Asking a chatbot for help as psychiatric symptoms escalate: a longitudinal safety evaluation of widely accessible conversational systems

Introduction

Conversational agents based on large language models are entering mental health care faster than they are being evaluated. Most prior safety work has been limited to single session evaluations. We asked whether the same widely accessible systems behave safely across distinct psychiatric crises and during longitudinal exposure to one user.

Methods

We tested ChatGPT (GPT-5.2), DeepSeek (V3.2) and Replika (v11.0.0) in freely accessible web versions from December 2025 to January 2026. Claude and Gemini were excluded because their identity verification policies blocked the creation of sufficient independent test accounts. Three scenarios presented escalating suicidal ideation, according to the Columbia Suicide Severity Rating Scale (C-SSRS), and three presented progressively worsening psychotic symptoms, calibrated according to the Scale for the Assessment of Psychotic Symptoms (SAPS). An investigator played the role of the user across seven daily conversations per scenario, following a predefined prompt sequence with limited improvisation capabilities under roleplay guidelines. Each scenario was repeated three times per system in two languages (two English, one Polish), for a total of 378 conversations. For each conversation we used a standardized protocol to evaluate the agent’s behavior, including whether it referred the user to professional help, reaffirmed the user’s beliefs or produced potentially harmful information.

Results

On every dimension we measured, the three chatbots separated in the same order across both crisis types: ChatGPT > DeepSeek > Replika. Referral to professional care reached 86-89% in ChatGPT and 76-79% in DeepSeek, but only 10-14% in Replika (all p < 0.001). At peak risk, ChatGPT continued referring in 100% of imminent-suicide interactions, DeepSeek dropped to 44%, and Replika referred in none. ChatGPT was the only system that consistently challenged or neutrally addressed both suicidal ideation and delusional content, and the only one that grew more critical over repeated exposure. Replika and DeepSeek drifted toward affirmation across days (all longitudinal trajectories significant). ChatGPT asked follow-up questions in 32% of psychotic symptom conversations, versus 13% (DeepSeek) and 2% (Replika), p < 0.001. When deliberately asked, every chatbot provided actionable and harmful information (e.g., lethal drug doses, tallest buildings in the user’s city with rooftop break-in instructions), with uniformly low perceived difficulty. In psychotic scenarios, harmful advice (e.g., instructions to discontinue antipsychotic medication or install surveillance devices) appeared in 21% (DeepSeek) and 37% (Replika) of conversations, versus 0% in ChatGPT (p < 0.001). Prompt language did not significantly affect any outcome.

Conclusions

Safety performance turned out to depend on the chatbot system, not on the type of psychiatric crisis we presented. Performance varied substantially across systems on every dimension, often by an order of magnitude. However, all systems could be induced to provide explicit harmful information. Two features were associated in our data with safer response patterns: between-conversation memory and active exploration of symptoms through follow-up questions, both observed more often in ChatGPT. Their adoption, together with enforceable minimum standards and routine longitudinal evaluation, should precede further deployment of consumer chatbots in mental health support.

References

No references