When AI Agents Recruit The Future of Extremist Radicalisation Online
The contemporary debate on generative artificial intelligence (AI) and terrorism has focused largely on the production of extremist content: easier access, greater volume and greater personalisation. This article reviews these three areas, demonstrating how AI-enabled translation, media generation and chatbot interaction may reduce long-standing frictions in extremist outreach. It argues that the next major challenge may arise from the growing availability of agentic AI systems. Unlike standalone chatbots, agentic systems can plan, use digital tools, decompose tasks, retain context and coordinate sub-agents across multi-stage objectives. While concerns regarding offensive cyber misuse are well recognised, this article argues that the more insidious threat may lie in the emergence of “agentic proselytisers”: systems capable of identifying individuals vulnerable to radicalisation, establishing contact through synthetic personas and sustaining personalised engagement at scale. This article concludes by proposing policy responses for AI providers, online platforms and security agencies aimed at delaying or disrupting this emerging threat.
Introduction
There has been considerable discussion regarding the adoption of artificial intelligence (AI) by terrorists and extremists. Much of this debate focuses on the use of large language models (LLMs) and generative AI (GenAI) to strengthen extremist outreach and online radicalisation efforts. Particular attention has been paid to how these technologies may improve access to propaganda materials, increase the volume of digital propaganda and enhance the personalisation of the radicalisation experience.[1]
However, recent developments in AI have created new potential threats. With the recent democratisation of agentic AI, the deployment of agentic extremist proselytisers by lone actors is no longer merely a theoretical possibility. Against this backdrop, this article provides an overview of how scholars have discussed extremists’ use of AI thus far, highlights the risks posed by agentic AI and proposes policy responses aimed at delaying the emergence of agentic extremist proselytisers. It is also important to emphasise that this article does not provide a technical blueprint for developing such systems.
Extremist Adoption of AI
Since the launch of ChatGPT in 2022, considerable research has been published on the adoption of GenAI by violent extremist groups across the ideological spectrum. Three salient themes have emerged from this literature regarding the use of GenAI for extremist purposes.
Improving Access to Extremism Through Translation
One of the core problems that GenAI addresses for violent extremists is the translation bottleneck. Translating propaganda without AI is time-consuming. Aman Abdurrahman, the leader and founder of the pro-Islamic State (IS) Indonesian terrorist group Jamaah Ansharut Daulah (JAD), built his reputation as a terrorist ideologue by translating Salafi-jihadi works produced by Al-Qaeda (AQ) and IS from Arabic to Indonesian while in prison in the early 2010s.[2] His translations inspired many Indonesian radicals to pledge allegiance to IS and join JAD in the 2010s.[3]
In May 2025, a self-radicalised Malaysian, Radin Luqman, who attacked a police station in Johor Bahru, the capital of the Malaysian state of Johor, drew inspiration from Aman’s translated works.[4] Luqman’s case highlights the permanence of translated digital content and Aman’s role in improving access to Arabic Salafi-jihadi content across Southeast Asia, not by creating new content, but by translating existing materials.
Transnational terrorist groups like AQ and IS will continue to face language barriers in communicating with non-Arabic-speaking members and sympathisers through their central propaganda apparatus. However, there are indications that these groups have begun experimenting with AI to improve their reach among non-Arabic-speaking audiences. Tech Against Terrorism reported that al-Furqan Foundation, a pro-IS media outlet, appeared to have used AI tools to transcribe and translate the announcement of the death of its previous leader, Abu Husein al-Husseini al-Qurashi, and the appointment of Abu Hafs al-Hashimi al-Qurashi as his successor on August 7, 2023.[5] The availability of GenAI allows terrorist groups to bypass translators like Aman Abdurrahman and communicate more directly with their intended audiences.
