Resources
AI-Generated Threat Hoaxes and Swatting: What Changed for Schools
Two federal actions landed eight days apart this September, and together they describe a problem most threat assessment training was not built around. On September 17, the FBI publicly warned that AI image generators are being used to manufacture fake school threats, pointing to a wave of fabricated images targeting schools in Kentucky. On September 25, the U.S. Departments of Education and Justice issued formal guidance to every school and college in the country on swatting: calling in a fabricated emergency to draw an armed police response to a real address.
Neither problem is new. What changed is scale and realism. A threat that used to take some skill to fake now takes a free app and a few minutes, and what it produces can be convincing enough that staff cannot tell by looking.
What the FBI is actually describing
FBI officials have been explicit that most of these hoaxes are not coming from outside actors. According to Christopher Farrell, an FBI Assistant Special Agent in Charge quoted in reporting on the warning, the people posting fabricated threat images to Instagram, TikTok, and Facebook are usually high school students or younger. The content is often crude and absurd: the Kentucky wave used AI-generated images placing the Cat in the Hat around school buildings, implying the character would show up and do damage. Absurd or not, a post like that still names a real school.
The FBI's message to students and families is blunt: a fabricated threat is still a crime. The consequences officials described include criminal charges in state or federal court and lasting effects on a young person's education and career opportunities, regardless of whether the person who posted it meant it as a joke.
What the swatting guidance asks of you
The Education and Justice Departments' letter defines swatting as a false emergency report designed to trigger a police response, and it states that incidents against schools have increased in recent years. The letter does not ask schools to get better at spotting fakes. It asks for the opposite: treat every threat as credible the moment it is received, and sort out authenticity afterward, as a law enforcement question, not an in-the-moment one.
The practical steps it recommends are ones most threat assessment teams can build without new budget:
- Train staff on what a swatting event typically looks like, so the response is recognized and coordinated rather than improvised.
- Build the relationship with local law enforcement before an incident, not during one.
- Run a tabletop exercise so your team has already made the hard calls once, on paper, before they have to make them live.
- Name who owns communication to the campus and to families, in advance.
- Use "Report, Don't Repost": screenshot a threatening post, send it to an adult who can act, and do not share it further. Sharing a hoax image spreads panic and can make the fabrication look more credible than it is.
Where this intersects with what you already know
If your team has been trained in leakage and convergence, something in the federal guidance may look like a contradiction. You have learned to use pattern, specificity, and persistence to sort a genuine warning sign from a moment that will pass. The new guidance says treat every threat as credible on arrival. Those two things are not in conflict. They run on two different clocks.
The immediate safety response, get students secure, verify with law enforcement, follow protocol, runs on the first clock and does not wait for pattern recognition. That part happens the same way whether the threat turns out to be fabricated or real. The threat assessment process, the slower work of understanding who made the threat and why, and what it means about that person's actual risk, runs on the second clock. That is exactly where everything your team already knows about leakage and convergence still applies.
A student who posts an AI-generated threat image, even as a joke that went further than intended, has still produced a data point worth a conversation. Most of the time it reflects poor judgment, not genuine intent to harm. The Secret Service's 2021 analysis of averted plots against K-12 schools found that in every case, tragedy was averted because someone who noticed concerning behavior came forward, and that fellow students were best positioned to notice. The same principle holds here. A single hoax post, on its own, is not evidence of deeper risk. A hoax post from a student who is also showing the other signs your team already watches for is worth exactly the response it always was.
The conversation after the lockdown lifts
Once the immediate response is over and a hoax is confirmed, most schools still have one more job: the conversation with the student who made it, and often with their family. The federal messaging here is worth borrowing directly. This is not framed as "just a joke" territory, and your team should not frame it that way either, because the FBI has been clear that consequences follow regardless of intent. At the same time, your threat assessment team's role is not to replace that accountability process. It is to ask the separate question underneath it: is this behavior part of a pattern, or is it an isolated, serious lapse in judgment from a student with nothing else concerning going on. Both things, discipline and assessment, can happen at once without one undermining the other.
Where to go from here
The real risk this fall is not only that your school might face a hoax. It is that a team without a rehearsed protocol spends the first chaotic minutes deciding how seriously to take something the guidance already answered for you: seriously, every time, as a matter of process, with the harder judgment saved for after everyone is safe.
Sources and further reading: FBI warning on AI-generated school threat hoaxes, as reported by WSAW/Gray Media (September 17, 2026); U.S. Departments of Education and Justice, Guidance to Educational Institutions on Swatting Threats, GEN-26-04 (September 25, 2026); U.S. Secret Service NTAC, Averting Targeted School Violence (2021)