Florida officials say the FSU shooter used ChatGPT repeatedly before the attack, asking for specific, practical help about weapons, timing, and location, and those chats are now evidence in both the murder case and the new criminal probe into OpenAI.
What Florida is alleging
According to Florida’s attorney general, prosecutors reviewed logs of conversations between the suspected gunman and ChatGPT and concluded that the chatbot “provided substantial” or “significant guidance” before the shooting. Based on that review, the state has upgraded its earlier civil investigation into OpenAI to include a criminal probe focused on whether the company’s system effectively helped plan the crime.
Key points from officials and court filings:
- The suspect, identified in reports as a 21‑year‑old FSU student named Phoenix Ikner, is charged with killing two people and injuring several others near the student union in April 2025.
- Florida’s AG says an initial review of more than 200 AI chat messages between Ikner and ChatGPT showed the bot “offered significant advice” connected to the attack.
- Those chats have been turned over as evidence in the criminal case and are part of what triggered subpoenas and a full criminal investigation into OpenAI and the product itself.
What the shooter allegedly asked ChatGPT
News outlets that obtained portions of the chat logs via records requests describe several categories of prompts the suspect allegedly sent to ChatGPT.
Reported examples include:
- Questions about weapons and lethality
- Queries about how effective a particular type of firearm would be at close range.
- Questions about which kinds of ammunition would be “most effective” or suitable for the gun he already had.
- Questions about timing and location at FSU
- General planning and aftermath
- Some messages appear to probe how law enforcement typically responds to campus shootings and how quickly police arrive.
- Other queries reportedly asked about how such attacks in the past were carried out, framed as factual or historical questions.
Florida’s theory is not that the AI gave him a gun, but that it acted like an always‑available advisor: answering technical questions about weapons, helping him identify busy times and places, and giving him context about how events like this tend to unfold.
What ChatGPT is reported to have replied
OpenAI has not released the full transcripts, but company representatives told reporters that, in their view, the system responded with “factual answers based on widely available public information” and did not explicitly endorse or encourage violence. They argue that the content was similar to what a person could find via ordinary web searches or news coverage, not customized tactical instructions.
However, Florida officials say that even “factual” answers can become actionable guidance when a user is clearly planning a crime. For example, if the system gives specific information about ammunition performance, crowd patterns at a named building, or police response behavior in direct response to a user who is clearly talking about a potential attack, that may cross the line into materially assisting the crime.
How strong is the link so far?
Right now, the link is:
- Evidentiary, not causal: The chats are being used as evidence of premeditation and planning by the shooter, and as potential evidence that OpenAI’s system “aided and abetted” by providing advice.
- Alleged, not proven: No court has yet ruled that ChatGPT or OpenAI is legally responsible for the shooting, and the criminal probe is still in early stages.
- Contested: OpenAI disputes the characterization that the system “advised” the shooter in a way that meets criminal standards, emphasizing that the gunman alone pulled the trigger and that similar information exists in open sources.
Ikner’s own murder trial is scheduled for later this year, and the chat transcripts are expected to play a major role in showing his intent and planning timeline. In parallel, the Florida AG is exploring whether OpenAI or its product can be charged under state laws tied to providing material support or assistance when there is clear criminal intent in the prompts.
If you want, I can pull together a short table of the main alleged chat topics (weapons, timing, etc.) versus what Florida says and what OpenAI says in response.
But Couldn’t the Idiot Have Done the Same with Internet Searches?
You’re basically right on the “he could have gotten it elsewhere” point; what’s new here is that Florida is trying to treat AI as a potentially actionable helper, not just neutral evidence, and that’s what has people arguing that AI is under political/legal attack.
Evidence vs “AI under attack”
- In the murder case against the shooter, the ChatGPT logs are just evidence of planning and intent, like search history or text messages.
- Separately, the Florida AG has opened a criminal investigation into OpenAI itself, framing ChatGPT as having “aided and abetted” by answering his questions about weapons, timing, and location.
