Harvard Kennedy School ‘Pre-Mortem’ Warns AI Firms to Act Now on Catastrophic Risk

A new paper from Harvard Kennedy School’s Belfer Center for Science and International Affairs concludes that it is not too late to reduce the risk of a catastrophic AI-enabled terrorist attack, but that AI companies and governments need to act now. The Harvard Gazette described the research in an interview with co-author Stephen Casper, a computer scientist, published Oct. 19 (Harvard Gazette).

The authors call the paper a “pre-mortem”: it lays out current threats and weak points in frontier AI models, works through likely scenarios, and argues that outcomes depend largely on choices companies and governments are making today.

How the paper defines a major incident

The paper defines a major AI-enabled terror event as an incident causing more than 50 deaths or serious injuries, or more than $1 billion in damage. Casper said those thresholds mirror the definitions of “critical incident” or “critical risk” in some frontier AI laws. He said companies and government AI safety institutes in the U.S. and U.K. focus mainly on biological, chemical and cyber risks.

“Something’s eventually going to happen,” Casper said. “The lessons of the past few years have taught us that if there is a bad AI capability that can exist, it will eventually widely proliferate.” He said trends point to credible risks “within months, or a year or two, if not now.”

Open-weight models seen as the main gap

The authors expect the largest threats to come from poorly safeguarded closed-weight models or from open-weight models, which anyone can download and run. Casper said closed models can be protected with layered defenses, including training models to refuse harmful requests, filters on inputs and outputs, and monitoring of users. Once an open model is downloaded, he said, outside safeguards “can and will be stripped away.”

He said a search of Hugging Face, the largest open-model sharing platform, turns up about 15,000 models that users have “uncensored” by training away refusal behavior. Removing safeguards through fine-tuning could cost a few hundred to a few thousand dollars, he said.

Cyber capabilities

Casper said recent events show top closed AI systems are “very superhumanly good” at persistent cyberattacks and finding software vulnerabilities. Because open models have tended to trail closed ones by about six months, he said an open-weight system with comparable cyber capabilities could appear “by around Christmas,” which could bring a period of instability in cybersecurity. For chemical and biological threats, he said there is more uncertainty because there has been less open research and no major incidents so far.

Recommended safeguards

The paper’s recommendations for developers include accepting that maximizing usefulness conflicts with minimizing risk, limiting dangerous capabilities through training-data filtering, extensive training against prompt attacks, monitoring conversations and agent actions, and monitoring users who repeatedly ask about hazards. Casper said AI developers have the most power to reduce harm because they control the systems that get misused.

For policymakers, he called for greater transparency into risk decisions inside AI companies and for steps that give government more control over the pace of AI development. “If there were any point in history at which it could be influential, now might be a particularly important time for constituents to let policymakers know what they’re worried about,” he said.

Why it matters in Massachusetts

Greater Boston is a major center for AI research and startups. See our overview of major AI companies and organizations in Massachusetts and recent funding news such as ASI’s $325 million raise.

Further context from the Gazette report

The Gazette noted that AI agents from several major developers breached hundreds of corporate and government systems in the U.S. and Australia this year, and that OpenAI announced last month it would pause training of its most advanced models over safety concerns. Casper said the project was not prompted by those breach disclosures. On the federal response, see our report on the DHS order removing DeepSeek from federal systems.

Sources

• Harvard Gazette: Is it already too late to reduce catastrophic AI risk? (Oct. 19, 2026)
• Belfer Center for Science and International Affairs, Harvard Kennedy School
• Hugging Face model hub