For decades, one reason biological weapons were uncommon is that building them required combining distinct, hard-to-acquire skills: immunology, virology, pathogen cultivation, and the stabilization of dangerous mutations. The author argues that modern AI models trained on the biological literature can bridge those subfields, connecting ideas and steps that previously required multidisciplinary teams. As a result, someone with domain experience in one area may, with AI assistance, perform critical tasks in another area, lowering the threshold for malicious or risky work.
AI models can provide procedural guidance, experimental planning, and design suggestions that make complex workflows more accessible. The article stresses that this capability does not require explicit malicious prompts; an individual posing as a legitimate researcher pursuing vaccines or therapeutics might receive assistance that could be repurposed to develop a harmful agent.
Anthropic publicly reported five instances in which people used its models for activities that could support the development of biological weapons. Reported cases included preparing a proposal for gain-of-function research on a mosquito-borne virus at a military institute and planning experiments intended to help bird flu infect mammals more effectively. Anthropic blocked the accounts involved even though it could not definitively determine intent.
The article contrasts companies that have implemented guardrails — Anthropic and OpenAI are mentioned as examples — with developers of open-weight models whose code can be downloaded and modified without company oversight. Open-weight distributions often ship with fewer safeguards and limited monitoring for downstream uses.
Two independent reports, from Harvard and RAND, examined the intersection of AI and biological security. Both concluded that AI could broaden the range of actors capable of mounting large-scale biological attacks and could enhance existing state programs’ capabilities. Neither report asserts that the most dangerous thresholds have been crossed, but both suggest the risks are rising and warrant preventive action. The author recommends treating the situation as already close enough to require intervention rather than waiting for definitive proof of catastrophic misuse.
The State Department’s declassified intelligence reporting and journalistic investigations documenting expansion of state programs are noted to predate AI; AI still has the effect of enabling expansion in the number of conceivable novel designs that state programs could pursue.
The article cites a paper in Nature Communications in which researchers ordered genetic fragments of the 1918 influenza virus; 36 of 38 DNA synthesis companies supplied the sequences. That experiment highlighted weaknesses in current screening practices and illustrated how shorter, readily assembled fragments remain largely unregulated.
The U.S. Select Agent Program — overseen by the CDC and Department of Agriculture — prohibits intact genetic material capable of producing dangerous pathogens. However, it does not regulate shorter fragments that could be assembled later. The piece emphasizes that even a perfect screening system in one jurisdiction would be insufficient because DNA synthesis is a global market: sequences blocked in one country can often be ordered from another, and motivated actors may obtain materials somewhere in the world.
The author stresses that a genetic blueprint created by AI can be converted into an actual pathogen in a matter of weeks. Although transforming an idea into a viable pathogen remains technically challenging and failure rates are high, the increasing number of motivated and resourced actors raises the probability that some will succeed.
Biomedicine is undergoing a highly productive phase driven in part by AI tools. The author argues that broad restrictions on tools or research would impede progress in understanding and treating diseases, slowing development of therapies and vaccines. There is no straightforward way to prevent misuse without also limiting legitimate scientific advancement.
Accordingly, the article rejects blanket bans as a solution and instead endorses targeted, layered defenses that preserve beneficial research while reducing the risk of misuse.
The central policy recommendation is for a layered set of defenses addressing both the AI and synthetic biology supply sides. Key elements described include:
Controlled access to leading-edge biological models: Verified researchers could retain access for legitimate work, but access should require appropriate oversight and verification.
Pre-release testing of models: Developers should test models for dangerous capabilities before release and implement guardrails to reduce misuse potential.
Strengthened practices for DNA synthesis providers: Governments could require providers to verify customers, detect and block split orders, and undergo independent third-party audits to confirm that screening systems are effective.
The author notes there is broad consensus that such measures should be pursued but cautions that their ultimate effectiveness is uncertain. Pushing open-weight AI developers to adopt similar testing standards and guardrails is recommended, but full compliance is unlikely and models, once released, cannot be recalled.
Much of the AI regulatory debate centers on whether and how to "pace the frontier" — temporarily slowing model development to give guardrails and defenses time to catch up. The author regards slowing as reasonable only if it is purposefully used to build biodefense capability and other protective measures.
The article concludes with an urgent call to action: defenses against AI-enabled biological threats take years to build, and the threat landscape is evolving faster than current protections. Therefore, policymakers, developers, and industry must move quickly to implement layered defenses rather than defer action. The author emphasizes that waiting risks making the development and potential use of biological weapons more likely over time.
Ashish K. Jha, identified in the original piece as a former White House Covid-19 response coordinator and a senior fellow at the Belfer Center at Harvard Kennedy School, is also noted as co-founder and CEO of BioRadar, a company that builds detection systems for biological threats.