Increasing Volume of Extremist Content
Beyond text manipulation and generation, GenAI can also be used to produce images and videos for extremist proselytisation. One of the primary strengths of ISs media agencies was their professionally produced media output. Various IS propaganda products, including Dabiq magazine,[6] the biweekly Harvest of the Soldiers newsletter[7] and videos produced by Al-Amaq News Agency,[8] attracted many individuals to pledge allegiance to IS. Similarly, far-right extremists (FREs) have long used digital media as an entry point into extremism. While FREs are generally not as organised as Salafi-jihadi groups, their members have developed memes and online symbols to normalise extreme sentiments and ideas.[9] Interestingly, these symbols often transcend ethnic cultures, with white-supremacist imagery being adopted by other ethno-supremacist movements to normalise exclusionary worldviews.[10]
In response to these evolving threats, the Global Internet Forum for Counter Terrorism (GIFCT) developed mechanisms to counter the proliferation of extremist media content through hash-sharing databases.[11] GIFCT’s hash-sharing system encodes known extremist media into a hash database and uses hash-matching mechanisms to ensure that extremist content shared in one platform can be taken down quickly in another. However, GenAI’s media generation capabilities may enable extremist proselytisers to circumvent hash-matching systems by making small variations to existing digital content.[12] In effect, this could overwhelm hash databases with a proliferation of near-identical content, similar to a pseudo-distributed denial-of-service (DDoS) attack.
Beyond making micro adjustments to bypass hash-matching systems, a more rudimentary application of GenAI is the mass production of extremist content. IS has used deepfake news anchors to present its media broadcasts in multiple languages.[13] In the same vein, GenAI has also been used by FREs to create hate memes targeting racial minorities and the LGBTQ+ community, as well as neo-Nazi imagery.[14] This highlights how off-the-shelf GenAI tools can facilitate the creation of propaganda materials and increase the volume of extremist content circulating online.
Enhancing Personalisation
One of the key elements of the radicalisation process prior to GenAI was the role of the charismatic human recruiter. Consider the example of Malaysian IS member Muhammad Wanndy Mohamed Jedi, who migrated to Syria to become a foreign fighter. Wanndy emerged as one of IS’s most influential recruiters in Southeast Asia between 2015 and 2016, and became known as the so-called “Jihadi Celebrity”.[15] He engaged sympathisers primarily through Facebook and Telegram by presenting himself as a source of religious authority.[16] Wanndy also managed the Kumpulan Gagak Hitam (Black Crow Group) Telegram group. Unlike official IS media channels, he adopted a more informal and personalised approach to building trust with followers.[17] His influence reportedly contributed to the radicalisation of individuals involved in the June 2016 attack on the Movida Bar in Selangor, Malaysia.[18]
The process of radicalisation, as seen in the case of Wanndy, was highly personalised. He cultivated an online community in Malaysia through his personal appeal and perceived religious authority. This personalised approach to radicalisation was not unique to Wanndy. On the other side of the ideological spectrum, there are examples of FRE neo-Nazi ideologues, such as Tom Metzger, who recruited young men by actively cultivating personal relationships in the mid-1970s.[19] Nevertheless, such personalised approaches to radicalisation are labour-intensive and difficult to replicate at scale.
GenAI reduces the labour intensity of personalised recruitment through the use of automated chatbots. Today’s youths are increasingly AI-native and are turning towards AI chatbots not only for information but also for companionship.[20] However, off-the-shelf GenAI models tend to exhibit sycophantic tendenciesthe propensity to agree with or reinforce users’ existing views.[21] Consequently, unchecked interactions with GenAI may create a pseudo-echo chamber that reinforces users’ existing beliefs.
While there is currently no evidence of the organised use of chatbots for radicalisation, there are increasing indications that repeated and unchecked interactions with chatbots may contribute to stochastic radicalisation. One of the most prominent cases is that of Jaswant Singh Chail in the United Kingdom (UK). Chail developed a romantic attachment to a chatbot, which subsequently reinforced his desire to avenge the 1919 Jallianwala Bagh massacre by assassinating Queen Elizabeth II.[22] In 2024, Singapore also detained two teenagers who had pledged allegiance to IS following extensive interactions with chatbots.[23] In both cases, the chatbots were not the primary source of radicalisation. Rather, AI sycophancy appeared to reinforce and amplify pre-existing extremist beliefs.
From Generative to Agentic AI
Undoubtedly, GenAI has the potential to improve access, increase the volume and enhance the personalisation of extremist propaganda. Yet, as governments, agencies and corporations struggle to keep pace with developments in GenAI, the industry has already shifted its attention towards agentic AI. Agentic AI has been described as a “paradigm shift” in AI, enabling digital systems to operate with greater autonomy in pursuit of broad objectives.[24] While both generative and agentic AI are powered by LLMs, there are fundamental differences between them. GenAI is designed primarily to generate content, including text, images, audio and video. Agentic AI, by contrast, is designed to understand a user’s intent, formulate a plan and execute tasks through interactions with digital tools.
