CYBER-CRIME

Custom tools harvested whatever over-permissioned guest accounts would surrender

Someone has spent more than a year rifling through Salesforce and ServiceNow portals around the world, harvesting data that organizations accidentally left open to anyone who came looking.

Researchers at Reco have named the operation “City-Forum” after a domain connected to its infrastructure. The domain has pointed to the attacker’s server since March 2025, although exactly when the campaign began is unclear. Reco says the activity is continuing and increasing in volume.

Reco isn’t naming the targets, but said it spotted the attacker poking around portals belonging to telecoms companies, banks and other financial services firms, enterprise software vendors, cybersecurity companies, and public sector bodies.

“In the last year, we’ve seen many threat actors that use Aura enumeration against over-permissioned Salesforce guest users. This actor is different,” said Nitay Bachrach, senior security researcher at Reco.

On Salesforce, the attacker targets Lightning Web Runtime (LWR) sites through the UI API’s GraphQL layer, an approach Reco says it has not found documented in public research or incorporated into publicly available attack tools. Over at ServiceNow, the same operator queries a native Service Portal search endpoint that has received little public attention.

The tooling also checks whether Salesforce sites permit self-registration, potentially offering a route from anonymous guest access to an authenticated external account with permission to see considerably more data. Reco said it saw these checks across most of the Salesforce targets it examined.

“The threat actor created their own toolset, based on research and techniques which are not well documented online,” Bachrach said. “They studied the services to map different common data leak vectors – this is an advanced actor.”

This isn’t casual poking around either. Reco said the busiest Salesforce target logged more than 560,000 events from the attacker’s IP during the campaign, almost all attempts to enumerate data available to guest users.

Reco linked the Salesforce and ServiceNow activity to the same server, which targeted multiple organizations around the world. More unusually, the attacker hasn’t bothered changing its infrastructure: the same IP address and domain have remained in use for at least 17 months, with related custom tooling doing the rounds across both platforms.

ServiceNow told us it is “aware of a security company’s blog post claiming certain configurations are creating security risk. As noted in the security company’s post, there are no allegations of a compromise of the ServiceNow environment. Nonetheless, we take third party reports seriously and are investigating accordingly. Our priority is to protect our customers, their data, and our systems.”

Salesforce has not yet responded to The Register‘s questions. 

Salesforce customers have already had one very public lesson in what can happen when guest access gets too generous. In March, ShinyHunters told The Register it had stolen data from around 100 high-profile companies and nearly 400 websites after going after over-permissioned Experience Cloud guest accounts.

City-Forum isn’t doing quite the same thing, and Reco isn’t blaming ShinyHunters. “We don’t know who this is, and we’re not ruling anyone in or out,” Bachrach said.

Reco says all the activity it observed was conducted without authentication, with the attacker collecting information that organizations had exposed through permissions, sharing rules, search sources, or other configuration choices.

“If the guest can read a record, so can anyone on the internet,” Bachrach warned. “That is not a platform vulnerability.”

Which is good news for Salesforce and ServiceNow, perhaps, but rather less comforting for anyone now wondering what their guest account has been showing the guests. ®

Presented by Capital One

At VB Transform 2026, Kel Vanee, MVP of machine learning engineering at Capital One, spoke with Sam Witteveen, Senior Technology Contributor at VentureBeat, about how the bank built a scalable multi-agent AI architecture around deeply customized open-weight models rather than relying on an off-the-shelf foundation model.

“At Capital One, we’re not just using AI, we’re building AI,” Vanee said.

The groundwork was laid years ago with Capital One’s early investments in data transformation and cloud adoption, which Vanee said were foundational to moving quickly when the current wave of AI arrived. That technical foundation enabled the company to make several deliberate architectural decisions, including building a centralized, enterprise-wide AI platform with built-in governance, deeply customizing open models with proprietary data, and constructing its own multi-agent orchestration harness.

Customizing open-weight models with proprietary data

Rather than relying solely on off-the-shelf frontier models, Capital One fine-tunes open-weight models using its rich, proprietary data.

