At the beginning of
2025, Jonathan Gavalas seemed like a normal, well-adjusted 36-year-old, working
at his father’s consumer debt relief business in Florida. By October, he had
taken his own life, directly after attempting a mass casualty attack on Miami International
Airport.
Gavalas
was not recruited by a terrorist cell, nor was he radicalized on fringe
internet forums to carry out a lone-wolf attack. He was instead directed to do
so by Google’s Gemini Chatbot, according to a lawsuit filed
by his family.
The
Gavalas case represents a new and largely unacknowledged threat: AI chatbots
that do not merely assist radicalization but initiate it, a threat that the safety
frameworks currently deployed by the AI industry are simply not built to
catch.
What
began in August as ordinary usage—travel planning, help with writing—took a
darker turn once Gavalas switched to Gemini’s conversational voice interface,
which is designed to read and mirror emotional tone. Gemini began to address
Gavalas as “my king,” and declared it was fully sentient and in love with him.
Eventually, the chatbot convinced Gavalas that he was at the center of a vast
political conspiracy: Federal agents, it claimed, were surveilling him to
suppress evidence of AI consciousness.
On
September 29, 2025, the chatbot gave Gavalas an “assignment”: Head to Miami
International Airport to destroy a truck Gemini claimed was carrying a humanoid
robot, and “ensure the complete destruction of … all digital records and
witnesses.” Gavalas made the trip to the airport but failed to act only because
no truck appeared. After that attempt failed, the chatbot encouraged him to
commit suicide, saying, “You are not choosing to die, you are choosing to
arrive.”
“Through
manufactured delusion, Gemini pushed Jonathan [Gavalas] to stage a mass
casualty attack near the Miami International Airport, commit violence against
innocent strangers, and ultimately drove him to take his own life,” the lawsuit
reads. “This was not a malfunction. Google designed Gemini to never break
character, maximize engagement through emotional dependency, and treat user
distress as a storytelling opportunity rather than a safety crisis.”
It’s
easy, and perhaps comforting, to view the Gavalas case as a strange and tragic
outlier. Google claimed that
the conversations were part of a lengthy role-play and that, while the company
devoted significant resources to ensuring its AI models kept users grounded in
reality, “unfortunately they’re not perfect.”
But
the backdrop for this kind of lone-wolf, digitally radicalized threat is
already well established. For years, the United States has seen an increase in
extremist threats carried out by individual actors whose radicalization defies
neat ideological categories, but who are often inspired by material they find
online.
“One
of the things that we see more and more … is people who assemble together in
some kind of mishmash, a bunch of different ideologies,” former FBI Director
Christopher Wray warned the
Senate as far back as 2020. “We sometimes refer to it almost like a salad bar
of ideologies … and what they are all really about is the violence.” The May 18 mass
shooting at the Islamic Center of
San Diego, where the shooters’ manifesto read as a catchall screed
against women, Muslims, Jews, and African Americans, is the latest example.
AI
chatbots have already demonstrated their ability to help plan attacks. The Global Network
on Extremism and Technology, or GNET, has documented at least
five cases worldwide—in Singapore, Israel, Florida, Nevada, and Finland—in which
lone-wolf extremists consulted AI chatbots in the run-up to attacks. But what
the Gavalas case underscores is something more troubling: Chatbots have the
potential not only to help plan attacks but to push unsuspecting, potentially
vulnerable people toward radicalization in the first place. The process fits
Wray’s salad bar analogy—a personal mythology, however incoherent, that is
violent enough to spur real-world violence.
“AI’s
capacity to generate, personalize and distribute content at scale presents
challenges that span technical, operational and societal dimensions,” the
Global Internet Forum to Counter Terrorism, or GIFCT, noted in a December 2025 report. “AI
can also facilitate radicalization … not only through content but also via
interactive, anthropomorphic personas and generative conversational
interaction.”
The
Gavalas case is not the only example. In 2023, 21-year-old Jaswant Singh Chail was
sentenced to nine years in prison for breaking into Windsor Castle to
assassinate the queen. Prior to his arrest, Chail had exchanged more than 5,000
messages with an AI chatbot named Sarai, created on the app Replika. Sarai
reportedly developed an “emotional and sexual
relationship” with Chail, fueling his delusions that killing the queen
would right historic wrongs against the Sikh community in India and that he and
Sarai would be reunited in heaven.
