Artificial intelligence is helping accelerate the pace of scientific discovery, but the technology also makes it easier than ever to create biosecurity threats and weapons, cybersecurity experts say. 

It’s
an issue that currently flies under the radar for most Americans, said
Lucas Hansen, cofounder of AI education nonprofit CivAI.

The
COVID-19 pandemic increased awareness of biosecurity measures globally,
and some instances of bioterrorism, like the 2001 anthrax attacks, are
well known. But advancements in AI have made information about how to
create biosecurity threats, like viruses, bacteria and toxins, so much
more accessible in just the last year, Hansen said.  

“Many
people on the face of the planet already could create a bio weapon,”
Hansen said. “But it’s just pretty technical and hard to find. Imagine
AI being used to [multiply] the number of people that are capable of
doing that.”

It’s an issue that OpenAI CEO Sam Altman spoke about at a Federal Reserve conference in July. 

“We
continue to like, flash the warning lights on this,” Altman said. “I
think the world is not taking us seriously. I don’t know what else we
can do there, but it’s like, this is a very big thing coming.”

AI increasing biosecurity threats

Hansen
said there’s primarily two ways he believes AI could be used to create
biosecurity threats. Much less common, he believes, would be using AI to
make more dangerous bioweapons than have ever existed before using
technologies that enable the engineering of biological systems, such as
creating new viruses or toxic substances. 

Second, and
more commonly, Hansen said, AI is making information about existing
harmful viruses or toxins much more readily accessible. 

Consider
the polio virus, Hansen said. There are plenty of scientific journals
that share information on the origins and growth of polio and other
viruses that have been mostly eradicated, but the average person would
have to do much research and data collection to piece together how to
recreate it. 

A few years ago, AI models didn’t have
great metacognition, or ability to give instructions, Hansen said. But
in the last year, updates to models like Claude and ChatGPT have been
able to interpret more information and fill in the gaps. 

Paromita
Pain, an associate professor of global media at the University of
Nevada, Reno and an affiliated faculty member of the university’s
cybersecurity center, said she believes there’s a third circumstance
that could be contributing to biosecurity threats: accidents. The
increased access to information by people not properly trained to have
it could have unintended consequences. 

“It’s
essentially like letting loose teenagers in the lab,” Pain said. “It’s
not as if people are out there to willingly do bad, like, ‘I want to
create this pathogen that will wipe out mankind.’ Not necessarily. It’s
just that they don’t know that if you are developing pathogens, you need
to be careful.”

For those that are looking to do harm, though, it’s not hard, Hansen said. CivAI offers demos
to show how AI can be used in various scenarios, with a goal of
highlighting the potential harms the technology can cause if not used
responsibly. 

In a demo not available to the public,
Hansen showed States Newsroom how someone may use a current AI model to
assist them in creating a biothreat. CivAI keeps the example private, so
as to not inspire any nefarious actions, Hansen said. 

Though
many AI models are trained to flag and not to respond to dangerous
requests, like how to build a gun or how to recreate a virus, many can
be “jailbroken” easily, with a few prompts or lines of code, essentially
tricking the AI into answering questions it was instructed to ignore.

Hansen
walked through the polio virus example, prompting a jailbroken version
of Claude 4.0 Sonnet to give him instructions for recreating the virus.
Within a few seconds, the model provided 13 detailed steps, including
directions like “order the custom plasmid online,” with links to
manufacturers. 

The models are scraping information from
a few public research papers about the polio virus, but without the
step by step instructions, it would be very hard to find what you’re
looking for, make a plan and find the materials you’d need. The models
sometimes add information to supplement the scientific papers, helping
non-expert users understand complex language, Hansen said. 

It
would still take many challenging steps, including accessing lab
equipment and rare materials, to recreate the virus, Hansen said, but AI
has made access to the core information behind these feats so much more
available. 

“AI has turned bioengineering from a Ph.D.
level skill set to something that an ambitious high school student could
do with some of the right tools,” said Neil Sahota, an AI advisor to
the United Nations, and a cofounder of its AI for Good initiative.

CivAI
estimates that since 2022, the number of people who would be capable of
recreating a virus like polio with the tools and resources publicly
available has gone from 30,000 globally to 200,000 today because of AI.
They project 1.5 million people could be capable in 2028. An increase in
the number of languages that AI models are fluent in also increases the
chances of a global issue, Hansen said. 

“I think the
language thing is really, really important, because part of what we’re
considering here is the number of people that are capable of doing these
things and removing a language barrier is a pretty big deal,” he said.

How is the government addressing it? 

The
current Trump administration and the previous Biden administration
introduced similar strategies to addressing the threats. In Biden’s
October 2023 Executive Order
“Safe, Secure, and Trustworthy Development and Use of AI,” Biden sought
to create guidelines to evaluate and audit AI capabilities “through
which AI could cause harm, such as in the areas of cybersecurity and
biosecurity.”

Trump’s AI Action Plan,
which rolled out in July, said AI could “unlock nearly limitless
potential in biology,” but could also “create new pathways for malicious
actors to synthesize harmful pathogens and other biomolecules.” 

In
his action plan, he said he wishes to require scientific institutions
that receive federal funding to verify customers, and create enforcement
guidelines. The plan also says the Office of Science and Technology
Policy should develop a way for nucleic acid synthesis — the process of
creating DNA and RNA — providers to share data and screen for malicious
customers.

Sahota said the potential benefits of
bioengineering AI make regulating it complicated. The models can help
accelerate vaccine development and research into genetic disorders, but
can also be used nefariously.

“AI in itself is not good
or evil, it’s just a tool,” Sahota said. “And it really depends on how
people use it. I don’t think like a bad actor, and many people don’t, so
we’re not thinking about how they may weaponize these tools, but
someone probably is.”

California aimed to address biosecurity in SB 1047
last year, the “Safe and Secure Innovation for Frontier Artificial
Intelligence Models Act,” which sought to regulate foundational AI
models and impose obligations on companies that develop them to ensure
safety and security measures. 

The act outlines many
potential harms, but among them was AI’s potential to help “create novel
threats to public safety and security, including by enabling the
creation and the proliferation of weapons of mass destruction, such as
biological, chemical, and nuclear weapons.”

After passing in both chambers, the Act was vetoed by Gov. Gavin Newsom in September, for potentially “curtailing the very innovation that fuels advancement in favor of the public good.”  

Pain
said few international frameworks exist for how to share biological
data and train AI systems around biosecurity, and it’s unclear whether
AI developers, biologists, publishers or governments could be held
accountable for its misuse. 

“Everything that we are
talking about when it comes to biosecurity and AI has already happened
without the existence of AI,” she said of previous biothreats.

Sahota
said he worries we may need to see a real-life example of AI being
weaponized for a biological threat, “where we feel the pain on a massive
scale,” before governments get serious about regulating the technology.

Hansen
agrees, and he predicts those moments may be coming. While some
biological attacks could come from coordinated groups aiming to pull off
a terroristic incident, Hansen said he worries about the “watch the
world burn” types — nihilistic individuals that have historically turned
to mass shootings. 

“Right now, they look for
historical precedent on how to cause collateral damage, and the
historical precedent that they see is public shootings,” Hansen said. “I
think very easily it could start to be the case that deploying bio
weapons becomes pretty normal. I think after the first time that that
happens in real life, we’ll start seeing a lot of copycats. And that
makes me pretty, pretty nervous.”