Countering terrorist propaganda in the age of AI
Bottom lines up front
- The time between radicalization, recruitment and action for would-be terrorists has gotten shorter over the past twenty-five years.
- AI could further shrink that time—while exposing many more people to terrorist propaganda.
- Counter-terrorist efforts must be aimed at limiting access to such content in the first place.
Over the last quarter century, the time between recruitment and action for would-be terrorists has been shortened in large part due to access to modern technologies. Rapid communication through social media and the expanding use of AI tools help recruit would-be terrorists quickly, exposing them to violent propaganda and encouraging action on behalf of a terror organization, representing one of the largest shifts—and emerging threats—in 2026.
Groups such as Hamas, al-Qaeda, and the Islamic State of Iraq and al-Sham (ISIS) leverage technology to operate far from their geographic centers of gravity, supplanting their once-physical caliphates with digital ones. Connective technologies link disparate individuals and cells and allow them to share terrorist propaganda and “how-to guides,” expand networks through radicalization and recruitment, and enable dispersed groups to share knowledge and engage in trade. Small terror cells, connected to larger organizations through online infrastructure, pose a complex threat to the United States and its allies because they are difficult to detect and are constantly innovating.
A persistent threat
In October 2024, two Afghan immigrants were arrested in Oklahoma after plotting to conduct an attack on Election Day. Then, on New Year’s Day 2025, a bombing in the French Quarter in New Orleans killed fifteen revelers. Another plot and two further attacks in early 2026 highlight the persistent threat that ISIS and its affiliates continue to pose to the United States. In these cases, the men had interacted with ISIS-affiliated media prior to their attacks, demonstrating the ever-growing role that exposure to online extremist propaganda plays in terrorism radicalization.
Radicalization is a complex, highly individualized process. Although the specific causes of radicalization are unique to each individual, academic researchers report that exposure to propaganda that justifies violence closely predicts whether an individual will radicalize and espouse extreme beliefs. The internet and social media in particular enable such terrorist propaganda to reach vulnerable populations quickly and easily. Prior to a few years ago, interested individuals had to specifically seek out terrorist propaganda through dark web sites or on niche forums; now, terror groups can leverage easily accessible tools to reach potential followers. For example, in 2023 and 2024, pro-Hamas influencers hijacked hashtags that initially represented support for Palestinians to spread terrorist content on Twitter and TikTok. ISIS is especially skilled at leveraging the internet to promote its message and radicalize individuals, as the group’s ability to promulgate its message on social media played a key role in both its emergence and in its enduring ability to attract followers.
Al-Qaeda has also demonstrated its ability to continue to reach Western audiences through targeted propaganda. In late 2023, al-Qaeda in the Arabian Peninsula (AQAP) revived its English-language online magazine Inspire, which is intended to reach Western audiences with attack tactics, recruitment pitches, and ideological training. In June 2025, AQAP used Inspire to call for the assassination of US political leaders. The early 2026 edition of Inspire encouraged would-be terrorists in the West to acquire bomb-making materials, glorifying the individuals who used homemade IEDs (improvised explosive devices) in the December 2025 attack in Australia.
Additionally, generative AI has emerged as a force multiplier for terrorist propaganda and radicalization efforts. For example, ISIS has produced AI-generated news videos and deepfake audio clips in multiple languages within days of major events. During the 2023 Gaza conflict, Hamas-affiliated propagandists circulated AI-manipulated images, including fabricated photos of atrocities and fake images of Israeli soldiers, to inflame emotions and undermine enemy morale. By using synthetic media that mimics legitimate news or popular entertainment, terrorists are able to rapidly and broadly spread disinformation and hateful narratives while evading content moderation.
From radicalization to action
Not everyone who is exposed to pro-terrorist online content decides to take action in support of a group. Radicalization itself does not directly result in violence, according to academic literature; recruitment into a terror group and acting on its behalf often requires encouragement and interaction with another person. However, terror groups are leveraging technology to reduce the barriers to violent action and are recruiting individuals to conduct violent acts more quickly than ever. For example, ISIS’s digital apparatus, including encrypted messaging platforms and rapid content replication, is critical to its durability and ability to continually recruit members. This digital ecosystem allows the organization to disseminate instructions, assist supporters, and relay guidance without persistent physical contact, reducing the timeline between radicalization and mobilization.
