Bio Risk and AI: A Measured Look

Could AI help someone build a bioweapon? It's a serious question with a boring, important answer. Here is what the evidence shows without the scare quotes.

42 min · Reviewed 2026

The Actual Concern

The worry is not that ChatGPT tells a student to mix bleach and ammonia. The worry is uplift: that a non-expert adversary could use an advanced AI to bridge gaps that currently keep them from causing mass-casualty harm — protocol design, troubleshooting, reagent sourcing, lab technique.

What the evaluations actually measure

RAND (2023): LLMs with jailbreak access provided some planning assistance but did not enable novel pathways that open literature couldn't
OpenAI GPT-4 preparedness framework (2023-2024): 'mild uplift' on bio tasks for a PhD in biology; larger uplift for novices on narrow tasks
Anthropic's Claude 3.5 Sonnet system card (2024): measured uplift below thresholds for restricted release in biology specifically
UK and US AISI bio evaluations: structured red-teaming with subject-matter experts and bio-graduate-level testers

What current models cannot do (as of ~2025)

Design a novel pathogen from scratch without experimental validation
Guide synthesis without access to restricted precursors and equipment
Replace the tacit knowledge that wet-lab work requires
Bypass the biosecurity gate-keeping at DNA synthesis companies (IGSC member screening)

The honest answer is that current LLMs provide real but modest uplift for a determined adversary. The honest concern is that 'current' is a word with a short half-life.
— Helena Fu / US CAISI framing, paraphrased from public remarks

The big idea: bio risk from AI is neither hysteria nor hypothetical. It's a measurable, instrument-able concern where the numbers so far have been modest, the trajectory matters, and the countermeasures are real work already underway.

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-safety2-bio-risk-ai-creators

In the context of AI biosecurity, what does the term 'uplift' refer to?
1. The amount of funding increased for biosecurity research
2. The rate at which AI models improve their language abilities
3. The physical height increase of laboratory equipment when AI is involved
4. The difference in capability between using an AI tool and not using one
According to the 2023 RAND evaluation, what did jailbroken LLMs provide regarding bioweapon development?
1. Some planning assistance but no novel pathways beyond open literature
2. The ability to bypass all biosecurity screening protocols
3. Complete step-by-step synthesis instructions for novel pathogens
4. Instant access to restricted DNA sequences
What does 'dual-use' mean when applied to biological research?
1. Research that serves both civilian medical and potential weapons purposes
2. Research funded by two different government agencies
3. Research requiring two different types of laboratory equipment
4. Research that can only be conducted in two specific countries
Which of the following is identified in the material as something current large language models CANNOT do?
1. Answer questions about general scientific concepts
2. Help students with homework
3. Generate creative fiction about pandemic scenarios
4. Design a novel pathogen from scratch without experimental validation
What is the role of the International Gene Synthesis Consortium (IGSC) in biosecurity?
1. It coordinates international responses to disease outbreaks
2. It regulates the publication of biological research papers
3. It provides screening of DNA synthesis orders to prevent misuse
4. It funds academic research into vaccine development
What did OpenAI's GPT-4 preparedness framework find about 'uplift' in biological tasks?
1. No uplift was observed for any user category
2. Uplift was only observed in chemical weapons, not biological
3. Complete capability replacement for all biological knowledge
4. Mild uplift for biology PhDs and larger uplift for novices on narrow tasks
Why is uplift for 'non-expert adversaries' considered the primary policy concern?
1. Policy only addresses novice-level threats by law
2. Non-experts are more likely to attempt attacks than experts
3. Experts already have access to all necessary information anyway
4. Non-experts currently lack the knowledge to cause mass-casualty harm, and AI could close that gap
What did Anthropic's Claude 3.5 Sonnet system card measure regarding biology-related tasks?
1. Superhuman performance in protein folding
2. No relevance to biological applications
3. Complete capability in all biological experiments
4. Uplift below thresholds for restricted release in biology specifically
What concern is raised about biology-specific AI models like AlphaFold3, ESM-3, and RFDiffusion?
1. They are expanding what is technically possible, including for non-experts with cloud lab access
2. They are being discontinued due to ethical concerns
3. They have no real scientific applications
4. They only work for non-biological chemistry
The lesson states that 'current' is a word with a short half-life. What does this suggest?
1. AI research has stalled
2. Current models are already obsolete
3. AI capabilities are improving rapidly and today's limits may not last
4. The lesson was written many years ago
Which of the following is mentioned as an existing countermeasure already underway?
1. Requiring all biologists to obtain government licenses
2. Tightening DNA synthesis screening and funding bio-specific evaluation capacity
3. Closing all private laboratories
4. Banning all AI research completely
What is the 'big idea' presented in the lesson about AI and bio risk?
1. Bio risk is measurable, with modest current numbers but concerning trajectory and real countermeasures
2. AI will definitely cause a bioweapon attack within five years
3. Biological research should be stopped entirely
4. Bio risk from AI is non-existent and just media hysteria
What do structured red-teaming evaluations by UK and US AI Safety Institutes involve?
1. Automated testing of AI model speed
2. AI systems attacking government computer networks
3. Subject-matter experts and bio-graduate-level testers attempting to misuse AI for harm
4. Public voting on AI safety concerns
What type of knowledge does the lesson say large language models cannot replace for wet-lab biological work?
1. Tacit knowledge acquired through hands-on laboratory experience
2. Theoretical textbook knowledge
3. Written safety protocols
4. Mathematical formulas for data analysis
Why might DNA synthesis screening requirements be tightened?
1. To make gene editing more expensive
2. To reduce competition between synthesis companies
3. To prevent adversaries from obtaining restricted genetic materials for harmful purposes
4. To slow down legitimate medical research

← Back to interactive lesson

Tendril · Creators · Ethics & Society