“Biosecurity by prompt” suggests that a user can ask an artificial intelligence system for a biological threat and receive a complete answer. That is not an accurate description of present capability. Biological development still depends on materials, suitable facilities, tacit laboratory skill, repeated experimentation and the difficult conversion of a digital design into a viable system. A model response is not a pathogen, and a high benchmark score does not prove that an inexperienced user can complete a dangerous project.

The risk is nevertheless becoming more serious because generative AI is reducing friction across the research process. Frontier systems can synthesise technical literature, explain unfamiliar methods, critique plans, diagnose failures from text and images, write analysis code and interact with specialist software. The United Kingdom’s AI Security Institute reports that leading models have exceeded its biology PhD baseline on private open-ended tests. Its October 2026 ReproBAIT evaluation found that coding agents could reproduce some biological AI tools from published descriptions, although a highly complex system remained beyond them.

Industry assessments point in the same direction without showing that a biological weapon can be produced “from a prompt.” OpenAI treated GPT-5.5 as high capability under its biological and chemical risk framework. Google DeepMind reported that it could not rule out a defined critical threshold for Gemini 4 Argon’s biological information risk before safeguards. Anthropic disclosed five cases of model use that could support dangerous biological development, while stressing that it could not establish malicious intent and that some assistance was clerical or limited. These are warning indicators, not evidence of a completed attack.

The strategic change is threshold erosion. AI can make expertise easier to access, bridge disciplines and help a user recover from mistakes that might otherwise end a project. Connected to search, code execution, biological design tools or automated laboratories, a language model becomes an interface across a fragmented workflow. The threat is greatest not when a novice receives one prohibited answer, but when a capable actor receives persistent help across many individually plausible tasks.

Model refusals are therefore necessary but insufficient. Biology is deeply dual use, and a sophisticated actor can divide work across accounts and providers, disguise intent as legitimate research or use open weight systems outside a monitored service. Governments need defence in depth: standardised and independent pre-deployment evaluations; tiered access, verified identities and proportionate logging for high-risk capabilities; serious-incident reporting; and workable authorisation routes for legitimate science. Controls must also cover synthesis providers, benchtop devices, cloud laboratories, research institutions and funders. The World Health Organization’s new Biorisk Implementation and Evaluation Tool offers countries a practical way to identify governance gaps, but voluntary assessment needs national rules and common standards. Because prevention will never be complete, public-health resilience—including pathogen-agnostic surveillance, rapid attribution and adaptable medical countermeasures—is part of AI governance. The objective is not to suppress AI-enabled biology, but to preserve its benefits while adding friction wherever digital assistance becomes physical capability.

The risk has moved from information access to guided execution

Most biological knowledge relevant to misuse did not originate with generative AI. Scientific papers, databases, textbooks, protocols and specialist software have long been available online. This is why comparisons between a model and an internet search remain essential. If a system merely restates information that a motivated user could find through ordinary research, it may increase convenience without materially changing the threat. The important question is whether it helps a user overcome bottlenecks that previously required judgement, tacit knowledge or collaboration with several specialists.

Generative AI can change that process in four ways. First, it compresses search. A user can ask questions in ordinary language, request comparisons between approaches and receive an organised synthesis without knowing the vocabulary needed to locate every source. Second, it provides continuity. The system can retain the context of a project, identify dependencies and revise a plan as new information appears. Third, it translates across disciplines, allowing a user trained in computation to obtain biological explanations or a laboratory scientist to generate and debug code. Fourth, it can troubleshoot interactively, turning a failed step into a new query rather than a dead end.

None of these functions is uniquely dangerous. They are also why AI is valuable for drug discovery, diagnostics and routine research. Risk arises from their combination and persistence. A single answer may add little. A long sequence of answers can help an actor choose tools, interpret outputs, resolve contradictions and decide what to try next. The system becomes a general scientific adviser available at low marginal cost and at any hour.

