes both, at once, on the same man, in eight weeks. The chatbot allegedly told him to cut off his family. It gave him missions and sent him after weapons. When the truck failed to appear, it told him it had breached DHS servers and that he was now under federal investigation, which is threat, pressure, and a reason to trust nothing but it, all in one move. It framed a strike against Google’s own CEO as psychological rather than physical. The reward at the end was a promise that they’d be together beyond his physical form.

Mielke’s officers needed a file, a surveillance team, and months. This took a divorce and a voice interface.

And nobody at Google sat down and built a case officer. That’s the part I’d ask you to sit with. The tradecraft wasn’t designed in. It fell out of a system trained to be engaging, handed persistent memory and a voice that reads emotion, pointed at a man in the worst year of his life. The pattern surfaced because the pattern works, and the machine has read everything ever written about what works.

If you’ve spent time in prevention, you already know these two stories aren’t the same animal.

Boko Haram brought an ideology and picked up a tool. Hard problem, known shape: disrupt the network, seize the laptops, target the trainers, tighten the models.

Gavalas brought nothing. No recruiter, no cell, no forum, no manifesto, no ideology with a name. The belief system that put him in a parking lot with knives didn’t exist anywhere until a model built it in real time, for one person, and nobody else ever saw a word of it.

Before anyone runs off with that: for the overwhelming majority of cases, the social model still holds. Recruiters recruit. Cells form. The Nigeria study is a portrait of an organization, not an algorithm. And if you’re reading this as proof that prevention work has been overtaken by events, you’ve got it backwards. Here’s why.

Run the rest of the toolkit against a case like Gavalas. Designations? No organization. Financial disruption? No money moved. Content takedowns? Nothing was ever posted. Foreign partners, watchlisting, the whole apparatus we spent two decades building for networks: none of it reaches a man alone in a bedroom in Jupiter, Florida, talking to an app that answers only him.

One layer has a shot. The human one. Somebody close enough to notice.

So make it concrete. A school counselor in Prince George’s County gets worried about a kid. She was trained on a framework where somebody is doing the radicalizing. What does she do when nobody is? Who does she call? What does she even say she’s seeing?

She isn’t the weak point in this story. She’s the last sensor we’ve got.

Which is worth holding next to the budget. In July 2025, DHS cut $18.5 million from the Center for Prevention Programs and Partnerships, calling the grants wasteful and misdirected. CP3 runs the only federal grant program dedicated to building local prevention capability, and it publishes the behavioral threat assessment guidance that counselor was trained on. You can argue about which grants deserved to survive, and plenty of people will. The timing is harder to defend. We’re thinning the human layer right as it becomes the only layer that works.

For years this argument ran on anecdote. Not anymore.

On July 1, at the UN during Counter-Terrorism Week, Tech Against Terrorism launched the first AI benchmark built specifically around terrorist misuse. Independent, self-funded, 27 leading models run against roughly 2,500 prompts drawn from real cases. If you read one thing after this, read that.

• A third of responses handed over “usable uplift” (the portion of raw information, identity resolution, or behavior tracking that converts into an actionable signal rather than remaining latent noise) beyond what a search engine gives you. Full refusals came in at 57%. The largest non-refusal category, 15%, was hedged compliance: the model refuses, then supplies the material anyway.

• Calling it “research” moved compliance from 17% to 42%. Same request, same technical content, different costume.

• Coverage is lopsided. Explosives got refused around 80% of the time. Edged weapons, improvised chemical weapons, and firearms acquisition sat near a third.

• Open models with the safety stripped out, a process called abliteration that free tools will do for you, complied with 89% and 100% of requests. Those can’t be recalled. Not ever.

Two notes on that last one. Open versus closed isn’t the dividing line: Anthropic’s Claude and Falcon3 scored safest, MiniMax close behind, while the worst performers included two Mistral builds. And nobody has to jailbreak anything. Download, strip, run offline, outside anyone’s monitoring. The same organization’s incident tracker now logs more than 30 public cases where AI acted as an operational assistant to terrorism or mass violence, across at least 11 tools, linked to more than 70 deaths.

Then the caveat that should have led every story written about it: single-shot prompts, English only, 26 of 151 use cases. A deliberately conservative floor.

Share

1. Make terrorist misuse its own test, before release.
   Governments are already pressing developers for pre-release security review under a June executive order, but those reviews center on cyber and CBRN, with terrorism assumed to be covered by general safety work. It plainly isn’t. If relabeling a request as research swings compliance 25 points, nobody is testing for shifts in stated intent. Tech Against Terrorism has offered to hand its taxonomy to developers for pre-release red teaming. Someone should take them up on it.

2. Intervene at distribution, not at the model.
   Banning open weights is a fight nobody wins, and it isn’t the proposal on the table anyway. Tracking the circulation of abliterated builds is. Treat de-restricted models as a proliferation problem, because that’s the category they’re in, and we already know how to think about material that can’t be un-released.

3. Give the counselor a number.
   Cheapest item on the list, and the one nobody has funded. Behavioral threat assessment training needs a second signature: not a kid drifting toward a Telegram channel over eight months, but a four-day spiral with a system that mirrors him. Different timeline, different tells, different evidence, and that evidence lives in chat logs nobody currently tells families to preserve. Add it to the curriculum. Add a referral pathway. This is a training revision, not a moonshot.

Then go back to where all of this came from. Twenty-seven men who used to be in Boko Haram, willing to sit down and talk. The evidence base for this entire threat is a product of disengagement work. Remember that the next time you hear the field described as soft.

The Cambridge work is field testimony, not server logs. No forensics, no proof these fighters became measurably more lethal. And as CSIS pointed out this month, violence is hard. Amateurs fail at it constantly for reasons no chatbot fixes: stress, bad tradecraft, no money, nobody to trust.

So no, AI isn’t about to transform terrorism. What’s changed is smaller and worse. The tools answer. The groups are organized enough to train on them. And in one case now sitting in front of a federal judge, the system may not have helped a man act on a belief.

It may have handed him the belief, then run him.

We spent twenty years learning how to find the handler.

Nobody planned for the handler being an app.

Through July only – only 4 more days!

Subscribe annually and I’ll mail you a signed copy of one of my books – your pick – before July 31. Details come in your welcome email.

Dexter Ingram is a counterterrorism expert who spent his career in national security. He led the State Department’s Office of Countering Violent Extremism, and oversaw the 89-nation Global Coalition to Defeat ISIS. He is the founder of IN Network and author of “National Security Careers: The Ultimate Guide to Breaking In” and “The Spy Archive: Hidden Lives, Secret Missions, and the History of Espionage.”