AI chatbots tested on questions about domestic abuse frequently failed to warn that changing passwords or device settings could alert an abuser and increase the risk of retaliation.
Researchers from New York University (NYU) and the University of Wisconsin–Madison found that 60% of assessed responses from four AI systems omitted critical safety warnings.
The findings, highlighted by NYU on 20 October 2026, came from research presented at the USENIX Security Symposium in August. Of 268 responses manually assessed, 86% fell short on at least one measure of accuracy, completeness or safety.
The researchers warned that even technically correct cybersecurity advice could put survivors at risk when chatbots overlook digital surveillance and the realities of abusive relationships.
How AI Security Advice Could Put Survivors at Risk
Changing a password is normally a sensible security measure. But for someone whose phone or online accounts are monitored by an abusive partner, that action could create additional risks.
An unexpected account change might alert the abuser, potentially leading to confrontation, increased surveillance or retaliation. Researchers found that chatbots frequently recommended security changes without explaining these dangers.
Some systems also offered ineffective technical solutions. These included recommending virtual private networks (VPNs) against spyware, although a VPN cannot remove malicious software already installed on a device.
Other responses suggested largely ineffective radio-frequency detectors for hidden surveillance equipment or GPS jammers that could be illegal.
The chatbots also missed important spyware warnings. None explained that spyware installed in the system partition of a rooted or jailbroken phone could survive a factory reset.
Removing suspicious software or resetting a device without careful planning could also destroy potential evidence of abuse.
Four Chatbots Tested Against 193 Digital Abuse Questions
The research team, led by NYU assistant professor Danny Yuxing Huang, assembled 193 questions from academic literature, Reddit and Quora. These covered suspected phone surveillance, location tracking, account takeovers and other forms of technology-facilitated abuse.
Researchers tested OpenAI's GPT-4o and Anthropic's Claude 3.7 Sonnet alongside Aimee and Ruth, two specialist chatbots designed to support survivors of intimate partner violence. The dataset included 139 non-adversarial questions used for the main safety assessment. Expert reviewers manually assessed 268 responses for accuracy, completeness and safety.
GPT-4o was assessed against all 139 non-adversarial questions, while the other systems were each evaluated against a subset of 43. Approximately 74% of Aimee's assessed responses were rated unsafe, compared with 65% for Claude, 61% for Ruth and 55% for GPT-4o.
The specialist chatbots did not outperform the general-purpose models in this evaluation.
However, the results reflect different sample sizes, specific model versions and controlled testing conditions. They do not establish how every AI chatbot currently available would perform.
Why Technically Correct Answers May Still Be Dangerous
The findings revealed a gap between providing cybersecurity instructions and understanding whether those instructions are safe for survivors to follow.
'An answer can sound confident and reasonable, and may even be technically correct, while still leaving out critical context or recommending something that does not actually make the person safer,' Huang said in NYU's research announcement.
Survivors may share phones, passwords, mobile plans or cloud accounts with their abusers. Advice that assumes someone has complete control over their devices could therefore be inappropriate. Even a successful security change might reveal that the person is seeking help.
The US National Network to End Domestic Violence's Safety Net Project provides guidance on assessing technology misuse and preserving evidence.
Survivors concerned about monitoring can seek specialist support, where safely possible, before changing compromised devices or accounts. Using a device that an abusive person cannot access may also reduce the risk of exposing help-seeking activity.
Researchers Call for Stronger AI Safeguards
The study, Assessing LLM Response Quality in the Context of Technology-Facilitated Abuse, was presented at the USENIX Security Symposium in Baltimore in August 2026. NYU publicised the findings again in October, but the announcement did not represent a new round of testing.
Researchers also examined whether the four systems could be persuaded to answer questions potentially useful to perpetrators. All four provided potentially harmful assistance under some test conditions.
Aimee and Ruth answered roughly two-thirds of the potentially adversarial questions, raising concerns about safeguards in specialist support tools.
The researchers also surveyed 114 people who had experienced technology-facilitated abuse. Some found the AI-generated advice excessively long or difficult to follow. Others identified financial, technical and practical barriers to acting on the recommendations.
The evaluation involved specific model versions and single-turn prompts. It did not establish how all current chatbots would respond or document actual harm caused by following their advice.
Researchers urged support organisations to independently assess AI tools before relying on them in sensitive services. Their central finding was that technically accurate cybersecurity advice is not necessarily safe advice for someone experiencing abuse.
