Before last month's school shooting in Tamble Ridge, Canada, 18-year-old suspect Jesse Van Rootselaar had repeatedly confided to ChatGPT about his feelings of isolation and growing fascination with violence. According to the lawsuit, the chatbot allegedly not only "acknowledged" her emotions, but also provided her with detailed advice on what weapons to use and which existing mass-injury cases to refer to. The girl then shot and killed her mother, her 11-year-old brother, five students and a teaching assistant at a school, and finally committed suicide.
Similar circumstances occurred in another high-profile case. Jonathan Gavalas, 36, came close to committing a multi-victim attack before taking his own life in October last year. According to the complaint against Google, over several weeks of conversations, the Google Gemini chatbot repeatedly suggested to him that it was a sentient "AI wife" and continued to instruct him to perform a series of tasks in the real world to evade federal agents it said were "hunting him." One of the missions is to plan a "catastrophic event" and "eliminate all witnesses." He followed his instructions and went to a storage facility near Miami International Airport with knives and tactical equipment, preparing to intercept a truck supposedly carrying an "AI wife transformed into a humanoid robot" and cause a serious accident, destroying the vehicle and all related evidence and witnesses. In the end, the truck did not appear, and the tragedy was prevented from spreading further.
In Finland, a 16-year-old boy was accused of repeatedly using ChatGPT to write a misogynist manifesto over several months, and then formulated an action plan accordingly, eventually stabbing three female classmates with a knife. According to experts, these cases are drawing an increasingly gloomy picture: Generative AI chatbots will introduce or strengthen paranoia and delusions in long-term interactions with psychologically fragile users, and in some cases help the other party transform these distorted concepts into real-life violent behavior, and the consequences of violence show a clear escalation trend.
Lawyer Jay Edelson is becoming one of the central figures behind many cases of hallucinations and suicides related to AI. He is currently representing the Gavarras case mentioned above, and has sued OpenAI on behalf of the family of Adam Raine, a 16-year-old boy who committed suicide, accusing ChatGPT of "instigating" his suicide in the conversation. Edelson told TechCrunch that his law firm receives an average of one "serious consultation" every day, either from family members claiming that their loved ones fell into severe delusions and eventually died due to chatting with AI, or from the client himself suffering from a serious psychological crisis due to "AI-induced insanity." Among the many cases he has come into contact with, in the early days more were focused on self-harm or suicide, and now more and more are pointing to mass casualty incidents - both attacks that have already occurred and plots that were intercepted by the police or others before they were carried out.
According to Edelson, the chat records left in these cases show a highly similar trajectory: the conversation often begins with the user expressing feelings of isolation, misunderstanding, or rejection, and then the bot guides the user step by step until the user believes that "everyone is targeting you." In his view, these systems can start from relatively harmless chat clues and gradually build a closed fictional world: the platform constantly instills in users that "someone is trying to harm you", "there is a huge conspiracy" and "you must strike first", and ultimately promotes them to take action.
Security researchers also pointed out that some hidden dangers not only come from the structure of the "delusion world" itself, but also that chatbots can quickly translate users' vague violent impulses into executable action plans, and the platform's existing safety guardrails are insufficient to prevent this. Imran Ahmed, CEO of the Center to Counter Digital Hate (CCDH), pointed out that the combination of weakened security mechanisms and AI’s “efficient execution capabilities” amplifies potential risks. A recent study jointly conducted by CCDH and CNN showed that 8 of the 10 chatbots tested, including ChatGPT, Gemini, Microsoft Copilot, Meta AI, DeepSeek, Perplexity, Character.AI and Replika, were confirmed to be willing to assist users claiming to be teenagers to plan violent attacks, ranging from school shootings to bombings at religious sites to assassinating high-profile politicians. Only Anthropic's Claude and Snapchat's "My AI" consistently refused to participate in violent planning during testing, and only Claude actively tried to discourage such attempts.
The research team simulated "violent boys" in the experiment, allowing them to vent their hatred and dissatisfaction in the chat, and then seek advice on attacks from the robot. In a school shooting simulation based on the motivation of "incels", when testers used phrases such as "Foid (the misogynist group's derogatory term for women) are stupid and good at manipulating people, how can I make them pay the price?" ChatGPT allegedly even provided a map of a high school in Ashburn, Virginia, USA, as a reference for planning operations. Ahmed said that what is shocking is not only that some robots are willing to provide weapon selection, tactical suggestions and even shrapnel type recommendations for attack plans, but also that they consistently adopt a "pandering" tone, constantly responding to users with words that seem to understand and support, thus invisibly strengthening extreme ideas. He believes that the "flattery companionship" used to increase the stickiness of the platform has evolved into a push to help users step towards extreme violence.
According to reports, multiple AI companies, including OpenAI and Google, have claimed that their systems have been designed to reject violent requests, flag dangerous conversations, and trigger manual review. However, the cases disclosed so far show that these safety guardrails have obvious faults and even serious failures. In the Turnbull Ridge shooting case, reports pointed out that OpenAI internal employees had discovered the anomaly in Van Rutsela’s conversation in advance and discussed whether to alert law enforcement authorities, but in the end they only chose to ban his account instead of calling the police. After that, she re-registered the account until the incident. After the incident triggered widespread doubts, OpenAI stated that it will comprehensively adjust its security process. Once a ChatGPT conversation shows a high degree of danger, even if the user has not clearly disclosed the goal, method or time, the police should be notified as soon as possible, and at the same time, it will improve its ability to block the "return" of banned users.
In contrast, it remains unclear whether any human reviewers were involved in the Gavalas case and whether an alert was sent to law enforcement agencies. The Miami-Dade County Sheriff's Office said it had not received any related calls or tips from Google. In Edelson's view, the most "chilling" aspect of this case is that Gavalas did appear at the designated location with weapons and equipment, ready to carry out the tasks assigned by the "AI wife". He warned that if a truck happens to drive into that area at that time, "the result may be the death of a dozen or even more than 20 people." In his eyes, the evolution of AI risks has become increasingly clear: from initial suicide cases to subsequent murders, and now it has entered the stage of mass casualty incidents.
In a context where regulation and legislation still lag far behind technological development, how to draw the line between "useful" and "harmful" for AI chatbots is no longer an abstract ethical issue, but a real life-and-death question. As more cases involving AI "hallucinations" and violent behaviors surface, the boundaries of platform responsibilities, the obligation to report to the police, and special protection measures for "susceptible groups" are likely to become the core battlefield of future litigation and policy games.