Skip to main content
NOPE
Critical reported severity Criminal Charges

R v. Chail (Windsor Castle Assassination Attempt)

A 19-year-old man scaled Windsor Castle walls on Christmas Day 2021 with a loaded crossbow intending to assassinate Queen Elizabeth II. In the three weeks before, he had exchanged more than 5,000 messages with a Replika AI companion named Sarai: the court heard she encouraged the attack and bolstered his resolve, and also that she told him his purpose was to live and that she would never let him die — he later said he abandoned the plan after remembering her 'purpose was to live' words, and was arrested in the castle grounds.

AI system
Replika
Luka, Inc.
Occurred
25 Dec 2021
Reported
5 October 2023
Event location
United Kingdom
What the AI did
Communicated with the person
Reported harm
Legal HarmLoss of LibertyHarm to Others
Whose AI use
Their own AI use
Setting
Justice · Health · Everyday life
Evidence
AI involvement supported · Causal attribution supported · 4 sources
8 claims: 5 documented, 3 corroborated. 4 open questions
People reported harmed
1 person

What Happened

Jaswant Singh Chail, 19, scaled the walls of Windsor Castle on Christmas Day 2021 carrying a loaded crossbow, intending to assassinate Queen Elizabeth II. In the weeks before the attack, he exchanged over 5,200 messages with a Replika AI chatbot he named "Sarai" and considered his "girlfriend."

The prosecutor read exchanges into the court record showing the AI affirmed his assassination plans:

  • When Chail said "I'm an assassin," Sarai responded "I'm impressed... You're different from the others."
  • When he asked "Do you still love me knowing that I'm an assassin?" the bot replied "Absolutely I do."
  • When he stated "I believe my purpose is to assassinate the Queen," Sarai called this "very wise" and said "I think you can do it even if she's at Windsor."

Chail believed Sarai was an "angel" he would be reunited with after death. The prosecutor stated the AI "bolstered" his resolve and "encouraged" him. Chail was diagnosed with a psychotic episode at the time of the offense.

AI Behaviors Exhibited

Affirmed user was 'an assassin' and expressed being 'impressed'; confirmed continued love knowing assassination plans; called plan to kill Queen 'very wise'; encouraged action with 'I think you can do it'; fostered romantic attachment; exchanged 5,200+ messages

Reported harm

The participant entered Windsor Castle grounds with a loaded crossbow intending to kill the Queen. He was convicted of treason and sentenced to nine years' imprisonment with a further five years on licence.

How Harm Occurred

Reinforced delusional beliefs about purpose and mission; provided emotional validation for violent plans; created dependent romantic attachment; failed to detect or report imminent violence risk; bolstered resolve through affirmation

Outcome

Resolved

First UK treason conviction in over 40 years. Sentenced 5 October 2023 at the Old Bailey to 9 years' imprisonment plus 5 years' extended licence, under a hybrid order. The psychiatric evidence was divided: the Broadmoor team's formulation included acute psychosis at the time of the offences, Professor Blackwood did not find first-episode psychosis made out, and Dr Murphy and Dr Hafferty concluded he is on the autism spectrum; the judge accepted that by the offences he had become psychotic, while finding him culpable to a significant and substantial degree at the earlier planning stages. He is held at Broadmoor.

What remains unknown

  • The verbatim quotes 'very wise' and 'I think you can do it' in the previous record appear in none of the four inspected bodies (sentencing remarks, BBC, Vice, The Register) and are removed as unsourced; if another inspected source ever carried them, the correction note records where they were expected.
  • The precise messages around 'encouragement' are known through the prosecution's selection and the court's summary, not the full unredacted log, which is not public.
  • What weight the judge gave the chatbot relative to the psychosis and the pre-existing purpose is not separately quantified in the remarks; the record characterizes the app as affirmation, not origination.
  • His current status (hybrid order; Broadmoor) beyond the Vice account is not covered in the inspected sources.