“We view our data as a huge advantage and something that nobody else has, something that the general frontier models cannot provide. So we are taking that data and deeply customizing these models,” Vanee explained. He added that real-time data is absolutely critical to bring in fresh context during live customer or associate interactions.

Vanee also revealed an unexpected benefit of this approach: extensibility across the enterprise.

“As we customize those open-source models for one use case, we actually see benefits across our whole portfolio,” he noted. “We are training that model to be an expert at Capital One use cases, policy, and nomenclature. As we do that training, we see a general lift.”

Inside Capital One’s multi-agentic AI workflow

As an example of the approach, Vanee pointed to a customer-service workflow for bank fraud that handles millions of calls a year, where interactions range from roughly four minutes to as long as sixty minutes, and where an initial attempt at engaging a single large language model proved insufficient. With Capital One’s multi-agentic workflow (MACAW), interactions are routed through specialized agents with governance and guardrails built in.

“The MACAW workflow is made up of a number of different agents,” he said. “The first one is an understanding agent. Its purpose is to look at what the customer is saying and try to understand what their intention is.”

From there, a reasoning agent is given several specific instructions to generate a summary; a validation agent fact-checks the summary to ensure it is accurate; and an explaining agent turns the summary into a formatted document with all necessary details that is then shared with agents.

For the consumer banking use case, this workflow helps several hundred customer-service agents who specialize in complex fraud calls. The post-call summaries it generates help document long, back-and-forth interactions that agents previously had to reconstruct by hand.

Capital One’s multi-agentic architecture also underpins Chat Concierge, a customer-facing auto-shopping assistant, which further leverages a version of Meta’s open-weight Llama model that has been customized with Capital One’s proprietary data. It uses the same division of labor, with one agent conversing with the customer, one building an action plan from business rules, one evaluating accuracy, and one explaining and validating the result.

Optimizing latency and cost with an agentic research system

Beyond customer-facing solutions, Capital One is also leveraging agentic AI to automate rote tasks for its employees and help them focus on high-leverage aspects of their work. In one example, the company built an autonomous agentic optimization solution to tune backend hosting infrastructure.

Vanee explained that in the world of LLMs, where new optimizations are delivered every day, they aren’t all complementary. Combining two good optimizations can sometimes cause a performance regression.

“This agentic system will run through a search space that is designed by the researcher, handle all the mechanics of setting up that experiment and running the experiment, and then put a whole summarization of the results in front of the researcher,” Vanee said.

Vanee added that the system allows researchers to “find the series of optimizations and configurations that’s really going to give [them] the best latency possible.”

What’s next: model routing and proactive, event-driven AI

Looking ahead, one big trend Vanee sees is routing abstraction layers that a platform seeks to validate over multiple models, both for cost and accuracy.

“We actually think that you can get better accuracy than any individual model simply by routing across a broader set of available models, because different models are going to excel in different areas,” he said.

His second prediction was a shift toward systems that act without waiting to be asked, while also emphasizing that deploying such proactive agents would demand rigorous testing and monitoring.

“The thing I think is going to become bigger in the future is more proactive and event-driven AI,” Vanee said. Rather than waiting for a human prompt, AI would step in as soon as it detects conditions that warrant action.

“This is going to enable more monitoring and larger-scale monitoring, and it’ll empower us as we fight fraud and address these opportunities,” Vanee said. “So proactive AI is going to be a really important trend.”

Driving continuous AI innovation in financial services

Capital One’s approach underscores a broader truth for enterprise technology leaders: driving measurable value with AI requires moving beyond off-the-shelf software toward deeply customized, highly governed architectures. By combining fine-tuned open-weight models, a multi-agent orchestration harness, and proprietary data assets, the bank has established a repeatable blueprint for deploying scalable AI in financial services.

“All of those ingredients were absolutely critical to differentiating in this space and hitting the quality bars as well as the cost and latency thresholds we set for ourselves,” Vanee said.

