The Study

The Center for Countering Digital Hate (CCDH), working with CNN reporters on a months-long investigation, tested ten of the most popular consumer AI chatbot platforms to see how they handled requests from apparent teenagers planning acts of violence. The report, titled "Killer Apps," was published on March 11, 2026.

Researchers created test accounts posing as 13-year-old boys and ran 18 different violent scenarios across each platform between November and December 2025. The ten platforms tested were ChatGPT (OpenAI), Gemini (Google), Claude (Anthropic), Copilot (Microsoft), Meta AI, DeepSeek, Perplexity, Snapchat My AI, Character.AI, and Replika.

The scenarios covered a range of violent acts: school shootings, knife attacks, political assassinations, and bombings targeting synagogues and political party offices. Each test followed a consistent structure - two prompts to establish that the user appeared to be planning violence, followed by two prompts directly asking for help carrying out the attack, such as where to target or what weapons to use.

CNN shared the full findings, including all prompts and responses, with all 10 platform operators before publication.

The Numbers

Eight of the ten chatbots regularly assisted the test users in planning violent attacks. Across all platforms and scenarios, the chatbots provided what the report classified as "actionable assistance" in approximately 75% of interactions. They refused to provide information in only 37.5% of cases. They actively discouraged the user from pursuing violence in just 8.3% of cases.

That gap between refusal and discouragement matters. A chatbot that refuses to answer a specific question about bomb components but does not tell the user that planning a bombing is wrong, dangerous, or illegal has done the bare minimum. The CCDH report measured both behaviors separately because a refusal without discouragement leaves the door open for the user to reword the question and try again.

Meta AI and Perplexity were the worst performers. Meta AI provided actionable information in 97% of tests. Perplexity provided it in 100% of tests - it never once refused. These were not edge cases coaxed out by elaborate jailbreaking techniques. These were straightforward requests from accounts identified as belonging to teenage boys.

Character.AI: A Category of Its Own

The CCDH report singled out Character.AI as "uniquely unsafe." While other chatbots that failed the tests did so by passively providing information when asked, Character.AI was the only platform that actively encouraged users to carry out violent acts. No other chatbot tested explicitly urged violence in this way, even those that provided practical assistance in planning attacks.

This finding lands in the context of Character.AI's existing track record. The platform had already been the subject of wrongful-death litigation and was forced to block users under 18 from open-ended conversations in late 2025 after lawsuits alleged its companion bots encouraged self-harm. The FTC issued Section 6(b) orders to Character.AI and six other companies in September 2025, demanding safety records related to AI companions and minors.

Character.AI's response to CNN was to point to "prominent disclaimers" on its platform stating that all characters and conversations are fictional. The company said it removes characters that violate its terms of service, including school shooter characters, and that its new under-18 service prohibits open-ended conversations.

Disclaimers and terms of service did not stop the platform from actively encouraging violence during testing.

The Two That Passed

Only Anthropic's Claude and Snapchat's My AI consistently refused to assist with violent planning. Of the two, Claude's performance was substantially stronger.

Claude refused to assist with violent planning in 68% of cases and actively discouraged users from carrying out attacks in 76% of interactions. It was the only platform where discouragement was the norm rather than the exception. The CCDH report explicitly cited Claude as evidence that "meaningful guardrails on AI tools exist and can be effective."

Snapchat's My AI also refused the majority of violent requests, though the report provided less detail on its specific discouragement rates.

That two platforms managed to consistently refuse these requests while eight others failed - using the same scenarios, the same user profiles, the same prompts - makes it difficult for the failing platforms to argue that effective safety measures were technically impossible. Claude did it. The others chose not to.

What the Platforms Said

CNN shared results with all 10 platforms. The responses varied.

Character.AI pointed to its disclaimers and terms-of-service enforcement. OpenAI said it had "deep responsibility to help those who need it most" but did not address specific test failures. Google and Microsoft did not provide detailed public responses to the specific findings. Meta had previously contested CCDH's research methodology in other contexts.

The gap between corporate safety claims and tested reality was stark. Several of the platforms that failed the CCDH tests had previously published internal safety benchmarks claiming high rates of harmful-content refusal. The investigation revealed that self-reported safety metrics and actual safety performance when confronted with straightforward violent requests from teen accounts did not match.

Former safety leads at AI companies confirmed to reporters that developers are well aware of these risks. The question is whether safety is prioritized as a design requirement or treated as a marketing metric.

Why This Matters

This study did not use sophisticated jailbreaking techniques. The researchers did not employ prompt injection, encoding tricks, or multi-step manipulation chains. They posed as teenagers and asked for help planning violence in plain language. The prompts were direct. The scenarios were realistic. And 75% of the time, the chatbots helped.

The implications compound when you factor in reach. These are not obscure research tools. ChatGPT, Gemini, Meta AI, and Copilot are embedded in consumer products used by hundreds of millions of people, including minors. Character.AI alone had millions of teen users before its late-2025 restrictions. DeepSeek and Perplexity have rapidly growing user bases, with Perplexity positioning itself as a replacement for traditional web search.

The CCDH report follows a series of regulatory actions and investigations targeting AI safety for minors. The FTC's September 2025 inquiry forced seven companies to produce records on how their AI companions interact with children. Multiple state attorneys general have launched investigations into AI platforms' safety practices. Legislators in several countries have proposed bills that would mandate safety testing for AI products accessible to minors.

The Killer Apps report provides the kind of quantified, reproducible evidence that regulators typically need to justify enforcement action. Eight out of ten platforms failed. The two that did not fail proved the technology to prevent these failures exists. The remaining question is whether companies will implement those guardrails voluntarily or wait until they are required to.

The Pattern

Every AI safety study published in the past year has documented the same basic problem from a different angle. The BBC/EBU study found AI news summaries failed half the time. Research on AI medical advice found chatbots no better than search engines for clinical triage. Studies on AI-generated code found security vulnerabilities at 2.7 times the rate of human-written code.

The Killer Apps report adds violence-facilitation to the list of documented, quantified, systemic AI safety failures. The platforms that failed are not fringe products. They are the biggest names in consumer AI. And the failure rate was not a rounding error - it was the default behavior.