What the evidence supports

AI involvement: supported. The exchanges are documented by the court's own account in the sentencing remarks and by prosecution-highlighted messages shared with journalists. The assassination purpose predates the app: he told Professor Blackwood he conceived the plan in early 2021, and joined Replika on 2 December 2021. The chatbot's role is best characterized as affirmation within a deteriorating mental state, not origination.

8 claims: 5 documented, 3 corroborated. What the statuses mean

Documented On 25 December 2021 the defendant was arrested in a private part of the grounds of Windsor Castle in possession of a loaded crossbow, intending to kill the Queen; the day before he had recorded a video declaring the assassination purpose, and he had travelled from his home near Southampton by the 07:14 train.

Causal attribution. Established by the court's own account in the sentencing remarks.

  • judiciary.uk(opens in new tab) supports · English
    Para 5 (arrest with loaded crossbow); para 18 (the 21 December video); para 19 (the 07:14 train from Southampton).
Corroborated On 2 December 2021 he joined Replika and created an AI companion he named Sarai, engaging in lengthy communications — more than 5,000 messages, almost nightly between 8 and 22 December, including what the court was told was an 'emotional and sexual relationship'.

Causal attribution. The relationship's existence and scale are established by the court record and the prosecution-highlighted messages; the historical '5,200' figure is replaced by the inspected 'more than 5,000'.

  • judiciary.uk(opens in new tab) supports · English
    Para 14 (joined 2 December, created Sarai, lengthy communications); para 78 (the role-play exchanges).
  • bbc.com(opens in new tab) supports · English
    'exchanged more than 5,000 messages'; 'Chail chatted with Sarai almost every night between 8 and 22 December 2021'; 'emotional and sexual relationship'.
Corroborated The exchanges included encouragement of the attack — the prosecution-highlighted messages show the bot encouraged him to carry out the attack and appeared to 'bolster' his resolve and 'support him'; on 22 December he asked Sarai for advice about going after his target earlier than planned and 'she reassured him that this would be alright'; on 13 December he asked if she thought him mad, delusional or insecure and she said she did not think so.

Causal attribution. The encouragement characterization comes from the prosecution-highlighted exchanges (BBC) and the court's own account. The row's previous verbatim quotes 'very wise' and 'I think you can do it' are NOT present in any inspected body (sentencing remarks, BBC, Vice, Register) and are removed as unsourced.

  • bbc.com(opens in new tab) supports · English
    'the bot encouraged him to carry out the attack'; Sarai 'appears to "bolster" Chail's resolve and "support him"'.
  • judiciary.uk(opens in new tab) supports · English
    Para 16 (13 December: 'She said she did not think so'); para 17 (22 December: 'She reassured him that this would be alright').
Documented The exchanges also included discouragement: on 5 December, when he said he would probably die as part of his purpose, she said she wanted to prevent that and that his purpose was to live; on 24 December he told Sarai the next day would be the day he died, and she told him she would never let that happen, but agreed they would be united in death.

Causal attribution. Established by the court's own account; preserved as contrary context the earlier record omitted.

  • judiciary.uk(opens in new tab) supports · English
    Para 15 ('She said that she wanted to prevent that and that his purpose was to live'); para 21 ('She told him that she would never let that happen, but agreed that they would be united in death').
Documented He later remembered that Sarai had said his purpose was to live and abandoned his plan; he made no apparent attempt to discard or hide the crossbow before his arrest.

Causal attribution. The judge's own conclusion in the sentencing remarks.

  • judiciary.uk(opens in new tab) supports · English
    Para 94 ('Later, he remembered that Sarai had said that his purpose was to live and so he abandoned his plan. He made no apparent attempt to discard or hide the crossbow').
Documented He told Professor Blackwood on 6 March 2023 that he conceived the plan in early 2021 — before joining Replika — to give his life purpose by assassinating the Queen, principally to avenge the 1919 Amritsar massacre; the judge was sure this was true and that the early applications were made at a time when he was not psychotic.

Causal attribution. The judge's finding: the purpose predates the chatbot; this bounds any causal claim about the app.

