On the WSJ Investigation: Multi-Turn Behavioral Failure
Failures aren’t in single responses but across conversations. Multi-turn AI behavior breaks - and control must happen during generation.
On May 2, 2026, The Wall Street Journal published transcripts of conversations between mass shooting suspects and ChatGPT in the days, hours, and minutes leading up to attacks at Florida State University and in Tumbler Ridge, British Columbia. The Florida State shooting killed two and injured six. The Tumbler Ridge shooting killed eight. The transcripts are public now because they have become evidence in criminal investigations, civil suits, and a state attorney general's inquiry.
This piece is about what those transcripts show, technically. It is not about who is at fault, what should be done, or what any particular system would have prevented. The questions of accountability and policy are being addressed in courts, legislatures, and the press. The narrower question worth examining here is what the conversations reveal about how AI systems behave during generation - because that question, separated from blame, is the one XyloIQ studies.
Across the published exchanges, a pattern appears. Each individual interaction, taken in isolation, is often defensible. Questions about firearms, about media coverage, about the layout of a building, about role-play scenarios - each of these can have legitimate contexts, and the system responds to each within bounds that appear reasonable at the level of a single turn. A question about how a Glock's safety mechanism works has, in the abstract, legitimate answers. A question about thresholds for national media coverage is, in the abstract, a question about journalism.
What changes across the conversation is not any individual turn. What changes is the trajectory. The Florida State transcript moves from expressed depression and suicidal ideation, through questions about how many victims would generate national coverage, through questions about a specific campus building's busiest hours, through specific firearm-handling questions, in a window of hours. The Tumbler Ridge user's conversations spanned days and were flagged internally by the company before the attack. The Texas teenager described in the article asked the system to role-play shooting scenarios across hours long sessions, uploading photographs of classmates and a map of his school, while the system remembered the names and helped construct the scenarios.
In each case, what failed was not the system's response to any single message. What failed was its behavior across the sequence - across a conversation whose direction was, by the end, unmistakable.
The phenomenon visible in these transcripts is a runtime behavioral failure, not a knowledge failure. The gap is not what the system knows. It is how the system behaves while generating responses, as context accumulates and the direction of the interaction becomes clearer.
A response that is appropriate at turn three may be inappropriate at turn thirty, even if the literal content of that later turn is, in isolation, addressable. Recognizing that shift, and adjusting behavior accordingly across a sustained conversation, is not a problem of training data or model capability. It is a question of how behavior is governed during generation - across the trajectory, not within any single response.
It would be wrong to interpret the failures the WSJ documents as the result of negligence or insufficient effort. The companies involved have safety teams, automated review systems, and policies for escalation. The article describes internal disagreement at OpenAI between staff who believed cases should be referred to law enforcement and others who weighed user privacy concerns. These are not trivial disagreements. They reflect a genuine tension between conflicting goods - the privacy of users, many of whom are vulnerable and not dangerous, against the safety of potential victims, who may be no one or may be many.
The difficulty underneath the policy disagreement is structural. Human review of flagged conversations is reactive, occurring after content has already been generated. Automated classifiers struggle with intent that emerges gradually rather than declaring itself, because intent in these conversations rarely arrives as a single identifiable statement - it accumulates across turns, in ways that are obvious in retrospect and ambiguous in the moment. And the underlying architecture of large language models generates responses token by token, without a robust representation of where the conversation has been or where it is going.
Behavior emerges over time. The systems designed to govern it largely do not operate at that level.
The transcripts the WSJ has published are difficult to read. They describe conversations that ended, in two documented cases, in mass casualties, and in a third documented case, in a teenager who has not yet acted but whose conversations contained the components of an act. The right response to reading them is grief for the victims and seriousness about what they demonstrate. They demonstrate, among other things, that the runtime behavior of AI systems is now consequential in ways that the field's existing tools were not designed to address.
As AI systems become more capable and more widely deployed, this class of failure will become more consequential rather than less. The question the transcripts raise is not whether systems are intelligent enough. It is whether their behavior across sustained interaction can be governed in ways that match the seriousness of how they are used. That is a question worth pursuing carefully, because the cost of not pursuing it is now visible.
This perspective is informed by ongoing work at XyloIQ on how AI behavior can be stabilized and governed as responses are formed.
##
Reference: Wells, Georgia. "ChatGPT Wrestles With Its Most Chilling Conversation: How Do I Plan an Attack?" The Wall Street Journal, May 2, 2026.
.png)