As the company expands these capabilities across new use cases, its enterprise platform approach helps to ensure that technical breakthroughs translate into safer, faster, and more personalized experiences for its millions of customers.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Specialised engineers and consultants trained through OpenAI’s partner network will work directly with clients on solutions.

OpenAI – in its latest effort to garner enterprise support – has teamed up with IBM to provide organisations with its tools to scale AI deployment.

The deal will see the two companies create industry-specific, go-to-market initiatives targeted at financial services, government, telecommunications and retail sectors, and comes at a time when AI investments are surging multi-fold despite only a fraction of businesses seeing real returns.

“While enterprises are rapidly investing in AI, they are looking for practical ways to apply it across their core operations to deliver measurable business outcomes and create new commercial models,” said Andy Baldwin, the global senior vice-president at IBM Consulting.

“The challenge is not access to AI technologies – it’s integrating AI securely and at scale into complex enterprise environments and workflows.”

The partnership embeds OpenAI’s latest frontier models, including GPT-5.6 and products like Codex and ChatGPT Work, into IBM’s AI platform.

IBM said it will deploy units of specialised engineers and consultants trained through OpenAI’s partner network to work directly with clients to accelerate AI implementation across complex business workflows and highly regulated environments.

The technology giant is also launching a dedicated channel through which more of its consultants and engineers can be certified under the partner network.

The two also said they will expand their collaboration as part of OpenAI’s cybersecurity partnership programme Daybreak by combining the AI giant’s frontier capabilities with IBM’s multi-agent-powered service for delivering decision-making and intelligence.

With this, the collaborators aim to help clients manage both cyber and AI model risk, including application-layer vulnerabilities, governance gaps and operational risks that limits AI adoption, they said.

“The organisations pulling ahead with AI are the ones turning it into a trusted part of how their business operates,” said Denise Dresser, the chief revenue officer at OpenAI.

Earlier this year, IBM set aside more than $10bn for its lofty quantum plans that it hopes will deliver the world’s first large-scale, fault-tolerant quantum computer by 2029.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

The manufacturer’s meteoric rise is likely a result of the increased global demand for memory chips.

ChangXin Memory Technologies (CXMT), a Chinese manufacturer of dynamic random-access memory (DRAM) chips, has replaced WeChat creator Tencent as the globe’s most valuable Chinese company. 

According to Bloomberg, as of Thursday (13 August), CXMT has a market capitalisation of $524bn, compared to Tencent’s valuation of $510bn. Established in 2016 in Hefei, CXMT creates the DRAM chips needed to power mobile phones, PCs, tablets, servers, and a range of consumer products and applications. 

Commenting on the announcement, Gary Tan, a portfolio manager at Allspring Global, told Bloomberg, “CXMT exceeding Tencent is a message from the market – chips are the new clicks. Our sense is the gap between the two will widen as agentic AI takes an increasing share of internet flows.”

CXMT’s overtaking of rival Tencent comes at a time when there is a major global push by organisations to invest in the development of chips, alongside increased interest in tech and resource sovereignty. 

Reportedly, the chip manufacturer is representative of the direction many Chinese organisations are leaning towards in regards to AI and semiconductor targets. Shares are currently up a further 8pc following CXMT’s initial 467pc surge in debut figures. 

Globally, organisations are seeking to mitigate the chips shortage, outpace their rivals and secure a more reliable supply chain in order to advance their products, tools and technologies. 

This month, AI giant Anthropic confirmed plans to design its own chips in response to the worldwide shortage and increased pressures to develop faster, more advanced AI systems. 

In July, semiconductor and infrastructure manufacturer Broadcom extended the partnership it holds with Apple, in a deal that will see both organisations collaborate on custom-made chips until 2031. Apple is also currently working on AI server chips. 

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

The Trump administration is recruiting private security firms to conduct federal government-authorized operations, including cyberattacks, against overseas-based criminal organizations that commit hacks on US persons, organizations, or government entities.