A late March Inspire article encouraging homemade IEDs highlights one of the most concerning recent trends in terrorism that reduces the timeline between radicalization and action. Terror groups, including ISIS and al-Qaeda, are providing online how-to guides for developing weapons, many of which describe simple bombs that can be used to inflict mass casualties and can be constructed from materials available at a hardware store. By supplying bomb-making instructions alongside inspirational material, terror groups remove barriers to conducting attacks and enable disaffected individuals to rapidly move from radicalization to action.
For example, a young man in Austria recently stood trial for his attempt to attack a Taylor Swift concert in Vienna in 2023; the evidence presented against him included instructions he had downloaded from an ISIS website on building a shrapnel bomb. Beyond providing how-to guides for building bombs, some examples are emerging of jihadist groups using 3D printing technology to expand access to weapons. In late 2024, a US servicemember was arrested for selling 3D-printed machine gun components that were intended for use in an al-Qaeda-inspired attack.
The rise of AI-driven chatbots and interactive systems can facilitate recruitment and enable short-term operational planning, compounding the trend of shortening the radicalization-to-action pipeline. Extremist chatbots, powered by large language models, can engage potential recruits individually, tailoring radical messages to specific interests or grievances. This automation allows terror networks to groom and indoctrinate sympathizers at scale, with human recruiters only stepping in for final vetting. Beyond recruitment, AI “advisers” can assist in training and planning: open-source models fine-tuned without safety filters may provide instructions for making explosives or attack strategies. Researchers have demonstrated that jailbroken AI models could be directed to help with terrorist training, operational planning, and propaganda development. The potential for tech-savvy militants to build unrestricted jihadi chatbots may make violent knowledge available on demand, providing a virtual planner that guides lone actors through every step of an attack.
Decentralization and hardened communications
As terror groups turn to the internet to radicalize and recruit new members and inspire attacks, the same systems enable terror groups to reduce the need for a geographic footprint. Groups that once had territorial strongholds in the Levant, such as ISIS and al-Qaeda, are now networked enterprises that rely on a digital backbone. This structure increases leadership resilience and decreases vulnerability to geographic setbacks by dispersing the operational while preserving branding coherence without requiring a tight command-and-control structure. Encrypted ecosystems function as procurement exchanges, peer-support forums, and troubleshooting hubs where ISIS supporters share guidance on sourcing drone components, electronics, communications equipment, and explosive precursors. These systems also enable decentralized logistics, decreasing localized cells’ reliance on centralized supply chains or traditional smuggling networks.
Beyond radicalization, the shifting, decentralized nature of terror organizations is enabling group management from dispersed locations and the dissemination of propaganda that is harder to remove. Terrorist networks are exploiting blockchain-based internet technology and decentralized platforms to harden their communications. As mainstream social media and hosting sites crack down on extreme content, terrorists migrate to blockchain-based and peer-to-peer networks that are more resistant to takedown. For instance, ISIS supporters have experimented with minting propaganda as NFTs (nonfungible tokens) on public blockchains, effectively creating permanent, unerasable records of extremist content. Similarly, groups are exploring decentralized file-sharing networks and encrypted social feeds to distribute videos and manuals beyond the reach of tech companies’ content policies. Coupled with AI-enabled auto-translation tools, a single piece of propaganda can be instantly rendered into dozens of languages and proliferated via uncensorable channels. The convergence of generative AI and blockchain infrastructure amplifies the global reach of terrorist messaging, helping militants bypass traditional monitoring on the open web and recruit across linguistic or national boundaries.
Islamic State-Somalia (ISIS-S) is a small ISIS affiliate that encapsulates a decentralized terrorist network. Although the group does not control major population centers or conduct major attacks, it operates as a revenue generator and facilitation hub for the whole ISIS umbrella enterprise. Through explosives expertise, emerging UAV use, encrypted coordination, and maritime connectivity, ISIS-S supports the reconstitution of the Islamic State group across regions and accelerates the downstream diffusion of tactics across the group.
