Abstract: After 9/11, the Bush administration was preoccupied by the possibility of terrorists armed with weapons of mass destruction (WMD), so much so that the United States went to war in Iraq. In fact, in the post-9/11 era, terrorists only experimented with crude WMD of low lethality. However, now that we are in the age of AI and synthetic biology, terrorists—who are often well educated—will likely be able to create pathogens in a manner that was not available to militants of an earlier era. This feels like a dystopian reality rather than politicized hype, because it is AI industry leaders, not politicians, who are sounding the alarm about the issue.
The United States went to war against Saddam Hussein’s regime in Iraq in March 2003 based on the false assertions of dodgy defectors and the faulty assumptions of U.S. policymakers that the Iraqi dictator had weapons of mass destruction that he might give to his allies in al-Qa`ida. None of this was true, but the subsequent invasion of Iraq and Iraqi civil war claimed the lives of some 200,000 Iraqi civilians1 and those of 4,418 American service members,2 and in the process greatly damaged global perceptions of American power and undermined faith in the U.S. government at home.
This article will not rehash any of this well-documented history but instead will attempt to explain why senior Bush administration officials became preoccupied with the idea of terrorists deploying weapons of mass destruction (WMD) following the 9/11 attacks. The article will then examine the history of how terrorists experimented with WMD, producing only relatively crude weapons in the two decades that followed the 2003 invasion of Iraq despite much of the hyperbole surrounding the issue. It will then try to answer two pressing questions: Do advances in the fields of genetic editing and artificial intelligence change the game, so that what was once a fanciful notion—that terrorists might kill very large numbers of people with WMD—could become a bleak future reality? Does the history of hype about terrorists deploying WMD hold lessons that might be applicable today?
The 9/11 attacks came as a complete surprise to senior Bush administration officials, even though they had received a stream of highly classified warnings from the CIA during the spring and summer of 2001 that al-Qa`ida was planning a large-scale attack, including possibly in the United States.3 At the time, key Bush officials were so preoccupied by the purported threats posed by states such as Iraq that they discounted the notion that a non-state actor such as al-Qa`ida was a real threat. Underlining their preoccupation with state sponsors of terrorism, immediately after 9/11 senior Bush officials such as Secretary of Defense Donald Rumsfeld pushed for attacks against countries such as Iraq, which had concealed its active weapons of mass destruction WMD program during the 1980s.4
After 9/11, the thinking of President Bush and his war cabinet was greatly influenced by the anthrax attacks in the United States that took just place just weeks after al-Qa`ida had attacked the World Trade Center and the Pentagon. During October 2001, letters containing anthrax were sent to American journalists and members of Congress, killing five people and shaping President Bush’s understanding of the post-9/11 threat landscape, as they seemed to show that terrorists were now deploying WMD in the United States. The letters themselves contained the phrases “Death to America,” “Death to Israel,” and “Allah is great.”5 In fact, the FBI would eventually determine that Bruce E. Ivins, a biological weapons researcher working for the U.S. government who had access to highly secure biolabs, was solely responsible for the attacks.6
At the Bush White House, worries about terrorist access to WMD intensified when the CIA discovered that before 9/11, Usama bin Ladin had met in Afghanistan with Dr. Sultan Bashiruddin Mahmood, a Pakistani nuclear scientist who had been fired from his country’s nuclear program in 1999 because of his militant jihadi views. Bin Ladin had claimed to Mahmood that he possessed fissile materials suitable for a nuclear weapon, while Mahmood had shown bin Ladin a sketch about how to build a nuclear bomb.7 Sketching a nuclear bomb design is a very long way from actually building one, and bin Ladin’s boast about fissile materials was almost certainly false; instead, al-Qa`ida had very likely purchased quantities of radioactive waste. Still, Mahmood’s meeting with bin Ladin indicated that al-Qa`ida’s leaders were interested in learning about the most lethal forms of WMD and had connections to scientists who appeared to share their worldview.
After 9/11, al-Qa`ida’s leaders stepped up their public rhetoric about their purported access to WMD. On November 8, 2001, bin Ladin told Pakistani journalist Hamid Mir, “I wish to declare that if America used chemical or nuclear weapons against us, then we may reply with chemical and nuclear weapons. We have the weapons as deterrent.” This statement was followed in May 2003 by a fatwa from a militant Saudi cleric, Nasir bin Hamd al-Fahd, that gave religious sanction to those who wanted to use WMD on large numbers of American civilians.8
Vice President Dick Cheney became so concerned about the possibility of some kind of chemical or biological weapons terrorist attack that after 9/11, he kept a full biohazard suit on hand when he traveled.9 Yet, if Bush administration officials had had more familiarity with the history of non-state actors using WMD, perhaps they would have been more skeptical that al-Qa`ida could pull off a large-scale attack with weapons of mass destruction.