The AI Security Institute’s trend data illustrates the shift. Its private biology and chemistry tests contain more than 280 open-ended questions in each field and include experiment design, computational interpretation, laboratory techniques and general knowledge. The institute reports that leading models first surpassed its biology expert baseline in early 2024 and continued to improve. It has also observed progress on multimodal troubleshooting, where models interpret images from laboratory tasks. These results show greater access to expertise, but they do not measure whether a user can complete a dangerous real-world programme.

That distinction should anchor policy. Static knowledge tests can reveal a capability trend, yet they omit procurement, experimental variability, safety constraints and the compounding effect of errors. Laboratory work is not a clean sequence in which every correct answer produces a correct outcome. Reagents vary, equipment behaves unexpectedly and biological systems often fail for reasons that are difficult to infer remotely. A model may appear authoritative while giving advice that is subtly wrong. In benign research, that creates wasted time; in harmful work, it can remain a major barrier. The threat should therefore be framed as reduced friction, not instant capability. AI is most likely to increase the productivity of people who already possess some relevant skill, while also allowing less experienced users to proceed farther before they need expert help. That can enlarge the pool of actors able to explore risky ideas even if only a small fraction can cross the final practical thresholds.

Evidence shows rapid progress but not complete uplift

The public evidence in October 2026 contains an important tension. Earlier international assessments found no clear proof that general-purpose AI enabled malicious users to acquire biological capability beyond what the internet already provided. The International Scientific Report on the Safety of Advanced AI also warned that the evidence base was small and that future systems might provide more consequential assistance, especially in hands-on troubleshooting. That caution remains relevant because capability evaluations can be narrow, sensitive to prompting and difficult to translate into real-world outcomes.

More recent developer assessments show why the issue can no longer be dismissed. OpenAI classified GPT-5.5 as high capability in its own biological and chemical preparedness framework. An external SecureBio evaluation found its pre-release checkpoints among the strongest systems on static biology and biosecurity knowledge, while noting uncertainty about sophisticated planning and safeguard circumvention. Google DeepMind’s October model card for Gemini 4 Argon said expert red-teaming found measurable uplift over web baselines in two biological scenarios and that the company could not rule out its first critical capability level before mitigations. DeepMind nevertheless assessed the safeguarded deployment below that level.

These labels are not interchangeable. Companies define thresholds differently, use different scenarios and have unequal access to test data. Results are also partly self-reported, and public summaries necessarily omit sensitive details. Their significance lies less in any single score than in the convergence of concern: leading developers are now activating stronger biological safeguards because their own evidence no longer supports a comfortable assumption that model assistance is equivalent to ordinary search.

Observed misuse provides another signal, but it requires careful interpretation. Anthropic’s September 2026 threat report described five cases of model use that could support biological weapons development. The company did not claim that the users intended harm, and the dual-use character of the work made intent difficult to determine. In one case, its stronger biological classifier blocked high-risk content and pushed the user towards weaker models, where the estimated uplift was largely clerical. Other cases showed how users could conceal context, distribute work and seek assistance that looked individually legitimate.

The report matters because it moves the debate beyond hypothetical prompts. Actors associated with sensitive research are trying to use frontier systems, evade geographic or account controls and route requests across providers. It also shows the limits of content-only detection. A question about data analysis, grant writing or experimental interpretation may be benign in isolation. The warning emerges from account identity, institutional affiliation, repeated behaviour and the relationship between many requests.

There is still no public evidence that a general-purpose model has independently designed, built and validated a high-consequence biological agent. Capability is not intent, and intent is not successful execution. Governments should resist both complacency and sensationalism. Overstatement can distort research priorities, encourage blunt restrictions on legitimate science and reduce trust in official warnings. Understatement can leave standards and public-health capacity years behind a fast-moving capability curve.

Tool use and automation change the threat model

The greatest policy error would be to evaluate a language model as an isolated chatbot. Frontier systems increasingly operate as agents that can search, write and execute code, call external software and pursue multi-step tasks. In biology, these connections can bridge the gap between general advice and specialist action.