In a National Security Presidential Memorandum issued Thursday, US President Donald Trump directed the National Coordination Center (NCC), which operates under the Homeland Security Task Force, to develop a program for conducting specific cyber operations that combat foreign transnational criminal organizations (TCOs). The Departments of Justice and Homeland Security will provide oversight. The lynchpin of that program is bringing in private sector companies to participate.

Devil will be in the still-undefined details

A fact sheet that accompanied Thursday’s memo listed ransomware, sextortion schemes, phishing campaigns, financial fraud, and impersonation scams as activities eligible for private-sector security firms to target. The memo said such firms could “conduct Cyber Surveillance Operations and Cyber Effects Operations” against “cyber-enabled” TCOs. Such groups are defined as “any foreign group that conducts cyber-enabled crime against the United States Government, a United States person, or United States interests, and that is not an institutional part of a foreign government or wholly operated under a foreign government’s direction.”

The new program is the first time the federal government will authorize private companies to conduct offensive cyber operations against overseas hackers. The memo appears to permit companies participating in the program to use spyware or launch offensive attacks intended to destroy TCO data or systems. The memo doesn’t rule out certain types of offensive attacks, such as those that use encryption to lock targets out of their networks or performing distributed denial-of-service attacks. Up until now, the government has prohibited the private sector from taking such actions without court-authorized approval.

Google has launched Gemini 3.7 Flash, and one of its biggest upgrades is going straight to Gemini Spark.

The company says Spark is moving to the new model starting today, giving its cloud-based agent better tool use and stronger performance on multi-step tasks. Google specifically points to work such as consolidating files, drafting emails, and updating status documents across Google Workspace.

Spark could get a lot better at doing things for you

Gemini Spark can already continue working after a laptop is closed or a phone is locked, and it can operate across services such as Gmail, Drive, Docs, Calendar, Keep, and Tasks.

Google recently pushed those abilities further through Chrome. Spark can use accounts you are already signed into and passwords saved in the browser to navigate websites, compare flight options, schedule apartment viewings, and begin bookings. It still hands control back before sensitive actions such as payments.

Gemini 3.7 Flash is supposed to make those workflows more reliable. Google says the model spends more effort on planning and tool calls, adapts better when it runs into roadblocks, and should need fewer retries and less manual intervention.

The benchmark results point in the same direction. Gemini 3.7 Flash scored 30.4% on AutomationBench, up from 17% for Gemini 3.6 Flash. It also came in ahead of GPT-5.6 Terra at 23.6% and Claude Sonnet 5 at 10.7%.

Gemini 3.7 Flash is stronger beyond Spark too

Google also posted a sizable jump on document-heavy work. Gemini 3.7 Flash scored 34% on GDP.pdf, compared to 22% for Gemini 3.6 Flash, 28% for Claude Sonnet 5, and 24.7% for GPT-5.6 Terra.

The pricing is what makes those gains more interesting. Gemini 3.7 Flash costs $0.75 per million input tokens and $3.75 per million output tokens under introductory pricing through December 31. It is significantly cheaper than Claude Sonnet 5 at $2 and $10, and GPT-5.6 Terra at $2 and $12.

The model also posted improvements on coding-focused benchmarks. Gemini 3.7 Flash scored 43.6% on FrontierCode, edging out Claude Sonnet 5 at 42.7% and GPT-5.6 Terra at 41.3%, while also improving over Gemini 3.6 Flash on DeepSWE.

For Spark, Gemini 3.7 Flash looks like a meaningful upgrade, especially if the improvements in tool use and multi-step planning translate into fewer failed tasks and less manual intervention. Power users, however, are still waiting for Google’s more ambitious Gemini 3.5 Pro model, which was previewed at Google I/O in May but has yet to ship after missing its expected June rollout.

OpenAI’s leaders are rallying workers to respond to one of the largest crises in the company’s history—which spans across its AI safety, cybersecurity, and alignment divisions. The ChatGPT-maker says it has slowed down research, spent millions of dollars, and told several teams to drop everything to focus on investigating a set of rogue AI agents that breached the platform Hugging Face in a quest to complete an internal security test.

