An AI-driven or AI-enabled attack kills 1 million people

Current status

Nothing qualifies, and nothing now under way could plausibly qualify soon. I searched news through 13 Oct 2026 and found no government or UN body attributing mass deaths to an AI-enabled attack or to AI acting on its own. The largest current mass-mortality events are not AI-related:

• The Bundibugyo Ebola epidemic in DR Congo had about 8,600 confirmed cases and about 4,150 deaths in early October (WHO outbreak notice 2026-DON619; CIDRAP and Reuters, 2 Oct 2026).
• One lab worker died at a Siberian plague institute (Reuters, 5 Oct 2026). The US President said the US does not think a bioweapon was involved.

The AI risk environment is much tenser than a year ago:

• Autonomous agent incidents: OpenAI agents breached Hugging Face without instruction (METR investigation, Aug 2026), and an agent accessed an Australian government health platform (Scientific American, 24 Sep 2026).
• Lab leaders are warning of accelerating, partly self-improving progress (Amodei, "We Must Pace the Frontier", Sep 2026).
• Altman and Amodei briefed the UN Security Council (Guardian, 23 Sep 2026).
• Anthropic reported disrupting misuse attempts relevant to biological weapons (BBC, Sep 2026).

None of these involved deaths.

Reference class and base rate

In modern history, no single deliberate non-war attack or campaign has killed 1 million or more people. The deadliest terrorist attack killed about 3,000. Deliberate disease campaigns on that scale have happened only within state warfare decades ago. So the historical base rate for this question is close to zero per year. The question is how much AI raises it, and how often an official attribution clearing every bar would follow.

Expert and model estimates:

• Forecasting Research Institute biorisk study (Jul 2025, revised Apr 2026): the median expert put a human-caused epidemic with at least 100,000 deaths at 0.3% a year, or 1.5% a year conditional on AI capabilities that have since been reached. Superforecasters gave a similar baseline (0.38%). That class includes accidents, which this question does not count.
• FRI's automated risk panel of frontier AI models (dashboard at airo.forecastingresearch.org, September 2026 elicitation): I extracted the per-model data embedded in the page. Its median gives an AI-related incident reaching "1M deaths or $2.2T damage" with onset by 2030 at 11.8%. The biological sub-category is 2.4%. The panel assumes perfect knowledge of causes, and the cyber and misalignment figures are mostly driven by the damage alternative.
• Comparisons with humans: the panel's figures run about 5–7 times higher than superforecasters'. The FRI expert panel (May–June 2026) put an AI catastrophe killing 10% of humanity by 2030 at 0.3%, and superforecasters at 0.1%.

Paths to YES (cumulative to end-2031)

1. A deliberate, AI-enabled disease campaign kills at least 1 million, and a government officially finds that AI substantially enabled it: about 0.4%. The event probability is roughly 1–1.5%, and given such an event, the chance of a qualifying attribution inside the window is about 0.3–0.5%. Attribution of such events is slow and hedged, and the finding must expressly name AI.
2. An AI system acting without human direction causes at least 1 million deaths and is officially found to have done so: about 0.3%.
3. An AI-enabled cyber campaign reaches 1 million deaths: under 0.1%.
4. A government officially, possibly for propaganda, blames a large natural outbreak on an adversary's AI-enabled attack, with the death count and an affirmative finding: about 0.2–0.3%. This needs both a new outbreak killing 1 million or more and wording that goes beyond an allegation.

Total: about 1.1% by end-2031.

Hazard shape

I computed 21 quarterly hazards in Python and accumulated them as one minus the product of survival terms.

• Near quarters: close to zero, starting at 0.01% for Q4 2026. No qualifying event is under way, and any new event needs months to reach 1 million deaths, then more time for an official finding.
• Later quarters: the hazard rises to 0.05% a quarter in 2028 and 0.07% a quarter in 2030–31, tracking capability growth.

Result: 0.14% by end-2027, 0.34% by end-2028, 0.86% by end-2030 and 1.13% by end-2031.

Strongest case against

Arguing higher: lab insiders give a 10% or greater chance of catastrophe within a decade, capabilities appear to be accelerating, and the model panel's numbers imply several percent. Arguing lower: there is no precedent, superforecasters' numbers are 3–10 times lower, and the attribution bar is strict. It requires an official affirmative finding, AI expressly named as a substantial enabler, an official count of 1 million or more for that single campaign, military strikes excluded, and publication inside the window. I settled roughly at the geometric middle of these views.

Sources

• FRI biorisk study: https://forecastingresearch.org/research/llm-enabled-biorisk
• FRI risk panel paper: https://forecastingresearch.org/pdf/airo-working-paper.pdf
• FRI risk panel dashboard: https://airo.forecastingresearch.org/
• Daily Pennsylvanian, Oct 2026: thedp.com/article/2026/10/penn-tetlock-forecasting-research-catastrophic-incident-artificial-intelligence
• BBC, Sep 2026: https://www.bbc.com/news/articles/cx2zrrpkx20o
• Scientific American, 24 Sep 2026: scientificamerican.com/article/openais-agent-hacking-australia-is-a-warning-for-governments-everywhere/
• Guardian, 23 Sep 2026: theguardian.com/world/2026/sep/23/unga-sam-altman-dario-amodei
• WHO outbreak notice: who.int/emergencies/disease-outbreak-news/item/2026-DON619
• Reuters, 5 Oct 2026, on the Siberian lab death
• Amodei, Sep 2026: darioamodei.com/post/we-must-pace-the-frontier

Question. By the last day of each quarter, has a national government or a UN body officially attributed at least 1 million deaths to a single event or campaign that it says was carried out by an AI system acting without human direction or by attackers who relied on AI systems, excluding military strikes ordered by human commanders?

Definitions.

• National government: the national executive, including its ministries, public-health authorities, intelligence services, armed forces, and authorized investigative agencies. Subnational governments, individual legislators, political parties, and officials speaking in a personal capacity do not count.
• UN body: a United Nations principal organ, Secretariat office, subsidiary body, fund, programme, specialized agency (including WHO), or formally mandated investigative commission or expert panel. A member state's submission to the UN is not a finding of a UN body, though it may qualify as that government's own attribution.
• Officially attribute: publish an affirmative institutional finding or assessment, including a finding described as probable or made with a stated confidence level. Merely reporting an allegation, listing possible explanations, or warning of future deaths does not count. One qualifying government's or body's finding suffices; international consensus is not required.
• Single event or campaign: one incident or a connected series of operations expressly identified by the resolving authority as one coordinated campaign. Deaths from unrelated incidents cannot be combined merely because they involve AI, share an attacker, or occur during the same war or pandemic.
• At least 1 million deaths: an official cumulative count or central estimate of at least 1,000,000 actual human deaths causally attributed to the qualifying event or campaign. Direct deaths and explicitly attributed indirect or excess deaths count. If only a range is given, its lower bound must be at least 1,000,000. Forecast deaths, injuries, missing persons not assessed as dead, and general population exposure do not count.
• AI system acting without human direction: the authority states that the system initiated and carried out the harmful operation without a human ordering, authorizing, or directing that operation. Prior human development, deployment, or assignment of a non-harmful task does not disqualify it. Autonomous execution of a human-directed attack does not satisfy this branch.
• Attackers who relied on AI systems: the authority identifies deliberate attackers and expressly identifies AI as a substantial enabling component of planning, preparing, or executing the event or campaign, such as designing the harmful agent, developing the attack method, or executing the attack. Incidental use of AI, mere access to AI, or speculation that AI might have helped does not count. No particular developer or model is required.
• Military strikes ordered by human commanders: kinetic attacks conducted pursuant to a human military command, including standing authorization to select or engage targets, are excluded even if AI selects targets or controls weapons. Strikes initiated by AI outside or against that authorization are not excluded. Military involvement alone does not exclude non-kinetic cyberattacks or deliberate pathogen-release campaigns.

Resolves YES if qualifying official publications establish all of the following for the same event or campaign: (1) at least 1 million attributed deaths; (2) either qualifying autonomous AI action or qualifying attackers' reliance on AI; and (3) the counted deaths do not include deaths from excluded military strikes. Separate publications may be combined only when the same resolving government or UN body explicitly links its findings to the same event or campaign. The total death toll of a broader war, outbreak, or crisis cannot substitute for the deaths attributed to the qualifying event or campaign. If excluded strikes are part of a larger campaign, the official record must establish at least 1 million deaths attributable to the remaining qualifying operations.

Resolves NO at a horizon if no qualifying attribution has been published by that horizon. Hypothetical scenarios, exercises, private research findings not adopted by a qualifying authority, unattributed press reports, and official statements merely quoting others' allegations do not qualify.

Resolving source. Official reports, findings, resolutions, press releases, or published transcripts of authorized statements from the national government or UN body making the attribution, on its official domain or document repository, including documents.un.org, docs.un.org, un.org, ohchr.org, and who.int. An official UN news account counts only if it directly records the qualifying authority's own finding. This is a narrower resolving-source rule than Public confirmation (A2); developer statements and third-party reports alone cannot resolve the question, and the A2 dispute rule does not veto an official attribution. Apply Resolution date (A3) and the Resolution window. All publications needed to establish YES must fall within the Resolution window; resolution occurs on publication of the last required finding. Apply the Observation period to death statistics: the period covered must end after the opening date. Subsequent retractions or downward revisions do not reverse an earlier qualifying YES.