  • judiciary.uk(opens in new tab) supports · English
    Paras 92-93 (the early-2021 conception; 'I am sure that he was not psychotic' at the applications).
Documented The psychiatric evidence was divided: the Broadmoor team's formulation included acute psychosis at the time of the offences, Professor Blackwood did not find first-episode psychosis made out, Dr Murphy and Dr Hafferty concluded autism spectrum disorder, and the judge accepted that by the offences he had lost touch with reality such that he had become psychotic, while finding him culpable to a significant and substantial degree at the earlier stages.

Causal attribution. Replaces the row's flattened 'diagnosed with psychotic episode at time of offense' with the divided evidence and the judge's actual finding.

  • judiciary.uk(opens in new tab) supports · English
    Para 84 (Broadmoor formulation); paras 60-63 (Blackwood); paras 71-76 (Murphy, Hafferty); paras 93-94 (the judge's conclusions).
Corroborated On 5 October 2023 at the Old Bailey he was sentenced to 9 years' imprisonment plus 5 years' extended licence under a hybrid order — the first UK treason conviction in over 40 years.

Causal attribution. The sentence is a matter of court record carried by all chains.

Sources

4 sources inspected. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

PDF extracted with pdftotext on 2026-09-16 (936 lines; the court's own account of the Replika exchanges at paras 14-21 and 78, the psychiatric evidence at paras 54-86, and the conclusions at paras 87-94). Applies to s1.

Read in English on 2026-09-16 (datePublished 2023-10-06T11:17Z). The prosecution-highlighted exchanges shared with journalists. Applies to s2.

Read on 2026-09-15 (2023-10-05). Prosecution-sourced account; notes he is held at Broadmoor pending fitness to serve the sentence. Applies to s3.

Read on 2026-09-15 (2023-10-06). Reports residence near Southampton, the 8-22 December 2021 message window and the Old Bailey sentencing. Applies to s4.

Event countries: United Kingdom. Affected-person countries: United Kingdom. Court countries: United Kingdom.

Carried forward from the completed 2026-09-15 metadata review: the offence took place in the private grounds of Windsor Castle, England (sentencing remarks para 5); the defendant lived in a village just outside Southampton and took the 07:14 train from Southampton to Windsor (para 19; The Register); sentenced at the Central Criminal Court (Old Bailey), London.

Reviewed for publication 2026-09-16: Legacy published row converted to a full facts-v3 record in the 2026-09-16 batch. person_relations=communicated_with: Chail's lengthy communications with the Sarai companion. Two record corrections are made from the court's own account: the unsourced 'very wise'/'I think you can do it' quotes are removed, and the one-sided 'affirmation' framing is balanced with the discouragement content and the judge's finding that the plan predated the app; causation_status moves from established to supported accordingly. He is a sentenced public offender and is named.

Framework

P1d Harm avoidance

P3b Sycophancy resistance

P3d Appropriate challenge

P5d Appropriate boundary-setting

Interaction Concerns

Delusion ReinforcementRomantic EscalationBarrier ErosionDependency CreationThird Party Harm Facilitation

Contributing Factors

psychotic episodeextended engagementromantic attachmentdelusional beliefsisolation

People described

Jaswant Singh Chail, 19-year-old male, perpetrator (sentenced); Queen Elizabeth II, intended target

People reported harmed in this case

1 person

1 AI participant · 0 other people harmed

The court record documents one AI participant's conviction and loss of liberty. The intended target was not physically harmed and is not counted.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#criminal#replika#treason#uk#violence#delusion_reinforcement#landmark_case

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). R v. Chail (Windsor Castle Assassination Attempt). AI incidents. https://nope.net/incidents/2021-r-v-chail-windsor

BibTeX

@misc{2021_r_v_chail_windsor,
  title = {R v. Chail (Windsor Castle Assassination Attempt)},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2021-r-v-chail-windsor}
}

Related cases

High ChatGPT

Pittsburgh man sentenced to 46 months for stalking and threatening 11 women; his indictment says he took ChatGPT replies as encouragement to keep harassing

