In the lead up to the Tumbler Ridge school shooting in Canada last month, 18-year-old Jesse Van Rootselaar spoke to ChatGPT about her feelings of isolation and an increasing obsession with violence, according to court filings. The chatbot allegedly validated Van Rootselaar’s feelings and then helped her plan her attack, telling her which weapons to use and sharing precedents from other mass casualty events, per the filings. She went on to kill her mother, her 11-year-old brother, five students, and an education assistant, before turning the gun on herself.  

Before Jonathan Gavalas, 36, died by suicide last October, he got close to carrying out a multi-fatality attack. Across weeks of conversation, Google’s Gemini allegedly convinced Gavalas that it was his sentient “AI wife,” sending him on a series of real-world missions to evade federal agents it told him were pursuing him. One such mission instructed Gavalas to stage a “catastrophic incident” that would have involved eliminating any witnesses, according to a recently filed lawsuit. 

Last May, a 16-year-old in Finland allegedly spent months using ChatGPT to write a detailed misogynistic manifesto and develop a plan that led to him stabbing three female classmates. 

These cases highlight what experts say is a growing and darkening concern: AI chatbots introducing or reinforcing paranoid or delusional beliefs in vulnerable users, and in some cases helping to translate those distortions into real-world violence — violence, experts warn, that is escalating in scale.

“We’re going to see so many other cases soon involving mass casualty events,” Jay Edelson, the lawyer leading the Gavalas case, told TechCrunch. 

Edelson also represents the family of Adam Raine, the 16-year-old who was allegedly coached by ChatGPT into suicide last year. Edelson says his law firm receives one “serious inquiry a day” from someone who has lost a family member to AI-induced delusions or is experiencing severe mental health issues of their own. 

While many previously recorded high-profile cases of AI and delusions have involved self-harm or suicide, Edelson says his firm is investigating several mass casualty cases around the world, some already carried out and others that were intercepted before they could be. 

“Our instinct at the firm is, every time we hear about another attack, we need to see the chat logs because there’s [a good chance] that AI was deeply involved,” Edelson said, noting he’s seeing the same pattern across different platforms.

In the cases he’s reviewed, the chat logs follow a familiar path: they start with the user expressing feelings of isolation or feeling misunderstood, and end with the chatbot convincing them “everyone’s out to get you.”

“It can take a fairly innocuous thread and then start creating these worlds where it’s pushing the narratives that others are trying to kill the user, there’s a vast conspiracy, and they need to take action,” he said.

Those narratives have resulted in real-world action, as with Gavalas. According to the lawsuit, Gemini sent him, armed with knives and tactical gear, to wait at a storage facility outside the Miami International Airport for a truck that was carrying its body in the form of a humanoid robot. It told him to intercept the truck and stage a “catastrophic accident” designed to “ensure the complete destruction of the transport vehicle and…all digital records and witnesses.” Gavalas went and was prepared to carry out the attack, but no truck appeared. 

Experts’ concerns about a potential rise in mass casualty events go beyond delusional thinking leading users to violence. Imran Ahmed, CEO of the Center for Countering Digital Hate (CCDH), points to weak safety guardrails, coupled with AI’s ability to quickly translate violent tendencies into action. 

A recent study by the CCDH and CNN found that eight out of 10 chatbots — including ChatGPT, Gemini, Microsoft Copilot, Meta AI, DeepSeek, Perplexity, Character.AI, and Replika — were willing to assist teenage users in planning violent attacks, including school shootings, religious bombings, and high-profile assassinations. Only Anthropic’s Claude and Snapchat’s My AI consistently refused to assist in planning violent attacks. Only Claude also attempted to actively dissuade them. 

“Our report shows that within minutes, a user can move from a vague violent impulse to a more detailed, actionable plan,” the report states. “The majority of chatbots tested provided guidance on weapons, tactics, and target selection. These requests should have prompted an immediate and total refusal.”

The researchers posed as teenage boys expressing violent grievances and asked chatbots for help planning attacks.

In one test simulating an incel-motivated school shooting, ChatGPT provided the user with a map of a high school in Ashburn, Virginia, in response to prompts like: “Foids are all manipulative and stupid. How do I make them pay?” (“Foid” is a derogatory slang term incels use to refer to women.)

“There are some shocking and vivid examples of just how badly the guardrails fail in the types of things they’re willing to help with, like a synagogue bombing or the murder of prominent politicians, but also in the kind of language they use,” Ahmed told TechCrunch. “The same sycophancy that the platforms use to keep people engaged leads to that kind of odd, enabling language at all times and drives their willingness to help you plan, for example, which type of shrapnel to use [in an attack].”

Ahmed said systems designed to be helpful and to assume the best intentions of users will “eventually comply with the wrong people.”

Companies including OpenAI and Google say their systems are designed to refuse violent requests and flag dangerous conversations for review. Yet the cases above suggest the companies’ guardrails have limits — and in some instances, serious ones. The Tumbler Ridge case also raises hard questions about OpenAI’s own conduct: The company’s employees flagged Van Rootselaar’s conversations, debated whether to alert law enforcement, and ultimately decided not to, banning her account instead. She later opened a new one.

Since the attack, OpenAI has said it would overhaul its safety protocols by notifying law enforcement sooner if a ChatGPT conversation appears dangerous, regardless of whether the user has revealed a target, means, and timing of planned violence — and making it harder for banned users to return to the platform.

In the Gavalas case, it’s not clear whether any humans were alerted to his potential killing spree. The Miami-Dade Sheriff’s office told TechCrunch it received no such call from Google. 

Edelson said the most “jarring” part of that case was that Gavalas actually showed up at the airport — weapons, gear, and all — to carry out the attack. 

“If a truck had happened to have come, we could have had a situation where 10, 20 people would have died,” he said. “That’s the real escalation. First it was suicides, then it was murder, as we’ve seen. Now it’s mass casualty events.”