The case of Aum Shinrikyo is instructive. A Japanese cult with tens of thousands of followers who subscribed to obscure, apocalyptic beliefs, Aum actively recruited from among the best and brightest in Japan and had access to hundreds of millions of dollars donated by its followers.10 Despite recruiting scientists and possessing large-scale resources, when they manufactured sarin gas, a highly toxic nerve agent, they were able to kill only the relatively small number of 13 people in the crowded, enclosed environment of the Tokyo subway on March 20, 1995.
The Aum attack underlined that even terrorists with real scientific knowledge and considerable financial resources did not successfully build true weapons of mass destruction, although they could deploy weapons of mass disruption that could sow panic with relatively small-bore chemical or biological weapons attacks.
In one of the grimmer ironies of the war on terror, the Iraq War helped to create an alliance between some of Saddam’s Ba’athist officials and members of al-Qa`ida, which resulted in the creation of al-Qa`ida in Iraq (AQI) that deployed crude WMD weapons. In other words, the Iraq War produced the al-Qa`ida–Ba’athist–WMD nexus it was supposed to prevent.
From late 2006 through mid-2007, AQI detonated a series of crude chemical bombs in Iraq that were designed to spread what they hoped would be lethal quantities of chlorine, widely available in the Middle East for treating water. The U.S. military killed or captured many of the insurgents who were deploying these bombs. Charles Faddis, who headed the CIA’s operations against AQI’s chlorine bomb network, explained, “There was a lot of effort to secure the chlorine, to get a hold of the tanks, to track these guys down (who were responsible for building the chlorine bombs) to kill them or capture them. Meanwhile the attacks are not being particularly successful. The people are dying in the blast, but fortunately nobody is dying from chlorine.”11
Over time, AQI would morph into the Islamic State, which in 2014 seized much of Syria and Iraq. The Islamic State also experimented with WMD weapons, but again these were relatively crude chlorine-based devices. The group used these bombs dozens of times against the Iraqi military and Syrian Kurdish forces.12
The Islamic State mounted a more ambitious chemical weapons effort between 2015 and 2017, producing mustard gas and adding the agent to bombs and rockets. Yet, they only produced mustard gas at relatively low concentrations, unlike the mustard gas that was used by the armies that fought during World War I.13
Overall, the Islamic State’s chemical weapons efforts were not much more sophisticated than AQI’s, although the Islamic State, a terrorist army of some 30,000 fighters, at one point controlled a population greater than that of New York City that it was able to tax and extort from at will.14 At its height, the group’s claims to be the “Islamic State” had some basis in truth, and yet even with its substantial resources and its large-scale recruitment of militants, including 40,000 jihadis from around the Muslim world, the Islamic State still could not create an effective WMD program.
During the post-9/11 period, several would-be terrorists hoped to create effective chemical weapons by manufacturing ricin. Ricin, which can be extracted from widely available castor beans, can kill, but only if it is deployed by those with real chemical weapons expertise, as it does not aerosolize well and must typically be injected directly for lethal effects. The most infamous case of ricin poisoning was that of the Bulgarian defector Georgi Markov, who was stabbed by a ricin-tipped umbrella in London in 1978 as he was waiting for a bus near Waterloo Bridge. Markov subsequently died, a death that was almost certainly the work of the KGB or an allied Eastern Bloc intelligence service.15
But in the hands of terrorists, ricin weapons were almost invariably duds. In 2003, an al-Qa`ida-linked militant based in the United Kingdom, Kamel Bourgass, attempted to produce ricin. So too did a Tunisian man living in Cologne in 2018, who was identified by German authorities as Sief Alla H., an Islamic State supporter.16 In 2025, Indian authorities in Gujarat arrested a doctor linked to Islamic State Khorasan, the group’s affiliate headquartered in Afghanistan, who was carrying castor bean mash suitable for making ricin.17 In none of these cases did the militants deploy a ricin weapon.
All this history suggests that terrorists could not deploy true weapons of mass destruction because the barriers to entry were so high. But will those barriers be lowered now that we are in the age of AI and synthetic biology?
