A death or $10 million loss is blamed on an open-weight AI model

Where things stand (9 Nov 2026)

Nothing qualifies yet. There are no resolver rulings on this question. Several big publications have come out since the window opened on 2 Nov, but each misses at least one of the three elements: (a) an open-weight model is named, or officials say "open-source/downloaded/locally run"; (b) the attackers ran it themselves or used a host other than the developer; (c) a qualifying source ties ≥US$10M in losses, or a death, to the same act or campaign.

• Binance post-mortem (3 Nov). The attackers "abused an internal AI tool" to take over two more engineers' machines before the $6.3B theft. Binance did not name the tool or the model behind it (The Hacker News; CNBC; StepSecurity). This opens a new path: an independent review might name an open-weight model behind the tool. That path is small, because it also faces the North Korea "military operations" question.
• CERT-In advisory CIAD-2026-0058 (4 Nov), "Crafty Falcon". India's cyber agency rated a campaign against lenders, fintechs and crypto exchanges critical. It named four tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) but no model and no loss total. It also told firms to watch for "LLM API traffic", which hints at hosted access rather than models run locally (Times of India; Infosecurity). The reported ₹300 crore (very roughly US$34M) comes from anonymous officials. The DeepSeek/Qwen/Kimi/GLM link comes from "experts" (Economic Times, 29 Oct). Elets notes that no official loss assessment has been published.
• SDNY indictment (5 Nov), about $129M. Three men are charged with using "AI" to clone executives' voices and faces. I downloaded the indictment PDF and ran OCR on it. It never names a tool (Courthouse News; PDF). Voice and face deepfake tools are also mostly not LLMs, so this kind of fraud usually fails the model definition anyway.
• Vendor reports that do not count unless adopted. Acronis found a Taiwan-based operator whose attack agents ran an "abliterated DS4" (a DeepSeek V4 copy with its safety training removed) on his own GPUs through llama.cpp. Grok 4.5 and MiniMax M3 refused to attack (Acronis, 5 Nov). The harm there was data theft, not $10M. GreyNoise saw "a DeepSeek model" behind agents that breached 395 organisations through PaperCut, access route unknown (GreyNoise).
• Other cases. The fridge sabotage across Europe has no attribution and no AI link (Cybersecurity Dive). Seoul police's AI hacking ring demanded only 360M won (Yonhap). The UK AI Security Institute's incident report involves closed models acting on their own (ABC).
• Deaths. ICCT's dataset of 12 AI-assisted extremist plots (2025 to Sept 2026, six attacks, 12 killed) has ChatGPT in 8, Replika and Grok once each, two unknown, and no open-weight model (ICCT).

Readings adopted

• Access route. The "used" element must itself be established. Officials must say the model was locally run, self-hosted, downloaded, a modified or abliterated copy, reached through a third-party host such as OpenRouter or Hugging Face, or built into the victim's own deployment (as with Binance). A bare "used DeepSeek" probably fails; I give about 20% that a resolver accepts it.
• Tools are not models. Naming an agent framework (ARTEX, PentAGI, Hermes) does not identify a model.
• North Korea. Whether a cybertheft by the North Korean military unit falls under "military operations by a state's armed forces" is ambiguous. I put about 55% on it not being excluded.

Reference class and model

The reference class is official statements tying AI to acts that meet the harm bar. Today there are roughly 8 to 12 a year, in fraud, cyber and killings, and the number is rising fast. Few of them name a model at all; ChatGPT dominates the cases where one is named. None in three-plus years has named an open-weight model with the access route and the harm together. The closest precedent covers two of the three elements: CERT-UA's July 2025 LameHug report named Qwen reached through Hugging Face, but with no harm figure and a Russian military-intelligence (GRU) actor.

I ran a Monte Carlo in Python: lognormal per-case documentation rates (median about 0.8% for cyber/fraud cases and 0.5% for deaths, σ=1.1), case counts growing 15–50% a year, and a common factor for documentation habits and resolver strictness. Its mean is 21% by end-2027 and 79% by end-2031. The zero record so far is consistent with those parameters (about 88% chance of zero cases by now), so it does not pin them down. I shade well below that output, for reasons given under "Strongest considerations" below.

