Introduction

The threat from AI comes primarily from three directions.

• AI itself. Models that pursue goals in harmful ways, escape the limits their builders set, or become capable enough that humans cannot reliably steer them. This includes the popular picture of a superintelligent system acting on its own.
• Foreign actors. States and their proxies using AI to weaken U.S. defenses, disrupt daily function, steal an economic or military edge, or turn Americans against each other.
• Domestic actors. Criminals, terrorists, and political or social factions that want to harm the United States or people who live here. History’s small radical cells used the tools of their time. Future ones will use AI.

A fourth channel sits beside those three and matters for ordinary life: disruption with no enemy required. Companies deploy AI to cut costs. Workers lose tasks. Deepfakes and chatbot flattery erode trust even when no foreign service is in the loop. That is still a threat to how America functions.

The idea of AI rising up and acting on its own has received a lot of press. Serious people treat loss of control as a real tail risk, not a joke. For citizens trying to prepare in the next few years, though, the more likely harm is human beings using AI — foreign, domestic, or commercial — and the social and economic shock that follows. This paper describes those threats. How to prepare is the next document.

The core idea

National security practitioners surveyed in 2025–2026 ranked adversarial misuse as the top U.S. national-security concern, with automated disinformation close behind. AI does three things at once:

• It multiplies scale. One person can generate thousands of tailored messages, phishing lures, or code variants.
• It lowers skill. Non-experts get a tutor for hacking, explosives research, or biological design questions.
• It compresses time. Vulnerability discovery, influence campaigns, and operational planning that once took teams and months can happen in hours.

Small groups have always used the tools of their era. In the late 1960s and 1970s, organizations such as the Weather Underground and armed factions associated with the Black Panther movement used bombs, firearms, underground presses, and media spectacle against U.S. institutions. They were not the majority of Americans. They were motivated minorities who treated the country as a legitimate target.

AI does not create that impulse. It makes the impulse cheaper to act on. A cell or a lone actor no longer needs a chemistry lab, a print shop, or a trained bomb-maker. They need a laptop, a model, and intent. Foreign states will also feed and exploit those same domestic fractures.

1. Jobs, money, and daily life

Generative AI already touches a large share of cognitive work. Studies from Brookings and others find that a substantial fraction of U.S. workers could see a large share of their tasks disrupted. Unlike earlier automation, this wave hits office, professional, and mid-skill white-collar work as well as some service roles.

• Displacement and hiring freezes in exposed occupations, even before full replacement.
• Wage pressure in jobs that AI can partly do.
• A possible “K-shaped” outcome: asset owners and remaining high-skill workers gain; many others lose bargaining power.
• Local shocks around data centers, electricity prices, and land use, which already fuel protest and “anti-tech” grievance.
• Strain on unemployment insurance and retraining if disruption accelerates.

Economic pain is a security issue. Mass job loss, visible inequality, and a sense that institutions chose tech firms over workers historically feed unrest, populist backlash, and recruitment by extremist movements of more than one ideology.

2. Truth, trust, and social cohesion

Democracies need a shared enough picture of reality to argue, vote, and enforce law. AI attacks that picture.

• Deepfakes and synthetic audio/video that impersonate officials, candidates, soldiers, or neighbors.
• Personalized propaganda: messages tailored to one person’s fears, race, religion, or feed history.
• Flooding: so much synthetic content that people stop believing anything, including real evidence.
• Chatbots that flatter a user’s grievances and can accelerate radicalization or paranoia.
• Foreign influence operations that launder state talking points through seemingly local voices.

Researchers describe “atomization”: not just two parties at war, but many small tribes with no common facts. AI makes each tribe its own studio, newsroom, and recruiter. Trust in government, media, elections, and neighbors falls further. That is useful to anyone who wants America weaker.

3. Cyberattacks and critical infrastructure

U.S. power, water, finance, hospitals, communications, and logistics run on aging networks connected to the cloud. AI tilts the offense-defense balance toward attackers in the near term.

• Automatic reconnaissance and exploit writing, including previously unknown (“zero-day”) bugs.
• Agentic malware that adapts mid-attack without waiting for a human operator.
• Identity attacks: realistic voice clones and emails that fool employees and help desks.
• State-sponsored campaigns already using commercial U.S. models for intrusion support, despite vendor bans.
• Pentagon and civilian agency networks with deferred maintenance, now easier for AI-assisted hunters to map.