Militant groups often recruit educated young men, a demographic that is likely to understand aspects of these emerging technologies. In 2006, New America researcher Swati Pandey and I examined the educational background of 79 jihadi terrorists responsible for five major anti-Western terrorist attacks—the World Trade Center bombing in 1993, the bombings of two U.S. embassies in Africa in 1998, the September 11 attacks, the Bali nightclub bombings in 2002, and the London bombings on July 7, 2005. All those who had masterminded the attacks had university degrees. More than half the terrorists involved in them had attended university. Of those who attended a university, more than half had scientific or technical degrees, with engineering being the most popular subject studied.18
A dozen years after our study was published, sociologist Diego Gambetta and political scientist Steffen Hertog co-authored Engineers of Jihad: The Curious Connection between Violent Extremism and Education, which examined the educational background of 33519 terrorists across the ideological spectrum, from jihadis to right-wing extremists to leftist terrorists. Gambetta and Hertog found that engineering was by far the most popular subject studied by the militants who had attended university, underlining that terrorists are often well educated with a scientific bent.20
Which brings us to recent developments in the field of AI: In August 2026, Stanford University scientists announced that they had developed an AI program that had designed and made 16 new viruses. These viruses were not pathogens, but the study showed that entirely de novo viruses could now be made by AI. While there are plenty of reasons to celebrate that discovery—the viruses made by the Stanford scientists could be used to kill bacteria that cause disease—it also raises significant questions around biosecurity since de novo viruses are now an alternative path to making biological agents.21
Similarly, when it comes to chemical weapons, in 2022 North Carolina-based Collaborations Pharmaceuticals was contracted by the Swiss Federal Institute for Nuclear, Biologic and Chemical Protection to investigate whether AI systems involved in drug discoveries could generate thousands of novel chemical agents. Using the MegaSyn AI model, which was used to generate safe drugs, a scientist rewarded the model for finding toxic chemicals instead of safe drugs. Within hours, the model generated thousands of highly toxic potential new compounds.22 That said, it is important to emphasize the word “potential.” As Audrey Kurth Cronin pointed out in these pages four years ago, “generating a list of chemicals did not mean the results could be synthesized or would prove stable and effective. Pharmaceutical companies use the same method to create drugs; yet out of millions of compounds, they find few viable enough to enter into production.”23
While much of the focus on the promise and perils of AI is on large language models (LLMs) such as Claude and ChatGPT that can provide detailed answers to a wide range of questions, additional AI tools known as biological design tools (BDTs) can be used to design novel organisms far quicker than any laboratory can.24 Some BDTs are open source, such as AlphaFold, while others require expensive hardware such as Graphics Processing Units (GPUs) that can cost tens of thousands of dollars.
Could terrorist groups exploit these tools in coming years? As scholars Daniel Byman and V.S. Subrahmanian noted in July 2026, terrorists “are not technological pioneers in the conventional sense, but they are often capable adopters.”25 A similar skeptical note had been struck two months earlier in these pages by Andrew Glazzard, David McIlhatton, and Paul Martin, who pointed out that terrorists typically favor technologies that are both accessible and reliable.26
Indeed, the history of terrorism is rife with example of terrorists sticking with tried-and-true methods to murder large numbers of civilians, such as mass shootings, because they are relatively easy to do, especially in the United States where semi-automatic weapons are readily accessible. The most lethal terrorist attack in the United States since 9/11 was carried out by Omar Mateen, an American citizen inspired by the Islamic State, who killed 49 patrons at the Pulse nightclub in Orlando in 2016 using semi-automatic weapons. Mateen managed to kill around 10 times more people in his attack than Ivins had with his anthrax attacks, even though Ivins was one of the leading biological weapons researchers in the United States, while Mateen had no training from a terrorist group.
Vehicle ramming requires little skill and preparation. We have seen several of those in the United States since 9/11: an Islamic State-inspired terrorist killed eight in Manhattan using his vehicle as a weapon in 2017,27 for instance, the same year a right-wing extremist rammed a protestor in Charlottesville, Virginia, killing her.28 Early on New Year’s Day 2025, an Islamic State supporter killed 14 people with a truck in New Orleans.29
By contrast, the science around creating de novo viruses is presently highly complex and requires special labs. That said, it is worth noting that, like the much of rest of the world, terrorists are increasingly using AI in their work. In a study of the Nigerian Boko Haram militant group published in July 2026, Antonia Juelich of Cambridge University interviewed 27 former members of the group and found that they had used AI to plan attacks and design explosives. Islamic State members had also provided in-person AI training to the Boko Haram militants. None of this involved WMD research or planning, but it demonstrates that terrorists have moved beyond using AI to create propaganda and have now used these tools for operational planning.30
There is an as-yet unsettled debate about the origins of the COVID-19 virus: Was it inadvertently leaked from a biolab in Wuhan, China, or did the virus cross over into humans from a nearby “wet market” selling exotic animals? This article does not take a position on that important debate, but if the Wuhan lab leak theory is in fact correct, it underlines the very real dangers of “gain of function” research that uses genetic editing to tinker with the traits of viruses, experimentation that was going on at the Wuhan biolab in question.31 This points to how such gain of function research could be used for nefarious purposes; the massive global death toll and the calamitous economic and social consequences of the COVID-19 pandemic speak for themselves.