Tactically, ISIS-S treats Somalia as a testing and refinement environment. The group experiments locally, identifies what works under real conditions, and converts successful practices into codified guidance for the group writ large. Encrypted communications platforms, for example, allow ISIS-S facilitators to distribute lessons learned from local experimentation throughout the Islamic State group’s network. Such engagement enables other affiliates to learn from experience and obviates the need for physical training camps. Critically, ISIS-S has used the permissive environment in Somalia to expand its use of commercial unmanned aerial systems, using drones for reconnaissance, surveillance, and propaganda. It spreads this knowledge to other ISIS affiliates, providing insight across the organization into the integration of UAVs with explosive payloads.
Policy recommendations
Policy options to counter these technology-influenced terrorism trends must keep pace with private-sector advances. This effort will require public and private entities to cooperate and collaborate, while ensuring that free speech and privacy are enshrined in policy. These options will need to emphasize standardization and cooperation across borders and at all levels of engagement. Operating from standard definitions of terrorism or radicalization, and having a coordinated international response, will be more effective than implementing one or two policy recommendations individually. As counterterrorism has shifted, practitioners need to reconsider the ways they work to resolve these problems including by incorporating open-source intelligence (OSINT), human rights protection, community engagement, and financial investigations.
As the timeline between exposure to radical content and committing acts of violence shortens, efforts must be aimed at limiting access to the content in the first place. Several promising programs already underway could gain efficacy and traction if private and public entities partner to encourage international collaboration. In all instances, laws and free-speech rights must be protected and preserved. For years, legislation and debate have centered on the ability of media platforms (whether traditional or social) to be spaces for debate and discussion. Moves to counter the radicalization and recruitment underway must always ensure the preservation of civil rights.
- Hash sharing: Hashing, or the digital fingerprint of a piece of online content, can quickly identify whether content is violent or otherwise supports terrorism. Hash sharing between organizations and countries can help identify this content quickly and enable tech companies to identify terroristic content without resharing it and accidentally promulgating the message. Hash sharing has been proven effective in preventing the exploitation of children online, as hashes were shared between the US government and Google to identify and quickly remove abusive material. Applying the same concepts to counterterrorism, and using existing counterterrorism partnerships between organizations and countries, could represent a pathway to quickly identify and remove content before it spreads widely. In the counterterrorism context, sharing hashes across companies and government entities, counterterrorism practitioners may be able to slow the replication of content across and between platforms—increasing the time between recruitment and action.
Today, legacy hash sharing is insufficient. Hashes can identify known terrorist images and videos, though there often are discrepancies regarding what should be included. Extremist ecosystems increasingly rely on edited clips, screenshots, altered audio, translated text, memes, synthetic media, URLs, livestream fragments, and platform-specific repost tactics. The Global Internet Forum to Counter Terrorism’s work to prevent terrorist and violent extremist exploitation of digital platforms remains a critical foundation, but the next stage should move from simple content matching toward privacy-conscious indicator sharing. That means sharing hashes, URLs, behavioral signals, media fingerprints, adversarial edits, crisis-response packages, and provenance indicators, where law permits and oversight exists. It also means improving transparency, auditing, redress, and civil-society access so counterterrorism systems do not over-remove lawful speech.
- Strengthening cooperation frameworks: Although some of the connective tissue already exists between Western governments and technology companies, these partnerships should be improved to better address the rapidly changing counterterrorism environment. Establishing clear legal authorities and standardizing engagement protocols between governments and firms will allow for more flexible means of addressing transnational threats.
Technology-based terrorist infrastructure is dispersed and transnational, with messages and systems routed through several countries and accessible to users worldwide. Current frameworks do not match the speed at which networks reconstitute, or digital information appears and disappears, and standardizing these frameworks will allow for a faster response. Establishing standing mechanisms between governments, and between firms and governments, will be much more responsive than our current patchwork for ad hoc coordination to share threat indicators and emerging tactics, techniques, and procedures.
Jurisdictional challenges, evidentiary standards, and data access often differ between countries. Working to identify the seams and create a mechanism to enhance communication and identify solutions will help to counter the emerging trends. Success is not a matter of removing content from just one platform. These efforts must target the entire digital ecosystem: account creation pipelines, mirror networks, payment pathways, translation nodes, archive repositories, and trusted amplifiers. - Using AI to counter terrorist messages: Working with social media providers to develop AI tools that can identify and remove online terrorist content may prevent extremist messages from reaching susceptible individuals. Emerging research suggests that AI can effectively detect content that supports online radicalization, and a study conducted in the European Union found that AI tools provided a “significant improvement” in law enforcement’s ability to identify indicators of online radicalization.