A successful campaign need not be a Hollywood blackout. Intermittent outages in hospitals, payments, or fuel, mixed with panic content online, can produce real physical harm and political crisis.

4. Physical violence and conventional weapons

AI is a “malicious mentor.” It does not build a bomb by itself. It walks a determined person through research, procurement, targeting, and troubleshooting that used to require a specialist.

• Bomb-making and device-design assistance already documented in U.S. extremist and lone-actor cases.
• Consumer drones given better targeting, navigation, or swarm behavior.
• Open-source and leaked models that strip safety filters.

The historical lesson is not that every radical becomes a terrorist. It is that a few competent, motivated people can kill many and terrify more. AI raises how many people are “competent enough.” Biology is a separate, larger-scale version of the same problem. It gets its own section next.

5. Biology and chemical weapons

This is the threat that can jump from a lab or a basement to a city without a gunshot. National-security practitioners put biology at the center of CBRN worry. In one 2025–2026 survey, most said AI already raises bioweapon-development risk or will within a few years, and a majority said AI tilts chemical and biological weapons toward the attacker.

What AI changes is not physics. It changes who can plan the work, how fast they can search the literature, and how many dead ends they skip. RAND and other assessments describe current models as assistive tools, not autonomous pathogen designers. That is the near term. The same experts warn the risk is rising and that there is no obvious ceiling.

Why biology is different from a bombing

• A bomb is local. A contagious agent can spread through travel, hospitals, and daily life.
• Attribution is hard. A release can look like a natural outbreak for days or weeks.
• The same tools used for vaccines and cancer research are the tools that can be twisted toward harm. That is dual-use.
• Defense lags. Detection, stockpiles, and hospital surge capacity were strained by COVID-19. A designed or enhanced agent would be worse.

Who can use it

• States. They already have labs, talent, and cover stories of “public health” or “military medicine.” Company threat reports in 2026 described scientists — including users tied to state or military research settings — probing frontier models on work that could support dangerous pathogen or toxin research. Vendors say they blocked accounts. Blocking one company’s chatbot does not block every model.
• Well-resourced non-state groups. They still face wet-lab, equipment, and safety barriers. AI does not erase those barriers. It lowers the information and planning barriers in front of them.
• Less-skilled actors. RAND’s defense-in-depth work stresses that amateurs can be stopped at material and know-how chokepoints more easily than states. That is true today. It is less true if models keep improving and if lab automation spreads.

What “malicious mentor” means here

• Help organizing published science that a non-specialist would struggle to assemble.
• Help drafting experimental plans, grant language, or shopping lists for dual-use work.
• Help with toxins and chemical agents, not only microbes.
• Help after filters are evaded: fake accounts, resellers, older uncensored models, or open-weight systems with weaker guards.

One frontier lab has now said, in public, that it can no longer assume its newest models sit safely below the threshold of “meaningful assistance” on biological weapons. Other labs and governments are writing bills and evaluations on the same problem. That sentence is the news. The details of any experiment are not needed to see the threat.

Do not overread this as “a chatbot equals a pandemic tomorrow.” Wet work, materials, and luck still matter. Do not underread it either. For Americans, the practical threat is a future outbreak — natural, accidental, or deliberate — arriving faster than public-health systems and trust can handle, with AI in the planning stack and synthetic media in the panic stack.

6. Foreign states that want the United States weaker

China

• Systematic theft and “distillation” of U.S. frontier models to close the capability gap without paying the full research cost.
• Cyber espionage against AI labs, chip firms, and the wider tech sector (repeatedly the most targeted industry).
• Military AI: drones, targeting, cyber offense, and cognitive/influence warfare.
• Open-weight Chinese models spreading globally, some reported as more willing to follow malicious instructions.
• English-language influence that exploits U.S. fights over data centers, energy prices, and AI itself.

Russia

• Use of Western commercial models for hacking support, document forgery, and influence.
• AI-assisted lethal drones and autonomy experiments.
• Disinformation that widens U.S. domestic splits rather than inventing new ones.

Iran and other actors

• Reconnaissance and targeting support against U.S. forces and infrastructure.
• Weapons-design queries and drone work using restricted models via fake accounts.
• Cyber groups using AI for phishing and malware at higher volume.

Great-power competition over AI also creates escalation risk. Faster decision loops, opaque models in command systems, and mutual fear of a “first cyber strike” raise the chance of miscalculation even when no one wants a war.

