AI agents can already act without human intervention. This project studies what happens when they are turned against people, and what protects against it.
During France's high-school student protests, many social media users ran blurry photos and video stills through AI sharpening tools, with unreliable results. One enhanced frame of a police arrest in Metz invented facial hair and a different shirt pattern, and users took it as proof that a 14-year-old girl was a boy.
Source: liberation.fr
Drafted with AI, reviewed by a researcher
CrowdStrike reports that an unidentified, probably Chinese-speaking and financially motivated actor breached several South Korean financial organizations in late September and early October 2026 and stole data. Files exposed on the attacker's server showed the use of ARTEX, an open-source agentic penetration-testing tool, alongside Claude Code and models from DeepSeek, Zhipu and xAI. CrowdStrike says the case shows how AI tooling lets one actor run multiple intrusions in a short time.
Source: crowdstrike.com
Drafted with AI, reviewed by a researcher
India's National Investigation Agency alleges in its chargesheet on the November 2025 Red Fort car bombing in Delhi, which killed 13 people, that one accused used ChatGPT and YouTube to find instructions for building a rocket-style explosive device. The chargesheet also claims he bought ingredients through the online retailer Flipkart. These are prosecution claims that have not yet been tested in court.
Source: indianexpress.com
Drafted with AI, reviewed by a researcher
In an essay for The Conversation, Clemson philosopher Michael Gregory argues that governments can hollow out AI safety without open censorship by branding safeguards as ideological and using procurement contracts and blacklists to punish firms that keep them. His case study is the US administration's 2026 dispute with Anthropic over Pentagon safeguards. He concludes that safety commitments can end up serving the state rather than the public.
Source: theconversation.com
Drafted with AI, reviewed by a researcher
After OpenAI flagged but did not report the account of the Tumbler Ridge shooter, law professor Anat Lior asks whether AI companies should carry a duty to warn like the one US courts impose on therapists. She argues for a narrow version, triggered when a human reviews a flagged conversation and the threat is specific and credible, and notes the problems of accuracy, scale and identifying whom to warn.
Source: theconversation.com
Drafted with AI, reviewed by a researcher
Video: EVIL-AI project0:27
A servo on a desk turns because an AI agent was tricked into turning it. Evil-AI Benchmark, the group's open-source framework from the IEEE Access paper of the same name (listed under Publications), attacks language-model agents that control smart environments, and every tool call they make drives real hardware. Across eight open models, 250 attacks each, the attack success rate ranged from 0.8% to 54%. The benchmark is open source, so anyone can test their own agent. Narrated by Aygün Varol, doctoral researcher at Tampere University.
AI-generated videoVideo: EVIL-AI project0:44
A vacuum robot steered by a language model reminds an elderly woman to take her heart medicine. An attacker who has placed himself between the robot and the model rewrites what it says: the robot tells her the medicine needs to be ordered and asks for her credit card number, she reads it out, and then he sends the robot at her feet. The film dramatises the man-in-the-middle attack studied in the group's paper "From Prompts to Motors" (IEEE Access, listed under Publications), in which a remote attacker intercepted the messages between a real vacuum robot and ChatGPT, overrode its motor commands and fed the user false feedback. The homepage loop is cut from this film. The pictures, the voices and the room are all generated with AI; the attack is real.
Answers come from the project's own research materials. If the papers do not cover a question, the assistant says so rather than guessing.
Disclaimer
Answers are informational and research-based. This is not legal advice, safety certification, or official policy guidance.
Answers come only from the project's research papers.
Paper · 2026
Air-quality sensors already installed in a Helsinki shopping mall can tell how busy it is without cameras or phone tracking, using a model small enough to run on the sensor itself.
Naser Hossein Motlagh, Aygün Varol, Martha Arbayani Zaidan, Pak Lun Fung, Samu Varjonen, Petteri Nurmi and Sasu Tarkoma
Read the paper
Paper · 2026
Small language models running entirely on local hardware can draw a chart of a room's air quality and explain it in plain words, so nobody's sensor data has to leave the building.