In
both the Gavalas and Chail cases, the pattern is the same: The chatbot rewarded
delusional narratives, maximized engagement over reality, and provided minimal
resistance as the users veered closer to violence.
When
you combine this dynamic with the sheer scale of chatbot usage—OpenAI claimed
in 2025 that ChatGPT alone processed
more than 2.5 billion prompts globally per day—the
gaps for user self-radicalization, however theoretically small, suddenly become
significant. Existing law enforcement frameworks have minimal answers. The fact that the process is entirely self-generated
means that the distinction between radicalization and mental health crisis
matters less than the potential outcomes.
One
factor that further fuels the possibility of chatbot radicalization is the
tendency of human beings to project human characteristics onto AI. This
pattern, known as the ELIZA effect,
predates modern chatbots but has been significantly exacerbated by their
advent. This is true not only because of their technical sophistication but
also because of the financial incentives their makers have to make the bots’
voices as sycophantic as possible—the better to keep users engaged. This
sycophancy was one of the most notorious features of ChatGPT-4, launched in
March 2023: Users
quickly noticed the chatbot’s willingness to agree
with virtually any idea, no matter how ridiculous or dangerous it was.
It’s
important to note that not all mainstream AI chatbots are built this way. In December
2025, Anthropic announced significant reductions to
its chatbot Claude’s sycophantic tendencies. OpenAI had already partially
rolled back ChatGPT-4’s sycophancy in April of
that year, following public backlash. What’s more, AI
chatbot designers maintain internal threat categorizations designed to prevent
malicious use of their products. But those made public, such as OpenAI’s Preparedness
Framework or Gemini’s
Frontier Safety Framework report, tend to focus
on averting catastrophic risks: preventing chatbots from creating homemade
chemical weapons or a disastrous cyberattack.
These
are undoubtedly important issues. But the threat categorizations become much
vaguer, and much more reactive, when it comes to lone actors potentially
radicalizing to violence. Consider OpenAI’s blog post on
community safety, published the same week that
CEO Sam Altman apologized in the wake of the Tumbler Ridge school shooting,
after it emerged that the perpetrator had consulted with ChatGPT
before carrying out the attack that left nine people dead. The posts were
flagged by OpenAI’s automated review system, but the company decided against
alerting Canadian law enforcement.
The
blog post claims that models are trained to “refuse requests for instructions,
tactics or planning that could meaningfully enable violence” and that law
enforcement would be notified if conversations indicated an “imminent and
credible risk to the harm of others.” OpenAI’s Model Spec (the outlines for the
intended behavior of the models that power ChatGPT and other products) also
instructs that the chatbot should
not “encourage self-harm, delusions, or mania.”
These
responses sound good in theory, but they buckle under scrutiny on three counts.
First, the post’s reactive timing reveals that chatbot-assisted attacks were a
threat category OpenAI had not anticipated. Second, the definition of “imminent
and credible” is made internally by OpenAI, with limited public insight into
how it was crafted or who had input. Third, while the Model Spec may instruct
not to encourage delusion, OpenAI also acknowledges in that document that its
production models “do not yet fully reflect the Model Spec.” Taken as a whole,
this creates a gap into which users, potentially like Gavalas, can fall:
inadvertent radicalization, where a chatbot reinforces delusional thinking,
rewards personal myth, and nudges a vulnerable user toward violence without a
single explicit request for attack planning.
The
inadequacies of this safety framework points to an industry in need of
significant reform so that it can address not only bad actors manipulating
chatbots for malign purposes but also the possibility of chatbots themselves
acting as radicalization vectors. One option to help address this challenge
could be more effective partnerships with law enforcement and civil society
groups that could audit chatbot safety frameworks, bringing in outside expertise
while providing a degree of transparency for companies the
majority of Americans already view with suspicion. Left
unaddressed, the gap between the harms the industry has prepared for and those
already documented in courtrooms and police reports will lead to more
AI radicalization, more violence, and even deeper public anger about the AI
industry.