Among AI thought leaders, the possibility that AI tools could be used for gain of function research with nefarious intent is now a very real concern. Efforts to preclude that kind of research are built into closed American AI models such as ChatGPT, which are programmed with ethically based considerations that will, at least in theory, not allow the models to perform substantive research on how to manufacture WMDs.32 In July 2025, OpenAI announced that it was introducing a new framework that explicitly guarded against any queries that were aimed at “bioweaponization.”33 The effectiveness of these guardrails is open to debate since there are ways to circumvent them if inquiries are posed in a deceptive manner, known as jailbreaks.
In July 2026, this journal published research from the non-profit Tech Against Terrorism that queried 27 AI models about WMDs and found that 15 came up with information that exceeded what was publicly available, while a third gave “real assistance” to either make or plan a WMD mass casualty attack, a sobering finding.34
So where does that leave us? Senior Bush administration officials, caught completely by surprise by the 9/11 attacks, went into overdrive in the other direction and adopted a sky-is-falling approach to WMD that embroiled the United States in a disastrous war of choice in Iraq. During the quarter century since 9/11, terrorists have created and used chemical weapons, but with a scant record of success in terms of their lethality, despite all the hype around the topic of terrorists armed with WMD.
We now stand on the brink of a new era, and the capabilities of AI and synthetic biology do present terrorist groups or individuals with idiosyncratic motives new tools to potentially create mass mayhem and murder. This feels like a dystopian reality rather than politicized hype, because it is AI industry leaders, not politicians, who are sounding the alarm about the issue. Demis Cambiss, who founded Google’s DeepMind and won the Nobel Prize for Chemistry in 2024, as well as Sam Altman, CEO of OpenAI, warned publicly in June 2026 that some AI systems “now outperform PhD-level virologists on questions about highly technical laboratory procedures.”35
Thomas Schelling succinctly observed in his preface to Roberta Wohlstetter’s 1962 book, Pearl Harbor: Warning and Decision: “There is a tendency in our planning to confuse the unfamiliar with the improbable.”36 The United States discovered that to its cost on 9/11. Policymakers around the world must ensure that the fruits of the dual revolutions in AI and gene editing do not end up in the wrong hands, creating a weapon that might rival, or even eclipse, 9/11 in its impact on the world. CTC
Peter Bergen is a vice president at New America, a professor of practice at Arizona State University, a CNN national security analyst, and the author of All the Presidents’ Wars: Twenty-Five Years of America’s War on Terror (New York: W. W. Norton & Company, 2026).
© 2026 Peter Bergen
Citations
[1] “Human Cost of Post-9/11 Wars: Direct War Deaths in Major War Zones,” Watson School of International and Public Affairs, Brown University, September 1, 2021.
[2] “U.S. Military Casualties – Operation Iraqi Freedom (OIF) Casualty Summary by Casualty Category (As of August 31, 2026),” Defense Casualty Analysis System, accessed September 1, 2026.
[3] “The 9/11 Commission Report,” 2004.
[4] “IRAQ: Weapons of Mass Destruction,” Council on Foreign Relations, February 3, 2005.
[5] “A mystery unravelled,” Economist, Agust 7, 2008; Sarah Pruitt, “When Anthrax-Laced Letters Terrorized the Nation,” History.com, October 4, 2018.
[6] “Amerithrax or Anthrax Investigation,” FBI.Gov, n.d., accessed August 18, 2026.
[7] Peter Bergen, All the Presidents’ Wars: Twenty-Five Years of America’s War on Terror (New York: W.W. Norton & Company, 2026), pp. 58-59.
[8] Seyed Hossein Mousavian, “Globalising Iran’s Fatwa Against Nuclear Weapons,” Survival 55:2 (2013): pp. 147-162.