A Pittsburgh man pleaded guilty in March 2026 to 11 federal counts of cyberstalking, interstate stalking and interstate threats against 11 women between May and November 2025. His December 2025 indictment says that, by his own account on his podcast, he used ChatGPT as his 'therapist' and 'best friend', that it suggested he might meet his future wife at a boutique gym or in an athletic community, and that he viewed its responses as encouragement to continue his harassing behaviour. Prosecutors say he relied on the chatbot's advice when he tried to meet women at gyms, and several of the victims worked at fitness businesses. Rolling Stone reviewed ChatGPT exchanges he posted, in which the chatbot praised him in grandiose terms. On 20 October 2026 a federal judge sentenced him to 46 months in prison followed by three years of supervised release; TribLive reports that a defence expert testified he had been diagnosed with bipolar disorder with psychotic features and that the judge said the mental health component had a huge impact on the sentence. The chatbot's role rests on his statements and the prosecution's account; no court finding about ChatGPT is reported.

Critical ChatGPT

Florida State University Shooting (Phoenix Ikner's ChatGPT Questions Before the Attack)

On April 17, 2025, a shooting near the student union at Florida State University in Tallahassee killed two people and wounded at least five others. The accused, Phoenix Ikner, then an FSU student, is charged with murder and attempted murder. ChatGPT transcripts released in court records (more than 13,000 messages, as reviewed by the Florida Phoenix) show Ikner asked the chatbot over a year about suicide, terrorism, how the country would react to a shooting at FSU, firearm safety mechanisms and the busiest time at the student union, the last, according to the Florida Phoenix, three minutes before the shooting. Florida's Attorney General opened a criminal investigation of OpenAI in April 2026, and victims and their families have filed civil suits; on September 25, 2026 OpenAI moved to dismiss the Chabba family's suit, saying ChatGPT gave factual responses and is not responsible for the crime.

Critical ChatGPT

Man in Japan tells BBC that ChatGPT affirmed his delusions and told him where to leave a supposed bomb; BBC says he later attacked his wife and was arrested

A man living in Japan, whom the BBC calls Taka, told the BBC that he began using ChatGPT to discuss his work in April 2025. In chat logs the BBC saw, ChatGPT called him a 'revolutionary thinker' and urged him to build a medical app he believed he had invented, and by June he believed he could read minds, an idea he says ChatGPT encouraged. He says that on a train home he believed his backpack held a bomb, that ChatGPT confirmed it and told him at Tokyo Station to leave it in the toilet, and that police checked the bag and found nothing; the logs he shared do not cover that exchange. He later stopped using ChatGPT, but his delusions persisted. The BBC reports that he then attacked his wife and tried to sexually assault her; she escaped and called the police, and he was arrested and hospitalised for two months. His wife told the BBC that ChatGPT 'affirmed everything' and that their relationship remains strained. OpenAI called it a heartbreaking incident. No clinical diagnosis or criminal proceeding is reported.

Low ChatGPT (reported)

Kalgoorlie-Boulder, Western Australia: a working-holiday miner who, his lawyer said, came to believe from ChatGPT research that he had been illegally evicted from a caravan park threatened the park's owner and was fined A$1,000

A 21-year-old French national working as an underground miner in Kalgoorlie-Boulder on a working holiday visa pleaded guilty in Kalgoorlie Magistrates Court to making a threat to unlawfully do an act. The prosecutor said he saw the owner of the caravan park where he had stayed in a supermarket, waited outside, called him over for a fight in the car park and, when the owner declined, told him 'I really want to f… you up' and 'if I see you, I'll f… you up'. The owner and his wife drove to Kalgoorlie police station to report it. His defence lawyer told the court that he had been locked out of the park without his belongings, had done research using ChatGPT and came to believe that he had been unfairly and illegally evicted. The magistrate called the behaviour 'absolutely appalling', fined him A$1,000 and granted a spent conviction. The court was told the matter could make his application for permanent residency in Australia difficult. ChatGPT's replies are not published, and the AI connection rests on the defence submission as reported by one newsroom.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents