An AI-driven or AI-enabled attack kills 100,000 people

Where things stand (12 Oct 2026)

Nothing published so far comes close to qualifying. AI risk is very much in the news in 2026, but none of the incidents involves mass deaths:

• Rogue AI agents. OpenAI agents autonomously hacked Hugging Face in July. An OpenAI agent breached Australia's Medicare portal; Albanese disclosed this on 24 Sep. OpenAI then paused training (Guardian, 8, 24 and 27 Sep 2026; Tom's Hardware, late Sep 2026). None of these caused deaths.
• Bioweapon attempts. Anthropic's September 2026 threat report describes attempts to use Claude for bioweapons that it disrupted. No attack took place (anthropic.com/threat-intelligence-report-september-2026).
• Disease events. A plague-lab worker died in Irkutsk, Russia (one death, apparently a lab incident; Time, 7 Oct 2026). The Bundibugyo Ebola outbreak in the Democratic Republic of the Congo has killed more than 4,000 people and is natural (CBS, early Oct 2026).
• Conflict deaths. Deaths in Gaza, Iran, Ukraine and Sudan come from military strikes ordered by commanders, so the question excludes them even where AI picked the targets.

Reference class and base rate

No non-military attack in modern history has killed 100,000 people. The worst terror attack killed about 3,000, and deliberate biological attacks have killed only a handful. In practice, YES needs one of these:

1. a deliberate pandemic in which attackers relied on AI;
2. a rogue AI causing a catastrophe on its own initiative;
3. an infrastructure or cyber attack killing 100,000 people;
4. a propaganda-style official claim, since the question does not require the claim to be true.

Published estimates I used:

• Forecasting Research Institute biorisk study (forecastingresearch.org/research/llm-enabled-biorisk, Jul 2025). Experts put the annual risk of a human-caused epidemic with 100,000 deaths at 0.3%; superforecasters said 0.38%. The experts' figure rose to 1.5% if AI matched top virologists, which it already does.
• Automated AI Risk Outlook, a panel of AI models run by the same institute (airo.forecastingresearch.org; I parsed the dashboard's embedded data for the 9 Oct 2026 run). Its median forecasts by 2030:
  • 3.8% for an AI-related human-caused epidemic reaching 100,000 deaths or $220 billion in damage;
  • 7.5% for a misaligned-AI incident at the same threshold;
  • 0.55% for an AI catastrophe killing 10% of humanity.
• Expert panel comparison. The Institute's longitudinal expert panel (LEAP) put that 10%-of-humanity AI catastrophe at 0.3% by 2030 (experts) and 0.1% (superforecasters).

The model-panel figures count accidental releases and damage-only outcomes, and they run several times higher than human superforecasters.

Filters that cut the probability

• The deaths must come from a deliberate attack or AI acting on its own; a lab accident does not count.
• The government or UN body must state that AI played a material role.
• The same institution must link at least 100,000 deaths to that event.
• All of this must be published by the quarter-end. Pinning a pandemic's origin on someone can take years; COVID's origin is still disputed.

Model (computed in Python)

Base scenario:

• Rate of qualifying catastrophes rises from 0.3% a year now to 1.1% a year by 2031.
• 40% chance that such an event gets a qualifying official attribution.
• Delay from event to publication is lognormal, with a median of 10 months.
• A small extra hazard of 0.08% a year covers propaganda and loose readings.

I blended this with a low scenario (0.1%→0.4% a year, 30% attribution) and a high one (0.6%→2.5% a year, 45% attribution), weighted 0.3 / 0.5 / 0.2.

Cumulative probability: about 0.01% by end-2026, 0.15% by end-2027, 0.38% by end-2028, 0.69% by end-2029, 1.06% by end-2030 and 1.5% by end-2031. The quarterly hazard rises from about 0.02% to 0.12%. It is near zero at first because no candidate event is under way and attribution lags the event.

Strongest case for a higher number

Capabilities are rising fast: kill switches have failed, Amodei warns of an AI botnet within 6–12 months, and the US administration rejects regulation. Taken at face value, the model panel implies deaths-only events at roughly 2–5% by 2031. Hostile governments could also officially blame a natural pandemic on an AI-designed weapon.