Meta has built an AI tool that identifies hateful videos across the internet, enabling other organizations to increase their ability to monitor for threats of radicalization. Since introducing the tool, Meta has reported a substantial reduction in the amount of online hate speech on its platforms. These successes, and the academic research, demonstrate that increasing the use of AI to detect indicators of online terrorism recruitment and remove such content is an effective way to prevent individuals from being exposed to messages that justify violence. As this infrastructure already exists, establishing opportunities for governments and private firms to develop potential scenarios may help to identify ways to leverage AI to counter future radicalization content. - Shifting from content removal to network disruption: Removing content can reduce harm, but it cannot be the entire strategy. Terrorists exploit technology in a network, and any response should target the network’s connective tissue. Terrorists leverage financial flows, domain infrastructure, cloud abuse, procurement channels, translation nodes, repost networks, influencer bridges, and cross-platform migration patterns. Financial intelligence and sanctions tools should integrate more closely with online disruption, especially where affiliates or supporters use cryptocurrency, crowdfunding, e-commerce, or informal value-transfer systems. OSINT should support this work, but analysts must validate open-source findings against legal standards. In the best model, intelligence, law enforcement, development agencies, and community-based prevention operate as separate but coordinated lines of effort, each with distinct authorities and safeguards.
- Deterring youth engagement: Several nations, including Australia and more recently Brazil, have developed legal frameworks to prevent youth from using social media. Legal tools such as these can help prevent vulnerable youth from accessing terrorist content in the first place, making it much more challenging for them to radicalize online. These age-enforcement thresholds also help to deter behaviors that, while technically legal, are harmful to youth, such as participation in fringe online communities or consuming violent, terrorism-precursor content. By learning from nations that have successfully banned teens from using social media, other countries can implement similar laws that protect youth while preserving adults’ civil liberties.
- Defending rights and free speech: When implementing any of the above solutions, the United States and its allies should be cautious of undermining civil liberties, free expression, or legitimate political speech. Terrorist actors often deliberately operate below traditional legal thresholds meant to protect free speech, exploiting those gaps. To successfully counter this type of online content, we must clearly define the types of content that are most likely to result in radicalization, clarify legal authorities surrounding removal, and establish a shared, clear definition for operationalizing online counterterrorism.
About the authors
Danielle Cosgrove is a senior adviser to the Atlantic Council’s Counterterrorism Project. She is a distinguished guest lecturer, a Stanford MedicineX scholar, and the founder and former CEO of an acquired threat-mapping start-up.
Doug Livermore is a senior US government civilian and reserve Special Forces soldier with extensive experience in national security, intelligence, special operations, irregular warfare, and counterterrorism. He has served in various relevant roles for over two decades, regularly speaks and writes on these topics, and is a graduate of both West Point and Georgetown University.
Erin K. McFee is the founder and executive director of the Corioli Institute, where she leads research and policy engagement on reintegration, irregular conflict, armed violence prevention, and the security implications of formerly armed actors, and a nonresident senior fellow with the Atlantic Council’s Adrienne Arsht Latin America Center. Her work draws on more than fifteen years of field experience across four continents, with a focus on translating frontline research into actionable guidance for defense, security, and stabilization communities.
Morgan Tadych is an open-source intelligence professional, Army veteran, and Atlantic Council Counterterrorism Project adviser. She spent much of her military career researching strategic Eurasia issues and deployed to conduct counterterrorism missions, and is currently pursuing a graduate degree in the field.
Timothy “Tito” Torres is the cofounder of Arrowhead Research and a former special operations and intelligence professional focused on national security, technology, and economic systems. He is a Tillman Scholar, Presidential Fellow, and Georgetown alumni focused on breaking down silos and connecting national security with economic and energy systems to better anticipate and navigate complex global risks.
Related reading
Explore the program
The Scowcroft Middle East Security Initiative (SMESI) provides policymakers fresh insights into core US national security interests by leveraging its expertise, networks, and on-the-ground programs to develop unique and holistic assessments on the future of the most pressing strategic, political, and security challenges and opportunities in the Middle East.
Image: Big data analytics neural flow. Shutterstock