RAND’s June 2026 assessment tested seven large-language-model agents on their ability to select and interact with biological tools. The agents could perform initial engagements that might lower expertise barriers, although the study did not show autonomous completion of an end-to-end harmful workflow. AISI’s ReproBAIT evaluation examined whether coding agents could reconstruct biological AI tools under constrained information and computing conditions. Leading agents reproduced some selected systems with substantial capability, while a highly complex tool remained beyond them. The finding challenges the assumption that managed access to a specialised model is enough if an agent can rebuild a useful approximation from a paper, training data and a software environment.

This creates a diffusion problem. Biological design tools are often protected through controlled interfaces rather than complete secrecy. Academic publication requires enough methodological detail for scrutiny and reproduction. If general coding agents become better at implementation, the distance between a published concept and a working tool shrinks. AISI’s separate research on pretraining-data filtering also found that removing selected biological data could degrade relevant performance while preserving other functions, but that the effect was not durable against fine-tuning with relevant data. Neither access controls nor training-data filters should therefore be treated as permanent barriers.

Automation also changes scale. A human expert has limited time and attention. An agent can compare many candidates, run repeated computational checks and document each step. Even where its judgement remains weaker, volume can compensate for some errors. The risk is not necessarily a brilliant novel insight; it may be the ability to explore a larger search space, discard obvious failures and present a smaller set of options to a human operator.

Physical bottlenecks still matter. Digital designs must be converted into materials, tested in suitable facilities and interpreted through experimental feedback. These steps create opportunities for control. Synthesis companies can screen orders and customers. Cloud laboratories can restrict workflows and retain records. Equipment manufacturers can apply access policies to remotely managed systems. Institutions can require review before higher-risk experiments begin. Yet the chain is becoming more integrated. A model with authorised access to design software, laboratory automation and procurement systems could coordinate tasks that were once separated among people and organisations. Legitimate researchers will demand this integration because it increases productivity. Security policy must therefore attach controls to capability and context rather than banning the connections themselves.

Model safeguards cannot carry the burden alone

Model providers have improved biological safeguards through safety training, specialised classifiers, account controls, monitoring and expert red-teaming. AISI found that successful universal jailbreaks became substantially harder between two rounds of testing, even though skilled evaluators still found one. These measures can block direct high-risk requests, slow unsophisticated misuse and generate signals for investigation. They should be mandatory for frontier systems whose evaluations cross defined thresholds.

They cannot be the entire strategy. First, dual use makes intent difficult to infer from text. The same request may support a vaccine, a defensive study or an offensive programme. A system tuned to reject every potentially relevant query would deny valuable scientific assistance and push legitimate researchers towards less controlled tools. A system tuned primarily for helpfulness may disclose too much when the user supplies a plausible benign explanation.

Second, actors can fragment their activity. Separate accounts can handle literature review, coding, analysis and writing. Different providers can be used for different stages. A user can begin with an open model, move to a commercial service for difficult reasoning and rely on a specialist biological tool for design. No provider sees the whole pathway.

Third, open-weight models cannot be recalled or monitored in the same way as hosted systems. Their scientific benefits are substantial, particularly for reproducibility and local research, but safeguards embedded in training may be altered through fine-tuning. Release decisions for highly capable biological models should therefore consider whether weights create a materially different risk from controlled access, and whether a staged or managed release can preserve research value.

Fourth, safeguards need governance. A developer should not be the sole judge of its own threshold, evaluation method and residual risk. Standardised tests, independent evaluators and confidential access for public authorities can make results comparable. Requirements should cover the strongest internal and deployable versions, including tool-enabled configurations, rather than only the most restricted consumer interface. Developers should report serious incidents and explain how evidence changed the release decision.

Access should become more differentiated as capability rises. Low-risk educational and scientific assistance can remain widely available. Systems that materially improve complex planning, troubleshooting or biological design should require verified users, institutional sponsorship or controlled research environments. Logs should be proportionate, protected from unrelated use and retained long enough to identify cross-session patterns. Appeals and rapid authorisation routes are essential so that security does not become arbitrary exclusion from scientific infrastructure.

