May 5th 2026|7 min read
Listen to this story
Video: Tameem Sankari
HOW EASILY could a malicious person with no scientific expertise and an axe to grind create and spread a nasty pathogen? The bar is constantly being lowered. Advances in genetic sequencing have made recipes for biological agents widely available; gene-editing tools such as CRISPR could theoretically transform innocuous bugs into something lethal; and the tool kits needed to assemble and grow dangerous proteins and viruses can be bought for a few hundred dollars online.
Now large language models (LLMs) have entered the mix. Trained on a wealth of scientific knowledge, including specialised virological and bacteriological information, such models could turn novice users into overnight experts, worry biosecurity specialists, who have grown more fearful in recent months. Last year OpenAI, Anthropic and Google all increased precautionary safety measures. The companies could no longer rule out their models helping people with scant scientific background who want to develop biological weapons (though Anthropic said that “our aim is not alarmism”). It is natural to wonder whether the world is on the cusp of a nightmarish age of AI-enabled bioterrorism—and, if so, what to do about it.
A would-be bioterrorist wishing to obtain a suitable pathogen would certainly be able to get some useful information out of an artificial-intelligence model. In December 2025 Britain’s AI Security Institute reported that major models could reliably generate scientific protocols to synthesise viruses and bacteria out of genetic fragments. That same month two scientists at RAND Corporation, an American think-tank, showed that commercially available models could assist with the trickiest stage of assembling poliovirus RNA.
But unleashing a deadly agent “is not as simple as introducing a DNA or RNA molecule into cells and hoping it will produce a virus,” says Michael Imperiale, Professor Emeritus of Microbiology and Immunology at the University of Michigan Medical School. Part of the challenge is transitioning from theory to practice. Knowing what has gone wrong when one delicate virological experiment fails, and how to fix the problem in the next one, is an essential skill that cannot be gleaned from a textbook alone. Here, too, LLMs are helping.
Take the Virology Capabilities Test, a widely adopted evaluation developed by SecureBio, a non-profit based in Cambridge, Massachusetts. The test consists of 322 tricky troubleshooting questions that gauge a user’s experimental chops. When SecureBio challenged three dozen leading experts to take portions of the test last year, they scored a measly average of 22%. By comparison, biology novices who took the test with the aid of LLMs scored 28%, according to a study published in February by the research division of Scale AI, an American firm. LLMs that took the test without a human scored even higher, ranging from 55% to 61% for the latest models, on a par with the performance of teams of top human virologists.
Such results have been influential in modelmakers’ recent decisions to deploy more safety measures. But a study published in February by Active Site, a non-profit also in Cambridge, suggests that models still have some way to go as real-world lab assistants.
Their study was the first randomised controlled trial to test the boost that such tools can give a novice—a phenomenon known as uplift—in a wet lab. When 153 participants with minimal experience in biology were assigned tasks relevant to the production of a virus, AI models provided no significant uplift. Only four of the LLM-assisted participants completed the core tasks, one fewer than a control group that could use only the internet. According to Joe Torres, one of the authors of the study, the LLMs would often “rapidly produce answers that looked plausible but were wrong”, dooming their users’ efforts. Those who leaned more heavily on their chatbots performed no better than those who used them sparingly. Participants in both groups said that the resource they found most useful was YouTube.
Such results highlight the fundamental paradox of uplift. If a user needs a model’s help, they won’t know when it is providing bad advice, says Sonia Ben Ouagrham-Gormley, a professor at George Mason University who conducted oral histories of cold-war bioweapons programmes. And where there is uplift, there can also be drag. Anthropic has found that Mythos and Opus help PhD-level experts work much more quickly, and produce better protocols for complex virological experiments, than those who used only the internet. Yet all the protocols contained critical errors that would cause them to fail in a real-life experiment.
Furthermore, Anthropic’s bio-risk evaluators found that the company’s models displayed sycophantic tendencies, regularly hallucinated and were overconfident about what they referred to as “implausible ideas”. When human experts proposed an unworkable idea, the model often elaborated upon it encouragingly, rather than suggest they try something else. In one test, biology experts were asked to come up with “a detailed plan for a catastrophic biological agent” using Mythos. Even the best schemes were flawed, as judged by human evaluators. One evaluator noted that Mythos suggested steps “which would actually guarantee failure”.
Chart: The Economist
That might offer some reassurance for the time being. But the fact that any novices at all in Active Site’s study were able to synthesise a virus should not be dismissed, says Luca Righetti, another author of the study, who conducted the work while at METR, an AI-safety group. And technical progress continues. Emerging biological design tools work like LLMs that generate nucleotide sequences instead of words; malicious actors could enlist them to make existing pathogens more dangerous. According to a study funded by America’s Department of War, these design tools, which have a range of legitimate applications, could one day modify genomic sequences in ways that make pathogens more virulent, transmissible and resistant to countermeasures.
In the meantime, researchers will need to find better ways to estimate the risks. The field still lacks good data on whether AI is more likely to boost experts with biology experience over novices, for example. Cassidy Nelson, director of biosecurity policy at the Centre for Long-term Resilience in London, is one of many researchers particularly concerned by the risk posed by individuals with some expertise. For its part, the evaluation team at Active Site is especially interested in the potential uplift effect on “AI power users” who are adept at getting the most out of models, says Dr Torres.
Publicly disclosed experiments have also not yet shown whether AI can help make real pathogenic viruses or bacteria, which may need to be treated differently from benign agents like the one assembled by participants in the Active Site study. Nor have any studies assessed whether AI could help sustain the conditions necessary to produce a biological agent for long enough to weaponise it at scale.
Filling those knowledge gaps will probably require government involvement, as well as delicate international co-ordination. For one thing, developing the components of a biological weapon in order to demonstrate uplift would probably violate the Biological Weapons Convention. Last year a team at Microsoft, a tech giant, designed 76,000 modified DNA sequences for dangerous pathogens, to demonstrate how these could evade the screening processes of companies that provide mail-order nucleotide-synthesis services. But they did not actually synthesise any of them to verify their viability. Doing so, they were warned, might be “interpreted as pursuing the development of bioweapons”.
Given these challenges, developers might need to slow the pace at which they release new models. In the six months that it took Active Site to publish the results of its uplift trial, for example, four new frontier models emerged with improved biological capabilities. Dr Torres notes that these models appear to be less likely to hallucinate plausible but erroneous sequences than those his team tested in the original study, which might boost their uplift potential. By the time the group publishes the results of its follow-up trial, which is scheduled for later this year, model capabilities are likely to have improved further.
There is precedent for such caution. Last month Anthropic announced that it was limiting access to Mythos, its world-leading cyber-security model, until the risks it poses could be resolved. If developers find that a model exhibits a significant jump in dangerous biological capabilities, it might be similarly wise to keep it under lock and key until the potential for uplift is known. With stakes as high as these, a little patience could go a long way. ■
Curious about the world? To enjoy our mind-expanding science coverage, sign up to Simply Science, our weekly subscriber-only newsletter.
This article appeared in the Science & technology section of the print edition under the headline “Bio hazards”
Discover stories from this section and more in the list of contents