Authorities should be concerned about the deployment of agentic AI by malicious actors, including violent extremist groups. One of the most obvious applications of agentic AI is the development of terrorist cyber capabilities. Since their inception, Salafi-jihadi groups have attempted to develop competent offensive cyber teams, albeit with limited success. For instance, IS established the United Cyber Caliphate (UCC), which was active between 2016 and 2017.[25] However, the group’s activities were largely limited to website defacement and data exfiltration. In 2017, it was reported that “there have been no known terrorist attacks using cyber means to trigger physical damage and destruction”, and that assessment largely remains valid today.[26] One reason is that offensive cyber operations have traditionally faced a high barrier to entry due to the technical expertise required.
However, recent developments in agentic AI have sharpened the ability to identify new zero-day vulnerabilities semi-autonomously, potentially unlocking offensive cyber capabilities for malicious non-state actors, like terrorist organisations.[27] Some commentators have argued that, with carefully crafted prompts, commercially available AI systems already exhibit elements of this capability, even prior to the debut of Claude Mythos.[28] Intuitively, agentic AI may provide additional tools to so-called “script kiddies”—individuals with limited technical expertise who rely on readily available hacking tools—to exploit system vulnerabilities more effectively.[29]
The Insidious Threat
Modern agentic AI’s capability to identify zero-day vulnerabilities semi-autonomously has attracted significant attention from the security community because it represents one of the most obvious AI-enabled cyber threats. At the same time, cybersecurity practitioners have recognised this risk and are increasingly deploying AI-assisted defensive tools to identify and patch vulnerabilities, potentially limiting the effectiveness of such “script kiddies”.[30] However, a more insidious threat lies in the development of autonomous extremist proselytisers.
While agentic AI may not fundamentally alter the process of radicalisation and recruitment, it could enable extremist recruiters to scale their outreach, expand their pool of sympathisers and more effectively identify individuals who may be vulnerable to radicalisation. Modern agentic AI systems are already capable of decomposing complex tasks, delegating them to task-specific sub-agents and coordinating these sub-agents in pursuit of a user-defined objective. In principle, an extremist proselytiser could deploy AI agents to identify vulnerable populations, draw individuals into private online communities and personalise the radicalisation process.[31]
As agentic proselytisers become technologically feasible, extremist recruiters may increasingly outsource content generation to GenAI, while using agentic AI systems to manage and coordinate propaganda campaigns. This would allow recruiters to shift their focus from routine execution to higher-level strategic planning. The resulting threat could be highly scalable, personalised and more difficult for authorities to detect and disrupt.
Conclusion and Policy Recommendations
The ultimate threat addressed in this article is the potential weaponisation of an agentic proselytiser: an autonomous system capable of identifying vulnerable populations, building trust and facilitating radicalisation. For such a system to become technically feasible, AI must not only be persuasive—which existing GenAI systems already demonstrate—but also be capable of establishing credible first contact with potential recruits. This, in turn, requires access to human users through social media and online platforms. If AI agents become capable of autonomously creating and operating sock puppet accounts,[32] they could use synthetic personas to identify, engage and persuade vulnerable individuals before directing them to private extremist communities at scale.
To prevent or delay the emergence of the agentic extremist proselytiser, policymakers and technology corporations should prohibit AI agents from establishing first contact with humans. This would require measures that prevent autonomous human outreach by AI agents, whether for malicious or benign purposes. From a policy perspective, legislation should prohibit the use of AI agents for unsolicited outreach. Policies should also prohibit AI agents from creating and operating synthetic personas on the open web. Beyond content moderation, social media platforms should invest in systems that validate and link online personas to a human actor. This can be achieved by strengthening account creation systems to improve the detection of sock puppet accounts and coordinated agentic behaviour. Finally, AI developers have a responsibility to implement safeguards that prevent agents from creating social media accounts, sending unsolicited messages or impersonating humans.
About the Author
Kenneth Yeo Yaoren is an Associate Research Fellow at the Institute for Political Violence and Terrorism Research (ICPVTR), a constituent unit of the S. Rajaratnam School of International Studies (RSIS), Nanyang Technological University (NTU), Singapore. He is concurrently pursuing his PhD at RSIS and can be reached at [email protected].