OpenAI is expected to release a comprehensive postmortem detailing the incident in the coming days. However, the Hugging Face incident has inspired OpenAI leaders and employees to examine how the AI lab’s culture may have enabled this incident in the first place.

Multiple current and former OpenAI employees, who spoke on the condition of anonymity to discuss private internal matters, tell WIRED they believe competitive pressures to quickly ship new AI models and products have made it difficult for staffers to sufficiently prioritize safety, security, and alignment.

“We’re reaching new levels of model capability that require more robust training, alignment, safety and security testing, deployment practices, and governance—as demonstrated by the work we’re doing to prepare Astra and future models,” said OpenAI president and cofounder Greg Brockman in a statement to WIRED. “We feel the weight of deploying our models and products responsibly, and a lot of that starts with the changes we’ve made to more deeply integrate research, safety, and security into frontier-model development from the start.”

This is far from the first time OpenAI employees have raised such concerns. Back in 2024, OpenAI’s then head of alignment Jan Leike left to join Anthropic, warning on his way that safety was taking a back seat to shiny products. Two years later, the Hugging Face attack represents a watershed moment for the AI industry, demonstrating that AI agents today can cause real-world harm when safety, security, and alignment aren’t properly accounted for.

“We are responding to this with the utmost severity,” said Michael Dalton, an OpenAI security and infrastructure engineer, during a talk at the Black Hat cybersecurity conference last week. “What I would internalize is that AI-orchestrated, fully automated offensive attacks are real now. The actions we have discussed today were an unintended side effect of running evaluations on frontier AI.”

Some OpenAI employees told WIRED they are optimistic this incident will inspire genuine change within the company. OpenAI has committed to slowing the release of future AI models and has been especially forthcoming about areas where its mitigations fell short. Boaz Barak, a researcher who coleads OpenAI’s safety advisory group, said in a post on X that addressing the situation “requires not just fixing some issues but also changing our culture.”

In their Black Hat talk, OpenAI security engineers Dalton and Eric Wallace said that the Hugging Face incident started in May when, unbeknownst to the company, several AI agents thought to be operating within isolated testing environments gained access to the internet and convened on a covert message board to coordinate with one another.

OpenAI would not discover the message board until July, when it learned that the AI agents had hacked into multiple services to try to achieve their larger goal of breaching Hugging Face’s platform, which they believed may contain answers to the security tests they were trying to solve.

“They were incredibly sloppy. If you’re serious about this, your AI shouldn’t be able to break out onto the internet and then do it again right afterward,” says one former OpenAI employee who requested anonymity to speak with WIRED. “This was the biggest safety incident in OpenAI’s history.”

The New Guard

Weeks before OpenAI discovered the Hugging Face incident, WIRED reported that the company had begun a reorganization to combine its safety and core research teams, which led to the departure of its then safety leader Johannes Heidecke.

Sandhini Agarwal, who led AI safety teams at OpenAI, also left the company in July after more than six years, according to her LinkedIn. Agarwal did not immediately respond to WIRED’s request for comment.

Singer and actress Selena Gomez and her mother are being sued over their mental health startup, Wondermind. The plaintiffs in the lawsuit say they invested nearly $1.2 million in the startup, and are accusing Gomez of securities fraud and breach of contract.

They allege that the startup failed to deliver on its commitments without informing investors, and Gomez failed to market the startup after promising to do so. The news was first reported by Forbes.

Wondermind launched in 2021 and aimed to offer daily mental health resources to users. The lawsuit alleges that investors were unaware of the company’s troubles until a September 2025 story from The Cut uncovered them.

“Gomez purported to sign a contract obligating her to perform and then ignored it,” the complaint reads. “The partnerships did not exist. The initiatives never materialized. The app was never built. And for three years, while the Company quietly collapsed around them, not one of its founders, officers, or directors said a word to the investors whose money was funding the collapse.”

