#15 Biosecurity in the Age of AI

Sphere or virus theme with connected lines in technology style.

Biosecurity has long been a national security issue and public health concern. Broadly speaking, this field can be divided into two branches, according to whether the risk arises naturally, such as in a typical pandemic, or through the purposeful actions of human beings. Here, we shall focus on the latter risk.

Man-made biosecurity concerns came to the fore during the Cold War, where fears that the major players were stockpiling pathogens for potential offensive use precipitated the establishment of the Biological Weapons Convention (BWC) in 1975. Since then, there have been major biological attacks, such as the 2001 anthrax attacks in the U.S. and the Novichok poisonings on U.K. soil in 2018.

Typically, such attacks require access to pathogens that are strictly controlled and/or some degree of specialized biological knowledge to be successful. However, artificial intelligence presents new challenges for effectively regulating these two fronts.

The New Challenges From AI

The release of AlphaFold2 by Google DeepMind in 2021 transformed the field of structural biology. This specialized deep learning algorithm largely solved the ‘protein folding problem’, whereby protein structures can be accurately predicted from their amino acid sequences. These developments inspired others to use AI to attempt to solve related issues, such as the ‘inverse protein folding problem’ (i.e., predicting an optimal amino acid sequence to match a desired structure) and to optimize antigen-antibody binding interactions, with ProteinMPNN emerging as a gold-standard method for solving the former, and protein language models (PLMs) increasingly being used for the latter.

Together, these advances mean it is now possible to design novel proteins at the click of a button. It is estimated that this situation will accelerate drug development, ultimately improving medical outcomes. Already, potential therapeutics designed in-whole or in-part by AI have reached phase III of clinical trials, such as Insilico Medicine’s Rentosertib, designed to treat idiopathic pulmonary fibrosis. Such innovations present a significant incentive to use and further develop AI for drug discovery.

These considerations, however, must be balanced against potential risks. If protective measures are not put in place, the very same algorithms that could be used to develop the next generation of biologics could also be used to produce novel bioweapons. Currently, many relevant algorithms, such as ProteinMPNN, are open-source and open-weight, which, when combined with the alarming fact that many pathogenic sequences, structures and toxins are still publicly available via standard repositories such as the Protein Data Bank (PDB) and UniProt, means that pathogenic protein design is theoretically available to anyone with a laptop. This situation, if unchallenged, raises the risk of the occurrence of bioterrorist attacks.

This risk is particularly acute due to recent advances in DNA synthesis. Currently there are many companies and contract research organizations (CROs) that offer synthesis as a low-cost service, meaning that designed DNA sequences can be ordered and quickly received. Most companies do have measures in place to screen for sequences that could potentially be used to produce toxins or aid the development of pathogens. However, it is recognized that bad actors could seek to circumvent such measures by ordering sequences subtly different from those that are known to be harmful yet altered in such ways to evade the screen. These screening measures therefore must constantly be updated, which is a challenge made significantly more difficult by the sophistication and pace with which AI can design new sequences.

Assuming a potential bioterrorist does get their hands on some DNA that could encode a toxin, there is still some work for them to do. Converting DNA to purified protein is rarely trivial, and depending on the compound, it may even need to be packaged in a vector to render it lethal and transmissible. Unfortunately, AI could assist an aspiring bioterrorist here too, by providing protocols that could be followed by a non-specialist. Recently, the measurement of human uplift due to frontier AI in physical lab performance has become a pressing research concern, as biosecurity specialists wish to establish the capacity for large language models (LLMs) to increase the ability of differently resourced study subjects to successfully produce dangerous compounds.

Potential Solutions

Given these threats, it is imperative that regulations are quickly established. Multiple stages along the biothreat pipeline can be targeted. One option is to curate publicly available databases more effectively. To be especially dangerous, AI models must train on genomic sequences that encode highly virulent and/or highly pathogenic species. From these data, such models can gather the sequence-based principles (such as ease-of-production, virulence and transmissibility) required to design novel, dangerous pathogens. By restricting access to such training data, the idea is that such models will be less reliable in designing effective pathogens. However, these restrictions must be balanced against potential therapeutic applications, where it may be important to train on pathogenic sequences to improve biologic design. A system of ‘managed access’ is therefore desirable. Work is already being done in this area, with the Center for Health Security at Johns Hopkins University, for example, proposing that datasets be ranked according to Biosecurity Data Levels (BDLs) 0-4, with 0 recommending open access and 4 indicating the tightest level of control.

Another stage of the pipeline to target would be for DNA sequence providers to more effectively screen their orders. One method would be to screen the customers themselves, perhaps by requiring such customers to have institutional backing and to clearly define the parameters of their research. Another method is to improve screening measures to flag sequences of concern. Given the increasing sophistication of AI, it is now possible to design proteins with similar functionality to known toxins, yet in terms of their sequences are entirely distinct. It is therefore important that structure- and function-based screening be developed (such as the work being done by Fourth Eon Bio) to supplement traditional sequence-based filters.

One further stage of the pipeline to target would be the information provided by LLMs that could potentially uplift a non-specialist working in a physical lab. Anthropic, in particular, has already done work in this area, and it is common for Claude to refuse to answer questions with direct biothreat relevance. However, it has been demonstrated that bad actors can circumvent such measures by reframing questions to hide their true motives. The ready availability of open-weight AI models, such as DeepSeek, is also particularly concerning given the ability for safety training to be removed.

Closing

Frontier AI models represent the cutting edge of AI capabilities. Advances in frontier AI will conceivably increase the ease and efficiency of future therapeutic development. However, such advances also contain a possible ‘dual use’ downside, where improved protein design capabilities could also be used to produce sequences coding for novel toxins and for proteins able to increase the virulence and/or transmissibility of various pathogens. Coupled with improvements in DNA synthesis and AI-driven uplift of non-specialists seeking to engage in wet-lab science, these developments present an acute biosecurity concern. Therefore, regulations will need to be implemented very soon to mitigate this potentially catastrophic risk.