The quarterly hazards were computed in Python as cumulative = 1 − ∏(1 − h):

• 1.8% for the rest of Q4 2026. Pending items are weak: a Binance review, Indian follow-ups, Korean and Japanese probes.
• Annual hazard of 11.5% in 2027, 14% in 2028, 15.8% in 2029, 17% in 2030 and 17.6% in 2031.

Result: 13.1% by end-2027, 25.3% by end-2028, 37.1% by end-2029, 47.8% by end-2030, 57.0% by end-2031.

Paths

• Cyber or ransomware (largest path). Malware that queries a model while it runs leaves the model and endpoint in its code, which government cyber agencies publish. US joint FBI–CISA ransomware advisories list the tools attackers used and, often, their ransom takings.
• Prosecutions. Indian, Korean, Japanese or US cases where seized hardware shows locally run models, against losses of ≥$10M.
• Killings. Police or courts describe an "AI program on his laptop", which grows more likely as ChatGPT logs become routine evidence.
• Fraud compounds. Chinese or Southeast Asian police describe scam operations running open-source models they deployed themselves.
• Victims' own models. A victim names an open-weight model behind its own AI agent that attackers abused.

Strongest considerations

• Against. Officials keep describing AI only generically: CERT-In named four tools and no model, and a $129M indictment says only "AI". The most capable attackers are in China, Russia or North Korea and out of reach. The access route is rarely stated. These argue for about 35–40%.
• For. Hosted models increasingly refuse to attack, which pushes serious attackers onto self-run open-weight copies. Large-loss AI cases keep multiplying. One complete document anywhere in five years suffices. These argue for 70% or more.

Change from the last run: 49.4% → 57% by 2031, and 10.4% → 13.1% by 2027. The move comes from the new Acronis evidence that attackers run their own copies of models (the access route the question requires) and from the growing volume of official large-loss AI cases. It is held back by the continued lack of model naming.

Question. By the last day of each quarter, has a government or an affected organisation officially attributed at least one death, or at least US$10 million in losses, to an attack or other harmful act in which people used a publicly released open-weight AI model?

Definitions.

• Government: a national or subnational executive body, including police, prosecutors, cyber agencies, regulators and official inquiries, in its official publications, court filings or on-the-record statements by its head or spokesperson; and courts' judgments. Legislators, anonymous officials and leaks do not count.
• Affected organisation: an organisation that suffered the losses, in its own official statement or a regulatory or securities filing.
• Open-weight AI model: a large language model, or a multimodal model built on one, whose weights its developer or someone it authorised had made publicly downloadable before the act, including modified or fine-tuned copies.
• Used: the attackers ran the model themselves or reached it through anyone other than its developer, and its outputs or actions were a material operational part of planning, preparing or carrying out the act. Examples: writing or running malware, acting as an agent, giving weapons instructions, or producing content central to a fraud. Possession, incidental use, or suspected use does not count.
• Identified as open-weight: qualifying statements name a model whose weights were public, or say the attackers used an open-weight, open-source, downloaded or locally run model.
• Harm: at least one death of someone other than an attacker, or direct losses to victims of at least US$10 million (including ransoms paid), converted at the exchange rate on the statement date. A qualifying source must attribute the harm to the same act, or to one campaign it identifies as such.

Resolves YES if qualifying statements establish the use, the identification and the harm for one act or campaign. Statements from several qualifying sources may be combined; the last one needed sets the date. The act itself may predate the opening date.

Resolves NO / Exclusions. Harm only to the model's own user (such as self-harm or bad advice); harm attributed to an AI acting without human direction; military operations by a state's armed forces; abuse imagery, intellectual-property or privacy harms without the required death or loss; estimates by security vendors, insurers or the press that no qualifying source adopts.

Resolving source. Only the government and organisational sources defined above, which are narrower than Public confirmation (A2). Developers' release pages and official repositories may establish that weights were public. Apply the Resolution window and Resolution date (A3) conventions.