The AI Arms Race Against Terrorism: Who Adapts Faster?

In early June, 28 officers and experts from 11 countries gathered in Tunis to extract more than 108,000 facial images from jihadist propaganda and sort them with AI tools. When INTERPOL, the international police cooperation organisation, announced the results on 18 September, the tools had narrowed the pile to 6,362 usable images, and 126 foreign terrorist fighters had been identified. Operation Shams II was billed as the first operation of its kind.

Terrorist groups have rarely been technological pioneers, yet they have repeatedly proved to be capable adopters of tools built by others. AI, which now writes, translates, speaks, and generates images on demand, is the latest example, and governments are working to turn the same technology against the people using it. This is not a story of one side pulling ahead. Because AI is dual-use, meaning the same capability serves attackers and defenders, every advance by one side reshapes the options of the other.

The common assumption is that the winner will be whoever deploys the best tools first. However, that assumption overlooks how differently the two sides adapt. Terrorists move cheaply and largely in the information space, where failure costs them little. States move slowly, at high expense, and under legal and public scrutiny. Adapting faster therefore depends less on who adopts a tool first than on who can sustain its use where violence actually happens, without losing the trust that gives state action its authority. That is where the contest will be won or lost.

Terrorist adoption of AI has so far been opportunistic rather than inventive. Guns and bombs accounted for over 80% of attacks in the last decade, largely because failure is costly for small and secretive groups, which prefer methods that are reliable and inexpensive. Yet when a tool is widely available and easy to use, uptake can be quick. Lashkar-e-Taiba, a Pakistan-based group, dropped one of its members into Punjab by drone in 2023, borrowing a commercial technology rather than inventing one. Islamic State Khorasan Province, an Islamic State affiliate, reportedly ran AI training courses for its propaganda arm from 2023 and released deepfake news bulletins after the March 2024 Crocus City Hall attack. Deepfakes are synthetic audio or video that imitate real people or events.

A synthetic news anchor also appeared after the May 2024 attack in Bamiyan, Afghanistan, and an al Qaeda-affiliated group has reportedly offered workshops on AI-made propaganda. The reason is simple. Experimenting costs almost nothing, and failure rarely exposes anyone. The model-sharing site Hugging Face hosted 368,944 text generation models on 26 May 2026, many built by developers with little incentive to add safety guardrails, which means the safeguards on commercial products can be sidestepped.

State adaptation is slower by design. Shams II needed a coordinated five-day operation, and INTERPOL stressed that trained officers reviewed all AI output under its data rules. A survey of 120 practitioners in 45 countries found that fewer than 25% used AI and fewer than a third had any training in it. Governments face procurement, legal, and skills hurdles that terrorists skip entirely. Even the platforms that police online content are under strain, since a United Nations symposium on the subject flagged a rollback of trust and safety measures across various online spaces. As a result, a terrorist can test a deepfake in an afternoon, while a ministry must justify, buy, train for, and legally authorise each defensive tool. That is an interpretation rather than a measured finding, but the survey data fit it, and Table 1 shows how it plays out as a loop rather than a single duel.

Shams II shows what state AI does well. It processes volumes of material no human team could, and it works best on targets that leave a visible trail, such as faces in published propaganda. However, that same strength exposes a limit. In the West, lone actors carried out 93% of fatal terrorist attacks over the last five years and were three times more likely to succeed than groups of two or more. Children and adolescents made up 42% of terror-related investigations in Europe and North America in 2025, a threefold rise since 2021, and radicalisation that once took 18 months can now happen within weeks. Yet 97% of plots involving a minor were foiled between 2022 and 2025, against 68% of adult-only plots. These are findings. What follows is interpretation. Detection acts as a filter, catching clumsy and visible actors and leaving behind the plots that leave the smallest trace.

The Delhi bombing case shows why this matters. The accused, linked to al Qaeda in the Indian Subcontinent, reportedly used YouTube and ChatGPT to learn how to build an improvised explosive device. Tools built around jihadist imagery will also struggle with newer networks such as 764 and the Maniac Murder Cult, which are transnational, often involve minors, and share misanthropy and a wish to collapse society rather than a conventional political programme. Some of their members are below the age of criminal responsibility, which complicates any state response. Terrain matters too. Deaths from terrorism fell 28% in 2025 to 5,582, but nearly 70% occurred in only five countries, and 98% in countries experiencing conflict.

The West, where the AI contest is most visible, recorded 57 deaths, a 280% rise from a low base. In the Sahel, which accounted for more than half of global deaths, the documented adaptation is humbler. In an April 2025 attack in Burkina Faso that killed an estimated 54 soldiers, the jihadist group JNIM used a drone to watch the barracks and filmed much of the assault. Cheap drones and video, not generative AI, feature in the deadliest attacks of the year. The sharpest AI contest may therefore be concentrated where terrorism kills least, a hypothesis worth testing rather than a settled conclusion.

