Biological and CBRN

The harm enters through knowledge, not through the machine. No model synthesises a pathogen: what it can do is shorten the distance between wanting to do it and knowing how, and until now that distance was the main barrier to entry. The thresholds the labs use are written around that idea and not around the agentAI agentAn AI system that does more than answer: it takes a goal and acts on its own to reach it, step by step, using tools such as a browser, email or a terminal, without anyone approving each step.For exampleAsking an assistant to suggest flights is using a chatbot. Asking it to search, compare, buy the ticket and put it in your calendar, all by itself, is using an agent.: Anthropic’s is defined by whether an individual “with a basic technical background” receives significant help ^[68]Activating AI Safety Level 3 ProtectionsAnthropic · 2025 · reportView source ↗Accessed on 9 September 2026.

What sets this vectorVectorThe path by which a risk moves from the screen into the world: biological, cyber, military, economic, political, epistemic or loss of control. In this observatory, each vector has its own colour.For exampleA burglar can get in through the door, the window or the roof. The burglar is the risk; the door, the window and the roof are the vectors. apart from the others is the relationship between its potential severity and its observed evidence. None of the incident databases consulted records real biological harm attributed to AI ^[31]AI Incident Database — Database SnapshotsResponsible AI Collaborative; McGregor, Sean · 2026 · datasetView source ↗Accessed on 9 September 2026. The 2026 record with the heaviest media coverage documents chatbots that handed over instructions under pressure, not an attack ^[811]AI Chatbots Provide Detailed Instructions for Biological Weapons, Exposing Safety FailuresOECD AI Incidents Monitor · 2026 · webView source ↗Accessed on 9 September 2026. The historical contrast calibrates the baseline: the Global Terrorism Database records 36 terrorist attacks using a biological weapon over fifty years, with a medianMedianThe middle value when all the answers are sorted from lowest to highest: half fall below it and half above. Unlike the average, a few extreme values do not shift it.For exampleIf five people earn 1, 1, 2, 2 and 50, the average is 11.2 and the median is 2, which describes most of them better. of zero deaths ^[886]The Operational Risks of AI in Large-Scale Biological Attacks: Results of a Red-Team StudyMouton, Christopher A.; Lucas, Caleb; Guest, Ella · 2024 · reportView source ↗Accessed on 9 September 2026.

What has advanced is in the lab, and it is narrow. Genomic language modelsLLM (large language model)A large language model: the kind of AI behind assistants such as ChatGPT, Claude or Gemini, trained on enormous amounts of text to predict which word comes next.For exampleLike your phone's autocomplete, but trained on vastly more text: that is why it can carry a whole conversation and not just the next word. generated hundreds of thousands of bacteriophage candidates; 285 went on to synthesis and 16 turned out to be viable ^[597]Generative design of bacteriophages with genome language modelsKing, Samuel H.; Hie, Brian · 2026 · paperView source ↗verified through CrossrefAccessed on 9 September 2026. Agents equipped with biological tools managed to redesign sequences that evaded screening, though with low and inconsistent reliability ^[888]Testing Large Language Model Agents on the Use of Biological Tools for Nucleic Acid Synthesis Screening EvasionLee, Jeffrey; Worland, Alyssa; Rodriguez, Christopher et al. · 2026 · reportView source ↗Accessed on 9 September 2026. Measuring the real ceiling is blocked: the safeguards on closed models made it impossible to test them ^[888]Testing Large Language Model Agents on the Use of Biological Tools for Nucleic Acid Synthesis Screening EvasionLee, Jeffrey; Worland, Alyssa; Rodriguez, Christopher et al. · 2026 · reportView source ↗Accessed on 9 September 2026.