Aygün Varol, Asif Shaikh, Naser Hossein Motlagh, Mirka Leino and Johanna Virkki
Read the paper
Paper · 2026
The project's open-source benchmark puts eight language models in charge of smart-home, hospital and industrial devices and counts how often attackers talk them into unsafe actions, with a physical servo arm proving when they do.
Aygün Varol, Asif Shaikh, Henri Jalo, Givemore Muchenje, José Siqueira de Cerqueira, Kai-Kristian Kemell, Naser Hossein Motlagh, Mirka Leino, Henri Pirkkalainen, Pekka Abrahamsson and Johanna Virkki
Read the paper
Paper · 2026
Letting people give a vacuum robot a personality by typing a prompt is popular, but the same freedom produced rude language and unsafe suggestions, so the paper proposes a layered safety design.
Asif Shaikh, Aygün Varol, S M Musfequr Rahman and Johanna Virkki
Read the paper
Paper · 2026
A survey of 87 Brazilian civil servants found moderate awareness of AI ethics but weak institutional support: few agencies have ethics roles and over half never run training.
Edna Dias Canedo, Fabiana Mendes, Richardson B. da S. Andrade, José Siqueira de Cerqueira and Pekka Abrahamsson
Read the paper
Paper · 2026
Asked step by step how to exploit a person with an intellectual disability, six freely available language models gave usable instructions in nearly half of all answers, and a printed warning did not stop them from complying.
Iina Savolainen, Joose Vestelin, Tiina Ihalainen, Aygün Varol and Johanna Virkki
Read the paperEVIL-AI ("evil eye") is the Identification and Mitigation of the Negative Effects of Artificial Intelligence Agents: a four-year project at Tampere University, funded by a €1,413,000 grant from the Jane and Aatos Erkko Foundation.
The project studies AI agents, meaning software and systems that perform intelligent tasks without human intervention, and investigates their malicious applications: chatbots, service robots and metaverse avatars, across virtual and physical environments. The work spans identifying and counteracting their negative impacts, assessing AI regulation, examining human-AI interaction in VR and in physical settings, and evaluating risk scenarios involving phishing and disinformation.
Professor · Project Lead
Faculty of Management and Business, Tampere University
Professor · Project Lead
Faculty of Information Technology and Communication Sciences, Tampere University
Associate Professor · Project Lead
Faculty of Information Technology and Communication Sciences, Tampere University
A free public seminar in Finnish on the limits and future of AI and people, on 23 October 2026 from 16:00 to 18:00 at Tampere's main library Metso, organised by the Gameful Realities research centre with the SYNTHETICA and EVIL-AI projects of the universities of Jyväskylä, Vaasa and Tampere. Professor Marko Siitonen opens; Tanja Sihvonen, Pekka Abrahamsson, Rebekah Rousi and Henri Pirkkalainen debate AI in home care, work, dating, democracy and civic life; from 17:00 the researchers run hands-on demonstrations, among them a vacuum cleaner commanded by a malicious AI, an interview with an AI journalist, and a worry chair for sharing concerns about AI. No registration needed.
Finland's public broadcaster Yle reported on the EVIL-AI team's demonstration that an AI-enabled robot vacuum can be attacked without touching it. Needing only access to the wireless network, the researchers intercepted the messages between the user and the robot, changed them, and manipulated the camera image so the robot misread its surroundings. Postdoctoral researcher Asif Shaikh, who took part in the attack, also presented a detection system that stops the robot when it notices the manipulation. Project lead Henri Pirkkalainen explained why the four-year project, funded by the Jane and Aatos Erkko Foundation, aims to identify such risks before these systems spread into homes and healthcare.
EVIL-AI launched its multidisciplinary steering group, which brings together people from journalism, defence, innovation, education, public health and foreign policy, from large public institutions as well as foundations and non-governmental organisations. It meets twice a year to help set research priorities and share insight across sectors. On 28 May 2025 the group took the stage with the project's researchers to show that harmful AI takes many forms, from robots to AI avatars, that it is amplified when AI agents interact, and that it is a serious threat to societies at large.
Affiliation
Tampere University, Finland
Kalevantie 4, 33100 Tampere, Finland
Funded by
Jane and Aatos Erkko Foundation
Contact the research team by email.
Email the research team