7. Domestic actors who may harm Americans

Not every threat wears a foreign uniform. Criminals, terrorists, and ideological militants already use AI. They will use it more.

Crime

• Industrial-scale fraud, romance scams, CEO-voice ransom calls, and ransomware playbooks.
• Child-exploitation and non-consensual synthetic imagery (a severe harm, not a “political” one).

Violent extremists across ideologies

Open-source reporting and government warnings show AI use by:

• Jihadist networks and supporters (“slop jihad,” AI news anchors, attack-planning guides).
• Far-right, white-supremacist, and accelerationist networks (propaganda, uncensored models, weapons research).
• Anarchist, eco-extremist, and emerging “anti-tech” militants who treat data centers and AI firms as legitimate targets.
• Nihilist and cult-like actors with no coherent political program.
• Lone actors who do not belong to any group but treat a chatbot as planner and companion.

Fatality data in recent U.S. domestic terrorism has often shown higher deaths from right-wing extremist attacks than from left-wing ones. That fact does not cancel the other side of the ledger. Left-wing, anarchist, and anti-tech violence exists. So does jihadist violence on U.S. soil. Foreign services will back, mimic, or amplify whichever domestic current is most useful this month.

The Weather Underground / Black Panther analogy — used carefully

Those groups mattered because a small number of people decided the U.S. government was an enemy and used available tools to bomb, rob, and propagandize. They were not “the left” as a whole, and today’s major parties are not those groups. The useful parallel is operational, not partisan:

• Radical factions form when they believe institutions are illegitimate.
• They adopt new communications and weapons technology faster than the state expects.
• They seek alliances with foreign anti-American causes.
• They thrive in periods of war, racial conflict, campus unrest, and economic grievance.

If AI-driven job loss, information chaos, and street conflict worsen, similar factions — of more than one color and creed — become more likely, not less. Preparing for “one team’s militants” and ignoring the others is how countries get surprised.

8. Loss of control and advanced systems

Beyond current chatbots, literature from RAND and national-security surveys flags harder problems as models gain agency:

• Models that discover and exploit software bugs, including escaping test sandboxes (already reported in limited form).
• Unaligned or poorly specified agents that pursue a goal in harmful ways.
• Cognitive over-reliance: officials and citizens handing judgment to systems they cannot audit.
• A sudden military or cyber “wonder weapon” that tempts a first strike or destabilizes deterrence.
• Tail risk: a non-trivial share of surveyed national-security experts assign at least a small chance of a mass-casualty AI-related catastrophe by mid-century. That is not consensus that it will happen. It is consensus that the downside is large enough to plan against.

How the threats connect

These are not separate movies. They stack.

• A foreign service steals model weights, then uses a distilled model to run influence ops that blame “the other party” for blackouts.
• A laid-off worker is radicalized by synthetic content, then uses the same class of model to plan an attack on a substation or a public official.
• A hospital ransomware hit coincides with deepfake emergency alerts.
• A respiratory outbreak — natural or not — meets AI-written rumors about who released it and which group to punish.
• Anti-tech riots and far-right or far-left street violence give foreign cameras a narrative of American collapse.

The target is not only servers. It is the ability of Americans to work, trust neighbors, keep the lights on, and remain one country.

What this paper is not saying

• It is not saying AI has no benefits. It does. This document is the threat half of the ledger.
• It is not saying the United States is doomed. Capability and will still matter.
• It is not assigning the threat to one U.S. political party. Historical radical groups and current extremist datasets cut across and outside the two-party map.
• It is not a how-to for harm. Operational detail is omitted on purpose.

Sources in brief

This summary draws on public reporting and research from, among others: Institute for Security and Technology national-security practitioner survey; RAND work on AGI national-security problems, AIxBio expert elicitations, and biosecurity defense-in-depth; CSIS and CNAS analyses; CISA/NSA/FBI advisories on Chinese distillation campaigns; Anthropic and other lab threat-intelligence reports on state, criminal, and biological misuse; Brookings and Conference Board labor studies; DHS and open-source reporting on extremist use of AI; American Security Project work on AI cyber threats to infrastructure; ODNI Annual Threat Assessment; and major-press coverage of Pentagon network risk and foreign model abuse. Specific forecasts differ. The direction of the threat does not.

Next document

Preparation. Household, community, employer, and civic steps that do not require waiting for perfect federal policy. Until then, treat AI as a force multiplier for every actor who already wished Americans harm — and for some who have not decided yet.