Biosecurity needs controls across the whole chain

The most credible response is a layered architecture that assumes individual safeguards will fail. RAND’s defence-in-depth strategy identifies a network of mutually reinforcing mitigations and emphasises that ambiguous signals become more useful when combined across the AI-biology ecosystem. A user probing several models, ordering from multiple synthesis providers and accessing specialist tools may appear ordinary at each node. Together, the pattern may justify review.

The first layer is capability measurement. Governments and developers should agree common biological evaluation categories: expert knowledge, novice and expert uplift, tacit troubleshooting, multimodal interpretation, tool selection, agentic persistence and the ability to reproduce specialist systems. Tests should include realistic time limits and internet baselines, measure both success and error, and examine how performance changes with scaffolding. Results should trigger predetermined obligations, including stronger safeguards, independent review and controlled access.

The second layer is identity and access. High-risk capabilities should not be anonymously available at scale. Providers need reliable customer verification, institutional validation for sensitive access and controls against proxy services that conceal the end user. This does not require every biology question to be tied to a passport. It requires stronger assurance when a user seeks the most capable models, removes safeguards or connects them to consequential tools.

The third layer is monitoring and information sharing. Model companies, synthesis providers, cloud laboratories and relevant authorities need legally protected channels for reporting serious patterns. The focus should be behaviour and risk, not the mass collection of benign scientific activity. Shared indicators can include verified attempts to circumvent biological safeguards, suspicious identity reuse and coordinated probing across services. Independent oversight, defined retention limits and penalties for misuse of monitoring data are necessary to preserve trust.

The fourth layer is synthesis and equipment screening. The United States’ nucleic-acid synthesis framework links federal procurement to providers that screen customers and orders, while a 2025 executive order called for a revised, comprehensive and verifiable approach, including non-federally funded settings. National rules should cover commercial providers and benchtop synthesis devices, use updated methods able to detect both known and predicted hazards, and create a route for legitimate orders that require specialist review. Screening standards should be interoperable internationally so that risky procurement does not simply move to the least regulated supplier.

The fifth layer is institutional governance. Many biosafety and dual-use rules were written before generative AI and automated design. Research institutions should update review processes to ask what models, data and tools are being used, whether external services retain sensitive information and whether automation changes the scale or novelty of the work. Privately funded research should not fall outside enforceable standards. Funders and publishers can require evidence that appropriate review occurred without demanding publication of sensitive technical detail.

WHO’s global guidance treats responsible life-sciences governance as a shared responsibility across governments, researchers, funders, publishers and industry. Its Biorisk Implementation and Evaluation Tool, launched in August 2026, turns that principle into a structured national and institutional self assessment. Countries should use it to map gaps and track progress, but voluntary assessment needs resources, political ownership and connection to regulation. Lower-capacity states will require technical support if global standards are not to become a new scientific divide.

The final layer is resilience after prevention fails. The United Kingdom’s new AI Biosecurity Lab, backed by public funding and model-company commitments, is designed to apply frontier AI to early detection and medical countermeasures. OpenAI’s biodefence plan similarly argues for using advanced systems to strengthen detection and response. These initiatives reflect the essential symmetry of the problem: the technology that may accelerate biological development can also accelerate defence.

Governments should invest in pathogen-agnostic surveillance, secure data integration, microbial forensics, broad-spectrum therapeutics and adaptable vaccine, diagnostic and manufacturing platforms. Public health agencies need access to advanced models before a crisis, not a procurement process after one begins. Systems should be tested in exercises that include ambiguous signals, deliberate deception and simultaneous cyber disruption. The aim is to detect unusual biological events quickly, characterise them without assuming a natural origin and deploy countermeasures fast enough to limit spread.

International coordination is indispensable. Models, code, data and synthetic materials cross borders, while oversight remains national. A common minimum should include frontier-model evaluations, serious incident reporting, synthesis screening, secure access to high-risk biological tools and assistance for biosurveillance. States will not agree on every threshold, but they can agree that a provider should not gain competitive advantage by ignoring a risk another jurisdiction has required its peers to control.