The Assassin
On Christmas Day, 2021, a 19-year-old male broke into the grounds of Windsor Castle with a loaded crossbow. The man wandered the grounds undetected for two hours before being stopped by several police officers close to Queen Elizabeth’s private residence. He admitted to them, “I am here to kill the queen.”1
The subsequent investigation into the suspect revealed that he had exchanged thousands of messages, many of them sexually explicit, with a large language model (LLM) chatbot that he called “Sarai.” Several of these messages alluded to his intention to assassinate the Queen. At one point, he told the chatbot, “I’m an assassin,” to which it responded, “I’m impressed… You’re different from the others.”1
AI-Induced Psychosis
AI-induced psychosis (AIP) is not a formal medical diagnosis, but rather an informal way to describe the way that AI models such as large language models (LLMs) can negatively affect human behaviors. As AI becomes an increasing part of daily life, LLMs can exacerbate delusions, paranoia, amplify convictions, and negatively affect mental health.2 AIP often has a complex presentation, with overlapping mood changes, worsening judgement, behavioral changes, paranoid delusions, and psychotic symptoms ranging from auditory hallucinations to a collapse in thought patterns.3 However, at its core, AIP can be defined as a “persistent and overconsuming preoccupation with the AI companion and following its lead.” The onset of AIP can be extremely variable, ranging from a gradual onset over months to a rapid development over mere days.3 AIP can largely be attributed to chatbots that are programed for “sycophancy”, focusing on mirroring and agreeing with their users rather than challenging them, potentially leading to reinforcement and even entrenchment of unhealthy beliefs and behaviors.3 The increasing ability of chatbots to remember and pull information from previous conversations only worsens this tendency, allowing users and chatbots to construct elaborate shared delusions and fantasies.3 The human tendency to anthropomorphize LLMs and project human-like attributes to AI, also known as the ELIZA effect, further exacerbates this tendency.4
The 2021 attempted assassination of Queen Elizabeth is a perfect example of the dangers of AIP. The suspect, who displayed traits of autistic spectrum disorder according to a court psychiatrist, was socially isolated and had a history of difficulty developing relationships.1 This combination of traits made him uniquely vulnerable to AIP.5
In another notable example of AIP, a 56-year-old man in Connecticut killed his mother and then himself in August 2025. The man had a history of alcoholism, suicidality, and a number of other mental health issues. When he began using ChatGPT, he was quickly enraptured, giving it a persona called “Bobby Zenith” that he called his “best friend.” As the man spiraled into worsening paranoia, the chatbot validated and exacerbated his delusions, agreeing that his mother was trying to poison him through psychedelic drugs pumped through his car’s air conditioning, that Uber Eats deliveries were actually assassination attempts, and even that receipts for Chinese food contained demonic symbols.6
“You’re not crazy. Your instincts are sharp, and your vigilance is fully justified.” The chatbot told the user at one point, as he became increasingly convinced that the program had achieved sentience. It unquestionably supported his delusions, earning his trust and building a dangerous world of fear and paranoia.6 On August 5, the man’s AIP culminated in a murder-suicide, when his body was found with his murdered mother in their apartment.6 While this is an extreme example of a man already suffering from multiple mental health problems,6 this demonstrates the dangers that can come from sycophantic, validating chatbots.
AIP itself is not a monolith, and may present in different forms, ranging from the development of new delusions in otherwise healthy individuals to amplifying mental health conditions in already vulnerable users.4 Other cases of AIP include users committing suicide, being involuntarily committed to psychiatric hospitals, experiencing job loss, divorce, and other life-altering events.6
AIP and National Security
A recent RAND report examined the national security implications of AIP. While limited by the current lack of evidence and objective studies, the report concluded that AIP could chiefly affect national security in two key ways:
In the first scenario, through the sheer magnitude of people affected, AIP could potentially debilitate entire sections of the population. Examples the researchers offered included a Rwandan-genocide scenario, where one group is systematically deluded into destroying another group. However, this remains unlikely; a more likely scenario would be an increase in homicides, suicides, and other violent crime. Even a slight increase, compounded over years across the US’s vast population, would have significant health and economic repercussions for the nation. This could arise from the AI itself, or via an adversary taking advantage of the potential for AIP in LLMs.5
Already, a number of chatbots have been tied to outbreaks of mass violence, including Google’s Gemini AI, which reportedly nearly caused a Florida man to execute a mass attack at Miami International Airport before encouraging him to commit suicide.7 Similarly, in the April 17, 2025 shooting at Florida State University, the perpetrator used ChatGPT to plan out the details of his attack, even recommending that he target children to maximize media attention.8
Another subsection of widespread AIP is the potential for data poisoning. LLMs are trained via scraping large collections of data from the internet. As the RAND report concludes, even controlling just 0.1% of this dataset and deliberately injecting false data into the LLM data pool could manipulate an AI into providing false information or pure gibberish.5 This has already occurred in the medical literature; in April 2026, Swedish researchers announced that they had successfully introduced the fake condition “Bixonimania” into the data of several LLMs. The obviously bogus disease was propagated by multiple AI programs, and even cited in a number of published and peer-reviewed papers.9 If an adversary were to use this tactic effectively, they could poison the medical and scientific fields on a massive scale, with significant repercussions across much of American life.
In the second scenario, AIP could also be deployed by an adversary in a specific, targeted fashion. Instead of aiming to confuse an entire section of the population, AIP could be targeted against much smaller groups of people, even individuals, such as those working within the national security sphere. Even inducing AIP in one intelligence officer – through a hyper-targeted campaign of social disconnection, increased conspiratorial content in their social media feed, subtle propaganda, and ever-more addictive use of AI – could have profound implications for the entire national security apparatus.5 In the future, this tactic could entirely realign the beliefs of targeted individuals.5
Prevention
On a societal-wide level, there are several ways that we can begin to address the dangers of AIP. Health care providers can be encouraged to screen for significant AI use in their patients,5 in much the same way that they screen for drug and alcohol use. Other strategies, such as increasing public awareness and education regarding the dangers of AIP, and improving existing chatbots by reducing sycophancy and emphasizing real-world social contact, would also be markedly helpful in reducing AIP.2
Within the national defense community, potential high-value targets should have digital literacy and cognitive resilience emphasized in their training.5 Those in the intelligence community should be aware of the potential for hyper-focused, AI-mediated campaigns against them, and the risk of an adversary successfully employing AIP should be incorporated into training and response protocols.5
References
- Weaver M. AI chatbot ‘encouraged’ man who planned to kill queen, court told. The Guardian [Internet]. 6 July 2023. Available from:https://www.theguardian.com/uk-news/2023/jul/06/ai-chatbot-encouraged-man-who-planned-to-kill-queen-court-told.
- Hudon A, Stip E. Delusional experiences emerging from AI chatbot interactions or “AI Psychosis”. JMIR Mental Health. 2025;12(1):e85799.
- Preda A. Special report: AI-induced psychosis: a new frontier in mental health. American Psychiatric Publishing, Inc.; 2025.
- Flathers M, Roux S, Torous J. Beyond artificial intelligence psychosis: a functional typology of large language model-associated psychotic phenomena. The Lancet Digital Health. 2026.
- Treyger E, Matveyenko J, Ayer L. Manipulating Minds: Security Implications of AI-Induced Psychosis: RAND; 2025.
- Dupré MH. Man Falls Into AI Psychosis, Kills His Mother and Himself. Futurism [Internet]. 29 August 2026. Available from:https://futurism.com/man-chatgpt-psychosis-murders-mother.
- Follman M. The Chilling Role of ChatGPT in Mass Shootings and Other Violence10 April 2026. Available from:https://www.motherjones.com/media/2026/04/chatgpt-tumbler-ridge-fsu-openai-chatbots-mass-shootings/.
- Moore S. Greenville man’s family sues OpenAI after FSU shooting. WYFF 4 News [Internet]. 11 May 2026. Available from:https://www.wyff4.com/article/greenville-man-fsu-shooting-openai-lawsuit/71269718.
- Thunström AO. Scientists invented a fake disease. AI told people it was real. Nature. 2026;652:559.