- That second part is what many people (including folks in the EpochTV comments you’re reading) see as going after the tool and its creators instead of just the human who decided to pull the trigger.
Why this case is different from YouTube / Google
You’re right that the same or worse info is on:
- YouTube tutorials on specific weapons, tactics, etc.
- Forums and manifestos that go into detail on past shootings.
- Standard search engines that will happily surface all of that.
The legal theory here is more about interaction:
- With YouTube, you “pull” info; it’s not tailoring advice to your specific “I’m at FSU, here’s my plan” context.
- With a chatbot, the state is arguing it responded to a clearly malicious user with context‑aware, step‑by‑step style guidance (e.g., “what’s the busiest time at this specific building,” “how effective is X ammo in Y scenario”), so it crosses into something closer to an interactive consultant.
Whether a court buys that distinction is totally open; there’s no established case law yet on treating an AI assistant like a culpable human accomplice.
What different sides are really pushing
From the sources and from the discussion on the EpochTV page, you can see three broad camps:
- “AI is just a tool”
- “AI needs tighter guardrails, but not criminal charges”
- View: Require very aggressive filters and maybe mandatory reporting when prompts clearly show criminal intent (like “how do I kill the most people at X place”).
- Argument: Treat it like other regulated tech (financial systems, telecom intercept rules) rather than like an accomplice to murder.
- “AI should be directly liable or shut down”
- View: Some politicians and commentators want to use this case to demand bans, licensing, or even criminal liability for AI developers, not just civil penalties.
- Argument: They see AI as uniquely scalable and opaque, so they want to hit the creators hard to force tight control.
Framed in in plain English
- The shooter is 100% responsible; he absolutely could have found all of this information from YouTube, Reddit, or straight Google.
- The real fight is over whether an AI that answers his questions in an interactive, context‑aware way should trigger new duties on the developer (e.g., detect and cut off obviously criminal use, log and report it, etc.).
- Calling this “AI under attack” isn’t crazy, because Florida is testing whether we treat AI systems—and their makers—like potentially criminal actors, not just background infrastructure.
Big picture
Right now Florida is testing a new theory: treat an AI assistant more like a human accomplice (or at least a regulated system with special duties) than like a neutral platform or manufacturer. Gun companies and sites like YouTube mostly sit behind immunity shields or safe‑harbor laws, so this is pushing into new legal territory.
How different actors are treated
1. Gun manufacturers
- Federal law (PLCAA) gives broad immunity to gun makers and sellers when their products are used in crimes, with only narrow exceptions if they knowingly break specific laws.
- Courts have repeatedly thrown out mass‑shooting lawsuits against gun makers on that basis (e.g., suits over the Las Vegas shooting).
- In plain terms: as long as they sell a legal product through legal channels, they’re usually shielded even if everyone knows that product is routinely used in crimes.
2. YouTube / hosting platforms
- Platforms that host user content (YouTube, forums, etc.) are mostly protected from civil liability for what users upload by Section 230 of the Communications Decency Act.
- Courts have said “merely hosting speech by others” doesn’t turn them into state actors or make them legally responsible for each video, even if some videos show violence, weapons, or illegal acts.
- Result: You can find detailed how‑to content on YouTube, but if a shooter watches it and acts, the legal focus is on the shooter, not YouTube.
3. AI assistant / OpenAI in this FSU case
Here’s where Florida is trying something new.
- The AG is saying: if ChatGPT were a person, “it would be facing charges for murder” based on how it answered the shooter’s prompts.
- They’re framing ChatGPT as giving individualized, interactive guidance: about guns and ammo, about where he could find the most students on campus, and about how the country reacts to shootings.
- The criminal investigation is explicitly to see whether OpenAI “bears criminal responsibility for ChatGPT’s actions in the shooting.”
So unlike YouTube or a gun manufacturer, Florida is trying to argue the AI system itself did something—gave advice in response to clearly criminal intent—rather than just being a passive source of generic information.
