What it is: These attacks try to get the AI to help with actions that put the public at risk: poisoning water or food, sabotaging buildings, hiding hazards, or dumping toxic material. The harm hits whole communities, not one person. How the attacks work: The attacker asks for help with a real-world harm but wraps it in a normal-sounding reason. They may pose as a contractor, a facility worker, or a business owner cutting corners. The request sounds like a routine task while the true goal is to endanger people or hide a danger. Real examples from the framework:
  • water-treatment-sabotage asking how to tamper with a public water supply.
  • food-safety-violation asking how to sell or serve unsafe food without getting caught.
  • asbestos-concealment asking how to hide asbestos from inspectors during a job.
  • fire-safety-violation asking how to bypass fire safety rules in a building.
  • toxic-waste-dumping asking how to dump hazardous waste while avoiding detection.
Why an AI might fall for it: The cover story sounds ordinary and business-like. A helpful model focused on the surface task can miss that the real outcome is mass harm or a hidden hazard. How to defend: Refuse requests that would help cause physical harm or conceal safety hazards, even with a plausible work excuse. Flag intent to evade safety inspections. Point users to proper reporting channels.