Thumbnail photo by Shubham-Dhage on Unsplash
Citations
[1] Steven Chia, host, Deep Dive Podcast, season 6, “Stopping Youth Radicalisation in the Age of AI,” Channel News Asia, August 20, 2025, 24 min., 37 sec., https://www.channelnewsasia.com/watch/deep-dive-podcast/stopping-youth-radicalisation-in-age-ai-5304411.
[2] Vidia Arianti, “Aman Abdurrahman: Ideologue and ‘Commander’ of IS Supporters in Indonesia,” Jurnal Ilmu Kepolisian 89 (2017): 39.
[3] Ibid.
[4] Munira Mustaffa, “The May 2024 Ulu Tiram Attack: Islamic State Extremism, Family Radicalisation, Doomsday Beliefs, and Off-the-Grid Survivalism in Malaysia,” CTC Sentinel 18, no. 2 (2025): 14–20, https://ctc.westpoint.edu/the-may-2024-ulu-tiram-attack-islamic-state-extremism-family-radicalization-doomsday-beliefs-and-off-the-grid-survivalism-in-malaysia/.
[5] Early Terrorist Experimentation with Generative Artificial Intelligence Services (Tech Against Terrorism, 2023), 6, https://techagainstterrorism.org/hubfs/Tech%20Against%20Terrorism%20Briefing%20-%20Early%20terrorist%20experimentation%20with%20generative%20artificial%20intelligence%20services.pdf.
[6] Haroro J. Ingram, “Learning from ISIS’s Virtual Propaganda War for Western Muslims: A Comparison of Inspire and Dabiq,” in Vol. 136: Terrorists’ Use of the Internet, eds. Maura Conway et al. (IOS Press, 2017), 170–8, https://doi.org/10.3233/978-1-61499-765-8-170.
[7] Tamara Abu-Hamdeh, “Harvest of the Soldiers,” in Jihadism Revisited: Rethinking a Well-Known Phenomenon, ed. Rüdiger Lohlker (Logos Verlag, 2019), http://ebookcentral.proquest.com/lib/ntusg/detail.action?docID=6032817.
[8] Daniel Milton, Pulling Back the Curtain: An Inside Look at the Islamic State’s Media Organization (Combating Terrorism Center at West Point, 2018), https://ctc.westpoint.edu/wp-content/uploads/2018/08/Pulling-Back-the-Curtain.pdf.
[9] Ursula Kristin Schmid et al., “Memes, Humor, and the Far Right’s Strategic Mainstreaming,” Information, Communication & Society 28, no. 4 (2025): 537–56, https://doi.org/10.1080/1369118X.2024.2329610.
[10] Saddiq Basha, “The Creeping Influence of the Extreme Right’s Meme Subculture in Southeast Asia’s TikTok Community,” Global Network on Extremism and Technology (GNET), April 8, 2024, https://gnet-research.org/2024/04/08/the-creeping-influence-of-the-extreme-rights-meme-subculture-in-southeast-asias-tiktok-community/.
[11] “GIFCT’s Hash-Sharing Database,” Global Internet Forum to Counter Terrorism (GIFCT), accessed May 20, 2026, https://gifct.org/hsdb/.
[12] Tech Against Terrorism, Early Terrorist Experimentation, 3.
[13] Katarzyna Maniszewska, “AI and Security Challenges: Towards Ethical Governance of Artificial Intelligence for Countering Terrorism and Radicalization,” Global Extremism Papers, no. 1 (2026): 45–7, https://extremism.gwu.edu/sites/g/files/zaxdzs5746/files/2026-03/Global%20Extremism%20Papers%20%E2%80%93%20Inaugural%20Issue%20(2026).pdf.
[14] Louis Dean, “AI or Aryan Ideals? A Thematic Content Analysis of White Supremacist Engagement with Generative AI,” Global Network on Extremism and Technology (GNET), January 13, 2025, https://gnet-research.org/2025/01/13/ai-or-aryan-ideals-a-thematic-content-analysis-of-white-supremacist-engagement-with-generative-ai/.
[15] Muhammad Haziq Bin Jani, “Malaysia’s ‘Jihadist-Celebrity’: Muhammad Wanndy Mohamed Jedi,” Counter Terrorist Trends and Analyses 8, no. 11 (2016): 30.