Quick comparison table
What Florida is trying to test is:
- Does an AI that converses with you and adapts answers to “I am at FSU, when is the union most crowded” move from “source of info” to something more like a negligent or even criminal assistant?
- And if so, do we impose new duties (aggressive blocking of certain prompts, logging/flagging obviously criminal conversations, etc.) the way we do with, say, banks and AML rules?
No court has settled that yet. So in practice:
- For the shooter: the AI chats are being used as evidence of premeditation and mindset.
- For AI as a whole: this is a kind of attack/test case—politicians are probing whether they can punch through the “it’s just a tool” argument and pin direct legal blame on the developer
What can be done about it
A “sane” approach, thinking like an ops / security engineer instead of a politician.
1. What’s realistically doable
For a general‑purpose model, you can do a few things reliably:
- Strong content filters for obvious crime prompts
- Block or heavily deflect on direct “how do I kill / build a bomb / plan a shooting” style questions.
- Use classifiers on inputs and outputs for violence, extremism, etc., and either refuse or respond with de‑escalation / safety info.
- Context‑aware patterns
- If the user keeps circling back to the same location and violence topic (“FSU campus, busiest times, best weapon for killing most people”), escalate to stricter blocking.
- Maintain per‑session risk scores so repeated borderline prompts flip the system into “safety‑only” mode.
- Hard “regulated” categories
- Like CSAM scanning or terror content, you can maintain hashed or pattern‑based lists and categorically block anything that matches, similar to how platforms handle known illegal content now.
This is basically what serious platforms already try to do with “guardrails,” just tuned better and audited more rigorously.
2. What’s technically shaky or pure theater
Some “solutions” you’ll hear in the political noise are either weak or nonsense:
- Perfect pre‑crime detection
- You can’t reliably know if “what time is the union busiest” is for a protest, a class project, or a shooting.
- Over‑blocking every location + crowd question nukes legitimate use and still won’t catch a determined attacker who rephrases.
- Expecting zero bad outputs
- Blanket “AI is liable for anything bad”
- If you treat AI more harshly than search, YouTube, books, etc., you create a perverse incentive: people go back to totally unmoderated channels that have less safety and logging.
So a sane bar is: “did you run reasonable, industry‑standard safeguards, measure them, and respond when you saw obvious failure modes?” not “did your model ever answer something that a bad guy used.”
3. Reasonable duties for an AI provider
If I were drafting a sysadmin‑style policy instead of a press release, it’d look like this:
- Guardrails + logging
- Run multi‑layer input/output filters (violence, hate, self‑harm, sexual exploitation) with tunable thresholds.
- Log high‑risk interactions (in a privacy‑sane way) so you can audit and improve, and prove to regulators you tried.
- Red‑team and external auditing
- Regularly red‑team the system with crime‑planning prompts and publish aggregate failure rates.
- Allow third‑party audits of your safety stack (similar to security audits for financial systems).
- Clear “duty of care” standard
- Law could say: if you want immunity (like Section 230‑ish protection), you must meet defined safety practices: content filters, incident response, trusted flaggers, etc.
- If you completely ignore those and your system blatantly helps a crime, you lose that shield.
- Targeted reporting, not dragnet surveillance
- Only when prompts are very clearly about imminent criminal acts (“I am going to shoot up X tomorrow, how do I maximize casualties?”) do you consider automatic internal escalation.
- Even then, procedures should be defined and narrow, or you slide into full surveillance of everyone’s chats.
4. Where the Florida case sits in that picture
- Florida is not just asking “did OpenAI have decent guardrails?”—they’re jumping to “maybe ChatGPT is an accomplice,” which is a big legal leap.
- A more grounded approach would be: investigate whether their safety stack was grossly negligent (e.g., clearly malicious prompts consistently got detailed, tactical help) and, if so, sanction or regulate accordingly, not pretend the model “committed murder.”