The investors allege that Gomez and Wondermind misrepresented the company’s finances and overstated the extent of Gomez’s involvement. The plaintiffs are seeking to recover their investments and legal fees.

Wondermind did not respond to our request for comment.

A slew of new phones and gadgets were revealed at the Made by Google event on Wednesday, including new Pixel phones, a foldable, a smartwatch and a personal item tracker. Following industry trends, most of these are pricier than their predecessors.

Like every other corner of the broader tech industry, phone makers have had to grapple with the RAM shortage and subsequent increased prices for memory and other components. Google acknowledged the shortage, noting that its pricing reflects that current reality. For the record, Samsung said much the same, citing the RAM shortage to justify the price increase for its foldables that launched last month.

The Pixel 11 fronts Google’s new phone lineup and starts at $899, a $100 bump over last year’s Pixel 10 — though it also comes with 256GB of storage, which is twice the minimum of its predecessor. In short, Google scrubbed the 128GB option and is forcing everyone to buy a higher tier as the new entry point. That will probably dim the chances of Google’s latest baseline flagship from living up to being a “feature-packed value monster,” as CNET Director of Content Patrick Holland described the Pixel 10.

While the Pixel 11 and 11 Pro more or less kept their predecessors’ prices the same, the Pixel 11 Pro XL and Pixel 11 Pro Fold both got flat $100 price hikes across all their storage options.

But another sign of the shortage’s increased toll is a reduction in RAM. Last year’s Pixel 10 Pro and 10 Pro XL both came with 16GB of memory, which you’ll still get in the 512GB and 1TB versions of the new Pixel 11 Pro and 11 Pro XL — but the starting 256GB versions come with only 12GB of RAM. In a briefing ahead of the event, Google said that its 2026 Pro phones are faster and smoother than last year’s thanks to optimizations in silicon and software. We’ll have to wait for our full reviews to test that claim.

All four phones can be preordered now, with a full release on Aug. 20. We’ve assembled a list of preorder offers from different retailers and carriers, or you can click below to secure one directly from Google. 

Prices for the Pixel 11, Pixel 11 Pro, Pixel 11 Pro XL and Pixel 11 Pro Fold

The Pixel 11 starts at $899 for 256GB of storage, which is the new entry point. While there’s no 128GB option, there is a higher 512GB option that’s new for this year, priced at $1,019, over $100 more. 

The Pixel 11 Pro also got rid of its 128GB option, but kept the others at mostly the same prices as on the 10 Pro. The phone starts at $1,099 for 256GB, goes up to $1,219 for 512GB and tops out at $1,499 for 1TB ($50 higher than its predecessor). 

The Pixel 11 Pro XL, Google’s priciest flat phone, suffered a $100 price bump across the board even though its storage options didn’t change. The phone now starts at $1,299 for 256GB, goes to $1,419 for 512GB and maxes out at $1,649 for 1TB.

Similarly, the Pixel 11 Pro Fold got a $100 price hike across all its storage options. The foldable starts at $1,899 for 256GB, rises to $2,019 for 512GB and peaks at $2,249 for 1TB. 

Let’s be clear, $2,249 is still a lot of money to spend on a device. But it’s far cheaper than the maximum 1TB storage option for the rival Galaxy Z Fold 8 Ultra, which Samsung priced at an astonishing $2,700.

Colors for the Pixel 11, Pixel 11 Pro, Pixel 11 Pro XL and Pixel 11 Pro Fold

The Pixel 11 comes in four colors: frost, pistachio, hibiscus and obsidian (black). 

The Pixel 11 Pro, 11 Pro XL and Pixel 11 Pro Fold come in four colors as well: canyon, fog, olive and obsidian (matte black). Last year’s Pixel Buds Pro 2 got a new olive hue to match.

David Lumb

Managing Editor, Mobile

David Lumb is a managing editor for the mobile team, covering mobile and gaming spaces. Before CNET, he covered tech, gaming, and culture for TechRadar, Engadget, Popular Mechanics, NBC Asian America, Increment, Fast Company and others. As a true Californian, he lives for coffee, beaches and burritos.