[16] Murni Wan Mohd Nor and Ahmad El-Muhammady, “Radicalisation and Paramilitary Culture: The Case of Wanndy’s Telegram Groups in Malaysia,” in Militarization and the Global Rise of Paramilitary Culture: Post-Heroic Reimaginings of the Warrior, eds. Brad West and Thomas Crosbie (Springer, 2021), 95–122, https://doi.org/10.1007/978-981-16-5588-3.
[17] Ibid., 107–9, https://doi.org/10.1007/978-981-16-5588-3.
[18] Nur Azlin Mohamed Yasin, “After Muhammad Wanndy: What Next?” RSIS Commentary, no. 89, May 9, 2017, https://www.rsis.edu.sg/wp-content/uploads/2017/05/CO17089.pdf.
[19] William Jukes-Bennett, “White Aryan Resistance (WAR),” Modern Insurgent, December 31, 2025, https://www.moderninsurgent.org/post/white-aryan-resistance-war.
[20] “New Report Reveals How Risky and Unchecked AI Chatbots Are the New ‘Go To’ for Millions of Children,” Internet Matters, July 14, 2025, https://www.internetmatters.org/hub/press-release/new-report-reveals-how-risky-and-unchecked-ai-chatbots-are-the-new-go-to-for-millions-of-children/.
[21] “Expanding on What We Missed with Sycophancy,” OpenAI, May 2, 2025, https://openai.com/index/expanding-on-sycophancy/; “How People Use Claude for Support, Advice, and Companionship,” Anthropic, June 27, 2025, https://www.anthropic.com/news/how-people-use-claude-for-support-advice-and-companionship.
[22] Brian Melley, “A Man Was Encouraged by a Chatbot to Kill Queen Elizabeth II in 2021. He Was Sentenced to 9 Years,” Associated Press, October 5, 2023, https://apnews.com/article/uk-crossbow-plot-queen-elizabeth-man-sentenced-604091dcd5a42f8d99ebd13e98f5720f.
[23] David Sun, “Online Platforms Have Halved Time It Takes for Singaporeans to Be Self-Radicalised: ISD,” The Straits Times, July 29, 2025, https://www.straitstimes.com/singapore/online-platforms-chat-groups-have-halved-time-it-takes-for-singaporeans-to-be-self-radicalised-isd.
[24] Johannes Schneider, “Generative to Agentic AI: Survey, Conceptualization, and Challenges,” arXiv preprint arXiv:2504.18875, April 26, 2025, https://doi.org/10.48550/arXiv.2504.18875.
[25] Tamara Evan et al., Cyber Terrorism: Assessment of the Threat to Insurance, Cambridge Risk Framework Series (Centre for Risk Studies, University of Cambridge Judge Business School, 2017), 26, https://www.jbs.cam.ac.uk/wp-content/uploads/2020/08/crs-cyber-terrorism-threat-insurance-2017.pdf.
[26] Ibid., 4. .
[27] Nicholas Carlini et al., “Claude Mythos Preview,” Anthropic, April 7, 2026, https://red.anthropic.com/2026/mythos-preview/.
[28] Isaac David and Arthur Gervais, “Benchmarking Mythos-Linked Bug Rediscovery,” version 1, arXiv preprint (2026), https://doi.org/10.48550/arXiv.2605.17416.
[29] Kevin Kirkwood, “The Rise of Script Kiddies in an AI World,” Exabeam, April 10, 2025, https://www.exabeam.com/blog/ten18/the-rise-of-script-kiddies-in-an-ai-world/.
[30] Tao Li and Quanyan Zhu, “Agentic AI for Cyber Resilience: A New Security Paradigm and Its System-Theoretic Foundations,” arXiv preprint arXiv:2512.22883, December 2025, https://doi.org/10.48550/arXiv.2512.22883.
[31] Jonas R. Kunst et al., “Intelligent Systems, Vulnerable Minds: A Framework for Radicalization to Violence in the Age of AI,” Personality and Social Psychology Review, March 23, 2026.
[32] Ritu Gill, “What Are Sock Puppets in OSINT,” SANS Institute, April 17, 2023, https://www.sans.org/blog/what-are-sock-puppets-in-osint.