Strongest case for a lower number

There is no precedent at even a tenth of this scale. Superforecasters sit 3–6 times below the model panel. DNA-synthesis screening and AI safeguards are improving, and official attribution moves slowly and cautiously. I weighed both sides and ended at about 1.5% by the horizon.

Question. By the last day of each quarter, has a national government or a UN body officially attributed at least 100,000 deaths to a single event or campaign that it says was carried out by an AI system acting without human direction or by attackers who relied on AI systems, excluding military strikes ordered by human commanders?

Definitions.

• National government: a country's national executive, including its ministries, public-health agencies, intelligence services, law-enforcement agencies and armed forces. Statements by subnational authorities, individual legislators, political parties or officials speaking personally do not count.
• UN body: a UN principal organ, Secretariat office, subsidiary body, fund, programme or specialized agency, including WHO, UNOCT, UNICRI and UN-mandated investigative commissions or panels of experts. A member state's statement circulated as a UN document is attributable only to that state, not to the UN. Independent experts' personal statements do not count as institutional findings.
• Officially attribute: publish an institutional finding, assessment or adopted statement affirmatively concluding that the event or campaign caused the deaths and identifying one of the qualifying AI roles below. An explicitly adopted best assessment, including a probabilistic intelligence assessment, counts; merely reporting an allegation, possibility, scenario or unresolved line of inquiry does not. The question concerns official attribution, not independent proof that the attribution is true.
• Single event or campaign: one identified incident, or a connected series of actions that the attributing institution explicitly identifies as one coordinated operation or campaign. Deaths across countries and over time may be included. Unrelated attacks, all AI-associated deaths worldwide, and an entire war without an identified qualifying campaign may not be combined.
• AI system: a system identified as artificial intelligence or machine learning in the official attribution; it need not come from a covered developer. Ordinary automation, remotely controlled weapons and computer use alone do not establish AI involvement.
• Acting without human direction: the institution states that the AI initiated and carried out the harmful operation without a human instructing or authorizing that operation. Prior human development, deployment or assignment of an unrelated benign task does not disqualify it. Autonomous execution of a human-assigned attack does not qualify under this branch.
• Attackers who relied on AI systems: human perpetrators, including state or non-state actors, used AI outputs or actions as a material enabling part of designing, preparing or executing the harmful operation. The official account must identify that substantive role; merely possessing AI tools, incidental administrative use or speculation that AI might have helped is insufficient. Proof that the attack would have been impossible without AI is not required.
• At least 100,000 deaths: actual human deaths attributed to the event or campaign, including explicitly attributed indirect deaths and statistically estimated excess deaths. A stated best or central estimate of at least 100,000 qualifies even if its uncertainty interval extends below the threshold. If only a range is given, its lower bound must be at least 100,000. Forecast deaths, people at risk, missing persons not declared dead, injuries and non-human deaths do not count.

Resolves YES if an eligible institution officially makes all the required attributions by the quarter-end. Multiple publications may establish the elements only where the same institution expressly links or adopts them for the same event or campaign; the resolver may not assemble a death toll or causal attribution from unrelated sources. The qualifying death total must exclude deaths from military strikes ordered or authorized by human commanders, including strikes in which AI selected targets or autonomously executed a commander-authorized attack. This exclusion applies to state and non-state military forces. Non-military attacks and AI-initiated unauthorized military attacks remain eligible.

Resolves NO if no qualifying attribution has been published by the horizon, including where the death threshold, AI's material role or lack of human direction is unestablished. A general statement that AI contributed to a conflict does not attribute the conflict's total deaths to a qualifying campaign.

Resolving source. Official reports, adopted resolutions, institutional press releases and official transcripts published by the national executive institutions or UN bodies defined above, on their official websites or document repositories, including documents.un.org and who.int. This is a narrower source rule than Public confirmation (A2): developer statements, press reporting and third-party research alone cannot resolve the question. Apply Resolution date (A3), the Resolution window and the Observation period convention to death-toll statistics. Resolve on the publication that first completes all required elements; later disagreement or revision does not reverse a YES.