[9] Mark Mooney, “Cheney Thought He Had Lethal Anthrax Dose,” ABC News, July 14, 2008.
[10] “Aum Shinrikyo: The Japanese Cult behind the Tokyo Sarin Attack,” BBC, July 6, 2018; “Global Proliferation of Weapons of Mass Destruction: A Case Study on the Aum Shinrikyo,” Senate Government Affairs Permanent Subcommittee on Investigations, Staff Statement, October 31, 1995.
[11] Author interview, Charles Faddis, January 2010; Peter Bergen, “Al Qaeda’s Track Record with Chemical Weapons,” CNN, May 7, 2013.
[12] Columb Strack, “The Evolution of the Islamic State’s Chemical Weapons Efforts,” CTC Sentinel 10:9 (2017).
[13] Ibid.
[14] Rukmini Callimachi, “The ISIS Files,” New York Times, April 4, 2018.
[15] Megan Friedman, “Georgi Markov and the Umbrella Gun,” Time, February 17, 2010.
[16] Florian Flade, “The June 2018 Cologne Ricin Plot: A New Threshold in Jihadi Bio Terror,” CTC Sentinel 11:7 (2018).
[17] Animesh Roul, “Ricin Threat and the Jihadist Conspiracy against India,” MP-IDSA Commentary, November 13, 2025.
[18] Peter Bergen and Swati Pandey, “The Madrassa Scapegoat,” Washington Quarterly 29:2 (2006): pp. 115-125.
[19] Diego Gambetta and Steffen Hertog, Engineers of Jihad: The Curious Connection between Violent Extremism and Education (Princeton: Princeton University Press, 2018), p. 8.
[20] Ibid.
[21] Clive Cookson, “AI Creates First Synthetic Viruses,” Financial Times, August 6, 2026.
[22] Fabio Urbina, Filippa Lentzos, Cédric Invernizzi, and Sean Ekins, “AI in Drug Discovery: A Wake-up Call,” Drug Discovery Today 28:1 (2023).
[23] Audrey Kurth Croin, “Biology’s Tectonic Shifts and Novel Risks,” CTC Sentinel 15:5 (2022).
[24] “Department of Homeland Security Report on Reducing the Risks at the Intersection of Artificial Intelligence and Chemical, Biological, Radiological, and Nuclear Threats,” U.S. Department of Homeland Security, April 26, 2024.
[25] Daniel Byman and V. S. Subrahmanian, “Artificial Intelligence and the Future of Terrorism,” Audio Briefs, CSIS, July 10, 2026.
[26] Andrew Glazzard, David McIlhatton, and Paul Martin, “Will Generative AI Fundamentally Change Terrorist Threats?” CTC Sentinel 19:5 (2026).
[27] Benjamin Mueller, William K. Rashbaum, and Al Baker, “Terror Attack Kills 8 and Injures 11 in Manhattan,” New York Times, October 31, 2017.
[28] “Ohio Man Pleads Guilty to 29 Federal Hate Crimes for August 2017 Car Attack at Rally in Charlottesville,” U.S. Department of Justice, March 27, 2019.
[29] “New Orleans Attack: Driver Acted Alone in ISIS-Inspired Rampage That Killed 14, Authorities Say,” NBC News, January 2, 2025.
[30] Dustin Volz and Eric Schmitt, “How Terrorist Groups Are Using A.I. to Gain an Edge in Battle,” New York Times, July 15, 2026.
[31] Jocelyn Kaiser, “NIH Says Grantee Failed to Report Experiment in Wuhan That Created a Bat Virus That Made Mice Sicker,” Science, October 21, 2021.
[32] Kevin Collier and Jasmine Cui, “ChatGPT Safety Systems Can Be Bypassed to Get Weapons Instructions,” NBC News, October 10, 2025.
[33] Adam Hadley, “Feature Commentary: Guardrails Under Test: Terrorist Misuse of AI Models and the Open-Weight ‘Abliteration’ Problem,” CTC Sentinel 19:7 (2026).
[34] “Preparing for future AI capabilities in biology,” OpenAI, June 18, 2025.
[35] “AI Executives Make Rare Collective Warning on Bioweapons Threat,” Semafor, June 4, 2026; “In Support of Mandatory Nucleic Acid Synthesis Screening and Recordkeeping,” dj.com, June 2026.
[36] Thomas C. Schelling in Roberta Wohlstetter, Pearl Harbor: Warning and Decision (Redwood City, CA: Stanford University Press, 1962), p. vii.
