The spread of artificial intelligence worries biosecurity experts, who say the technology could lead to accidental or deliberate creation and release of dangerous diseases and toxic substances. (Photo by LuShaoJi/Getty Images)

Artificial intelligence is helping accelerate the pace of scientific discovery, but the technology also makes it easier than ever to create biosecurity threats and weapons, cybersecurity experts say. 

It’s an issue that currently flies under the radar for most Americans, said Lucas Hansen, cofounder of AI education nonprofit CivAI.

The COVID-19 pandemic increased awareness of biosecurity measures globally, and some instances of bioterrorism, like the 2001 anthrax attacks, are well known. But advancements in AI have made information about how to create biosecurity threats, like viruses, bacteria and toxins, so much more accessible in just the last year, Hansen said.  

“Many people on the face of the planet already could create a bio weapon,” Hansen said. “But it’s just pretty technical and hard to find. Imagine AI being used to [multiply] the number of people that are capable of doing that.”

It’s an issue that OpenAI CEO Sam Altman spoke about at a Federal Reserve conference in July. 

“We continue to like, flash the warning lights on this,” Altman said. “I think the world is not taking us seriously. I don’t know what else we can do there, but it’s like, this is a very big thing coming.”

AI increasing biosecurity threats

Hansen said there’s primarily two ways he believes AI could be used to create biosecurity threats. Much less common, he believes, would be using AI to make more dangerous bioweapons than have ever existed before using technologies that enable the engineering of biological systems, such as creating new viruses or toxic substances. 

Second, and more commonly, Hansen said, AI is making information about existing harmful viruses or toxins much more readily accessible. 

Consider the polio virus, Hansen said. There are plenty of scientific journals that share information on the origins and growth of polio and other viruses that have been mostly eradicated, but the average person would have to do much research and data collection to piece together how to recreate it. 

A few years ago, AI models didn’t have great metacognition, or ability to give instructions, Hansen said. But in the last year, updates to models like Claude and ChatGPT have been able to interpret more information and fill in the gaps. 

Paromita Pain, an associate professor of global media at the University of Nevada, Reno and an affiliated faculty member of the university’s cybersecurity center, said she believes there’s a third circumstance that could be contributing to biosecurity threats: accidents. The increased access to information by people not properly trained to have it could have unintended consequences. 

“It’s essentially like letting loose teenagers in the lab,” Pain said. “It’s not as if people are out there to willingly do bad, like, ‘I want to create this pathogen that will wipe out mankind.’ Not necessarily. It’s just that they don’t know that if you are developing pathogens, you need to be careful.”

For those that are looking to do harm, though, it’s not hard, Hansen said. CivAI offers demos to show how AI can be used in various scenarios, with a goal of highlighting the potential harms the technology can cause if not used responsibly. 

In a demo not available to the public, Hansen showed States Newsroom how someone may use a current AI model to assist them in creating a biothreat. CivAI keeps the example private, so as to not inspire any nefarious actions, Hansen said. 

Though many AI models are trained to flag and not to respond to dangerous requests, like how to build a gun or how to recreate a virus, many can be “jailbroken” easily, with a few prompts or lines of code, essentially tricking the AI into answering questions it was instructed to ignore.

Hansen walked through the polio virus example, prompting a jailbroken version of Claude 4.0 Sonnet to give him instructions for recreating the virus. Within a few seconds, the model provided 13 detailed steps, including directions like “order the custom plasmid online,” with links to manufacturers. 

The models are scraping information from a few public research papers about the polio virus, but without the step by step instructions, it would be very hard to find what you’re looking for, make a plan and find the materials you’d need. The models sometimes add information to supplement the scientific papers, helping non-expert users understand complex language, Hansen said. 

It would still take many challenging steps, including accessing lab equipment and rare materials, to recreate the virus, Hansen said, but AI has made access to the core information behind these feats so much more available. 

“AI has turned bioengineering from a Ph.D. level skill set to something that an ambitious high school student could do with some of the right tools,” said Neil Sahota, an AI advisor to the United Nations, and a cofounder of its AI for Good initiative.

CivAI estimates that since 2022, the number of people who would be capable of recreating a virus like polio with the tools and resources publicly available has gone from 30,000 globally to 200,000 today because of AI. They project 1.5 million people could be capable in 2028. An increase in the number of languages that AI models are fluent in also increases the chances of a global issue, Hansen said. 

“I think the language thing is really, really important, because part of what we’re considering here is the number of people that are capable of doing these things and removing a language barrier is a pretty big deal,” he said.

How is the government addressing it? 

The current Trump administration and the previous Biden administration introduced similar strategies to addressing the threats. In Biden’s October 2023 Executive Order “Safe, Secure, and Trustworthy Development and Use of AI,” Biden sought to create guidelines to evaluate and audit AI capabilities “through which AI could cause harm, such as in the areas of cybersecurity and biosecurity.”

Trump’s AI Action Plan, which rolled out in July, said AI could “unlock nearly limitless potential in biology,” but could also “create new pathways for malicious actors to synthesize harmful pathogens and other biomolecules.” 

In his action plan, he said he wishes to require scientific institutions that receive federal funding to verify customers, and create enforcement guidelines. The plan also says the Office of Science and Technology Policy should develop a way for nucleic acid synthesis — the process of creating DNA and RNA — providers to share data and screen for malicious customers.

Sahota said the potential benefits of bioengineering AI make regulating it complicated. The models can help accelerate vaccine development and research into genetic disorders, but can also be used nefariously.

“AI in itself is not good or evil, it’s just a tool,” Sahota said. “And it really depends on how people use it. I don’t think like a bad actor, and many people don’t, so we’re not thinking about how they may weaponize these tools, but someone probably is.”

California aimed to address biosecurity in SB 1047 last year, the “Safe and Secure Innovation for Frontier Artificial Intelligence Models Act,” which sought to regulate foundational AI models and impose obligations on companies that develop them to ensure safety and security measures. 

The act outlines many potential harms, but among them was AI’s potential to help “create novel threats to public safety and security, including by enabling the creation and the proliferation of weapons of mass destruction, such as biological, chemical, and nuclear weapons.”

After passing in both chambers, the Act was vetoed by Gov. Gavin Newsom in September, for potentially “curtailing the very innovation that fuels advancement in favor of the public good.”  

Pain said few international frameworks exist for how to share biological data and train AI systems around biosecurity, and it’s unclear whether AI developers, biologists, publishers or governments could be held accountable for its misuse. 

“Everything that we are talking about when it comes to biosecurity and AI has already happened without the existence of AI,” she said of previous biothreats.

Sahota said he worries we may need to see a real-life example of AI being weaponized for a biological threat, “where we feel the pain on a massive scale,” before governments get serious about regulating the technology.

Hansen agrees, and he predicts those moments may be coming. While some biological attacks could come from coordinated groups aiming to pull off a terroristic incident, Hansen said he worries about the “watch the world burn” types — nihilistic individuals that have historically turned to mass shootings. 

“Right now, they look for historical precedent on how to cause collateral damage, and the historical precedent that they see is public shootings,” Hansen said. “I think very easily it could start to be the case that deploying bio weapons becomes pretty normal. I think after the first time that that happens in real life, we’ll start seeing a lot of copycats. And that makes me pretty, pretty nervous.”