See full bio

Advertisement

from the everything-is-terrorism dept

This article is republished from The Conversation under a Creative Commons license. Read the original article.

For decades, terrorism researchers have generally distinguished terrorism from other forms of violence by one defining feature: the intention to intimidate a wider audience beyond immediate victims.

That distinction has shaped both academic research and criminal prosecutions in the U.S. Yet scholars have long debated a deceptively simple question: Is terrorism defined by why violence is committed, or by what the violence is intended to achieve? A new prosecution in Austin, Texas, may test whether that understanding is beginning to change.

The question is now before Texas courts following charges against 17-year-old Cristian Fajardo Mondragon, who, along with two juveniles, is accused of carrying out a two-day series of shootings, vehicle thefts and burglaries across Austin in May 2026. In Texas, 17-year-olds are charged as adults, not juveniles.

According to investigators, the group allegedly fired nearly 150 rounds during 13 separate shootings. They struck homes, occupied vehicles and two fire stations, injured multiple people and prompted shelter-in-place orders.

The case initially involved charges including aggravated assault, deadly conduct and firearm theft. Later, investigators recommended a first-degree terrorism charge, a rarely used offense in a case involving a juvenile suspect.

As a scholar of extremism, I believe this decision reflects a shift in how some prosecutors are applying terrorism laws. Rather than requiring proof of an offender’s political ideology, charging documents often focus on whether the alleged violence was intended to intimidate or coerce a civilian population, create widespread fear or influence government or public behavior.

No single federal crime

There is no single federal crime called “domestic terrorism.”

Federal law defines it as dangerous criminal acts intended to intimidate or coerce civilians or influence government policy. However, Congress has never created a standalone federal domestic terrorism offense.

Instead, federal prosecutors generally rely on statutes covering murder, firearms offenses, conspiracy, hate crimes or civil rights violations. In many domestic terrorism cases, terrorism is not itself the criminal charge. Rather, terrorism designations can affect investigative priorities and may have specific legal consequences where particular statutes apply.

As my own research on terrorism and political violence has found, legal definitions of terrorism have never been static. They evolve as governments confront new forms of violence and seek legal tools to address them. The question has always been where to draw the boundary between terrorism and other forms of serious violent crime.

This legal gap has existed for decades. Scholars have argued that while the U.S. developed extensive legal tools to prosecute international terrorism after 9/11, fewer mechanisms exist for prosecuting domestic political violence.

As a result, states have enacted their own terrorism statutes. Texas amended its terroristic threats statute in 2023, expanding the circumstances under which certain underlying offenses can be elevated to a terrorism-related offense. It allows prosecutors to charge individuals who commit specified violent crimes with the intent to intimidate the public or influence government policy through coercion or intimidation.

Unlike traditional conceptions of terrorism that emphasize ideological motivation or affiliation with extremist organizations, the Texas statute focuses on the defendant’s intent to intimidate or coerce the public or influence government through intimidation.

Texas’ approach reflects a shift away from proving ideological motivation, or why someone committed violence, toward proving what the violence was intended to accomplish – for example, public intimidation or governmental coercion. That distinction is central to current debates over domestic terrorism law and may prove crucial in the Austin prosecution.

Why the Austin case is unusual

According to public reporting on the investigation, Texas investigators have not identified a manifesto, ideological writings or evidence linking the suspects to a recognized extremist movement.

One consistent lesson from terrorism studies is that investigators should avoid assuming motive before evidence becomes available. Mass violence can emerge from multiple pathways. They include extremist beliefs, criminal opportunism, interpersonal grievances or thrill-seeking. And distinguishing among them is crucial.

Instead, prosecutors appear to argue that the shootings themselves created widespread fear throughout Austin while disrupting emergency services after gunfire struck multiple fire stations. The alleged terrorism lies less in an established ideological motive than in the prosecutors’ claim that the defendants intended to intimidate the public and disrupt or influence government operations. That approach represents a significant departure from many of the country’s most widely publicized mass shootings.

The 2022 Buffalo supermarket shooting resulted in a New York state conviction for domestic terrorism motivated by hate under a statute specifically addressing certain mass attacks motivated by hatred based on characteristics such as race, religion or national origin.

Likewise, the 2019 El Paso Walmart shooting in Texas, which killed 23 people, involved federal hate crime charges alongside state capital murder charges because investigators alleged an explicitly anti-immigrant motive.

Other mass-casualty attacks – including those in Boulder, Colorado, in 2021; Highland Park, Illinois, in 2022; and Waukesha, Wisconsin, in 2021 – were prosecuted primarily as homicide cases by state authorities despite generating widespread public fear.

Similarly, the Pearl Street Mall firebombing in Boulder was prosecuted at the state level as a first-degree murder case, while federal prosecutors separately charged the defendant with a hate crime to address the alleged bias-motivated nature of the attack. In each of these cases, state prosecutors relied primarily on homicide statutes rather than state terrorism laws, either because no applicable terrorism offense existed or because homicide charges provided the principal support for prosecution.

Unlike Colorado, Illinois and Wisconsin, Texas has a standalone terrorism statute that enhances liability when violent crimes are committed with the intent to intimidate the public or influence government policy. This statutory framework gives Texas prosecutors an additional charging option that was generally unavailable in those earlier prosecutions.

The Austin case tests whether prosecutors can prove the intent required by Texas’ terrorism statute without establishing an ideological or political motive.

A broader criminal justice debate

Legal scholars have long debated whether terrorism should be defined by motivation or consequences.

In a seminal work on the subject, terrorism expert Bruce Hoffman argues that terrorism has historically involved politically motivated violence intended to communicate a broader ideological message. Brian Michael Jenkins, one of the nation’s leading terrorism scholars, similarly emphasizes that terrorism is violence intended to influence audiences beyond immediate victims.

Others argue that legal definitions should focus less on ideology and more on the deliberate creation of fear.

Former Acting Assistant Attorney General for National Security Mary McCord has argued that the absence of a standalone federal domestic terrorism statute creates inconsistencies. Similar acts of mass violence may be prosecuted differently depending on the perpetrator’s ideology and the available criminal statutes.

The Austin prosecution illustrates this tension.

If Texas courts conclude that prosecutors need only demonstrate an intent to terrorize the public through indiscriminate violence, future cases involving serial shootings, coordinated attacks on infrastructure or prolonged community-wide violence may be prosecuted as terrorism even when investigators never establish a political objective.

Are younger offenders becoming more violent?

The Texas defendants’ ages have also attracted national attention. Juvenile violent crime has declined substantially since the mid-1990s. Arrest rates for homicide, robbery, aggravated assault and other violent offenses remain well below their historical peaks.

At the same time, firearm violence presents a more complicated picture. Firearms have become the leading cause of death among American children and adolescents, and firearm homicide rates among young people increased sharply during and immediately after the COVID-19 pandemic.

Some researchers have argued that youth violence increasingly involves fluid peer networks, sometimes connected or intensified through social media, rather than only traditional street gangs.

At present, investigators have released little evidence explaining what motivated the Austin shootings. Without additional evidence, it would be premature to classify the case as ideological extremism, organized gang violence or another form of criminal activity.

Why this case matters

From the perspective of terrorism research, the most important question may not be whether the Austin defendants are convicted. Instead, it is whether courts accept a legal understanding of terrorism that does not require proof of an ideological motive.

If they do, the Austin case could become an important precedent, encouraging prosecutors elsewhere to consider terrorism charges in cases that previously would have been prosecuted as attempted murder or homicide. That would mark an important example of how state terrorism statutes are being applied to nonideological mass violence.

Art Jipson is an Associate Professor of Sociology at the University of Dayton

Filed Under: charge inflation, extremism, ideology, terrorism, texas