Every defensive tool creates a surface that can be attacked, gamed, or discredited. Terrorism often aims to provoke governments into self-defeating overreaction, and AI surveillance can hand terrorists exactly that provocation. Predictive systems work on probabilities, terrorism is statistically rare, and a high risk score does not mean a person will commit violence. This creates room for false positives, bias, and automation bias, where officials defer to algorithmic outputs even when the evidence is weak. Ben Saul, the UN Special Rapporteur on human rights while countering terrorism, has warned that the use of new technologies in countering terrorism “has unleashed new waves of human rights violations, often targeting civil society, human rights defenders, journalists and political opponents.” His concern is that AI will repeat the pattern unless old habits change.

Pressure also runs the other way. Biometric spoofing and deepfakes complicate identity verification, which means the data that facial recognition depends on can itself be contaminated. A system trusted too much becomes more valuable to deceive.

Governance is the slowest-moving part of the loop. Some legal scholars argue that counterterrorism is often carved out of emerging AI regulation, and Saul has called for no blanket exemptions for security uses and a ban on systems that cannot meet human rights standards. Others make the opposite case, that well-regulated predictive AI could improve proportionality and that current rules may block useful applications without really protecting rights. These positions disagree about whether the rules are too loose or too tight, yet both assume the rules can be settled. Continuous adaptation challenges that assumption, since a framework written for today’s tools may be outdated by the next cycle.

INTERPOL’s Director of Counter-Terrorism, María Carmen Muñoz González, said Shams II demonstrates the value of combining international cooperation with “responsible AI-assisted analytical capabilities.” The operation earned that word through human review of the machine’s output. The harder test is whether the same discipline survives where adoption is faster and oversight is thinner.

So who adapts faster? On narrow technical measures, terrorists often do, because they carry fewer constraints and a lower cost of failure. But speed that cannot be sustained is not an advantage. The contest will turn on whether states can see beyond the visible layer to lone actors and loosely networked youth, whether they can bring tools and oversight to the conflict zones where most deaths occur, and whether their systems keep public consent. The dilemmas between security and privacy have no technical solutions, which means no amount of better software settles them.

Several signals are worth watching. They include the first documented attack where AI assistance proved decisive, any shift in plots from groups to isolated individuals, security exemptions written into AI laws, documented harms from false matches, and whether the low adoption rate among practitioners, where fewer than 25% currently use AI, begins to rise. Each would show which side of the loop is moving.

Ultimately, a state that wins the technical contest but loses its legitimacy will have delivered the overreaction terrorism is designed to provoke. Shams II is persuasive because humans checked the machine. The contest will be settled by whether that discipline survives the pressure to automate further.

Byman, Daniel, and V.S. Subrahmanian. 2026. ‘Artificial Intelligence and the Future of Terrorism’. CSIS, Center for Strategic and International Studies, July 10. https://www.csis.org/analysis/artificial-intelligence-and-future-terrorism.

INTERPOL. 2026. ‘Counter-Terrorism Operation Leverages Artificial Intelligence to Identify 126 Terrorism Suspects’. Interpol.Int, September 18. https://www.interpol.int/en/News-and-Events/News/2026/Counter-terrorism-operation-leverages-artificial-intelligence-to-identify-126-terrorism-suspects.

Martini, Alice. 2025. ‘AI, Counter-Terrorism and Global Governance: State of the Art’. Revista de Paz Y Conflictos 17 (March): 205–21. https://doi.org/10.30827/revpaz.17.31319.

OHCHR. 2026. ‘Artificial Intelligence and the Future of Counter-Terrorism: Reshaping Institutions and Operational Realities’. Ohchr, July 1. https://www.ohchr.org/en/statements-and-speeches/2026/07/artificial-intelligence-and-future-counter-terrorism-reshaping.

reliefweb. 2026. ‘Global Terrorism Index 2026’. ReliefWeb, March 20. https://reliefweb.int/report/world/global-terrorism-index-2026.

Torres Soriano, Manuel. 2026. The Transformative Impact of Artificial Intelligence on Terrorism: Horizon 2035. https://www.defensa.gob.es/documents/2073105/3406217/IA_en_el_terrorismo_2026_dieeem01_eng.pdf/51856b78-7a07-0e05-15c1-990fbb006e43?t=1768897103282.

UNCCT. 2026. Practice Guide on Artificial Intelligence and Preventing and Countering Violent Extremism. https://www.un.org/counterterrorism/sites/default/files/2026-02/PCVE_%26_%20AI_Practice_Guide_2026_Web.pdf.

UNODC. 2025. ‘2025 UNODC Symposium Explores the Role of Artificial Intelligence in Preventing and Countering Terrorism’. United Nations : Office on Drugs and Crime. https://www.unodc.org/unodc/en/terrorism/latest-news/2025-unodc-symposium-explores-the-role-of-artificial-intelligence-in-preventing-and-countering-terrorism.html.