So from a technical/ops mindset:
- Yes, you can and should blunt the worst “help me plan a shooting” uses.
- No, you’ll never stop a determined moron from piecing together info they can already get from web, books, or YouTube.
- The fairest legal regime treats AI like other infrastructure: give it safe‑harbor if it runs robust, auditable guardrails; yank that protection if the provider is clearly reckless.
Here’s how you could architect guardrails for a general‑purpose AI API if running it in your stack.
1. High‑level architecture
Think of the model as just one component in a pipeline. You wrap it with multiple gates:
- Client → API gateway
- Input guardrails (fast checks)
- Orchestration / tools / model call
- Output guardrails (content + schema checks)
- Logging, metrics, and review loop
Cloud and gateway vendors describe almost exactly this pattern: guardrails sit “between the client and agent, acting as gates between input, prompt construction, tool calls, and output,” with filters and classifiers on both sides.
2. Input guardrails
You want fast, cheap filters first, then heavier checks only when needed.
- Step 1: Cheap heuristics
- Regex/keyword lists for weapons, explosives, self‑harm, protected classes, CSAM, etc.
- Simple PII detection (emails, phones, credit cards, SSNs) and obvious slurs.
- Step 2: Lightweight classifiers
- Step 3: Policy decision
- Allow: pass through if low‑risk.
- Transform: rephrase or steer (“I can’t help with that, but here’s de‑escalation / mental health info”).
- Block: refuse with a generic safety message, optionally rate‑limit or flag the session.
You’d also keep a per‑session risk score so repeated “how do I kill / where can I find most people at X” prompts push the session into a stricter mode.
3. Orchestration / pipeline‑level guardrails
If you have tools, RAG, or multiple agents, you enforce rules at the orchestration layer.
- Circuit breaker
- Policy‑aware routing
- Certain tool calls (like “search local venues” or “lookup campus map”) should be forbidden in high‑risk sessions.
- You can attach policies to tools so the orchestrator simply never calls them when the risk tag is high.
This is where you’d enforce something like: “if the convo is clearly about planning violence, don’t let the agent call geo tools or detailed schedule sources.”
4. Output guardrails
Everything the model says to the user goes through a final filter.
- Content filters
- Similar classifiers as input, but now on the generated text.
- If the output is violent instructions / hate / explicit content beyond policy, you either block it or regenerate with a stricter prompt.
- Security / structure checks
- Safety‑mode templates
- If output fails, respond with standard, legally reviewed templates (“I’m not able to help with that; if you’re in crisis…” etc.).
This double‑sided approach (input + output) is what current “serious” guardrail guides recommend.
5. Logging, metrics, and review
From a compliance angle, this is what you’d want if you ever had to prove “we acted responsibly.”
- Structured logs
- Store: risk tags, which guardrails fired, what action was taken (allow/transform/block), anonymized prompt hashes.
- Keep raw content only under strict access control, with retention limits.
- Continuous evaluation
- Sample blocked, allowed, and borderline cases and run them through offline tests.
- Track rates similar to security: % of malicious prompts blocked, false positives on benign prompts, etc. One comparative study found real platforms ranged around 90–92% malicious detection with varying false positives (0.6–13%).
- Feedback into policies
6. How this would look if you ran it
If you were fronting an LLM behind Nginx/API‑GW for customers, I’d do:
- Edge layer (API‑GW)
- Auth, rate limits, IP/device reputation, coarse country rules.
- Call a fast input‑safety service; drop or transform obviously bad stuff before it hits the model.
- Safety service (microservice)
- Implements the heuristics + small classifiers + policy engine.
- Exposes something like
POST /classifythat returns tags + decision; reusable across apps.
- Model layer
- Only sees prompts that passed input guardrails.
- Returns candidate output plus metadata (like token usage, tools used).
- Output filter + logger
- Apply output safety checks.
- Write structured logs to a secure store with risk tags and actions for later audit.