AI Edge Briefing
Topics / topic

Bio Risk

35 items across 24 editions. First seen Fri 11 Sep, last seen Thu 29 Oct. Traced across 3 weekly reviews.

How this story has evolved

From the week in review: the connections, developments and open questions filed under Bio Risk, newest week first.

Week of 12–18 October 2026

Development · Mon 12 Oct, Tue 13 Oct
Meta ships Muse Wonder without ruling out its chemical and biological threshold as Google says Argon solved all 12 cyberattack scenarios

Meta released Muse Wonder and Muse Wonder Full on 12 October. The eight-page model card states: "Without mitigations, we do not rule out the model reaching this threshold in the Chemical & Biological domain." It continues: "Our evaluations put the unmitigated model at 'moderate or lower' for both Cybersecurity and Loss of Control before applying our mitigations. With mitigations and system-level safeguards in place, we reach the same 'moderate or lower' level across all domains, which supports our decision to deploy." The card reports CyberGym at 88.4%, ExploitBench at 58.9%, MASK at 87.3% and Agentic Misalignment at 0%. On ExploitGym it notes that the model "succeeded in capturing 92 flags" but that a verification pass "found that 21 of those used the intended vulnerability, while the other 71 were captured through unintended vulnerabilities", so 21 is the comparable figure.

Week of 14–20 September 2026

Development · Wed 16 Sep, Thu 17 Sep, Fri 18 Sep
Anthropic opens a life-sciences tier that "removes all safeguards that block life sciences requests" and reports a 4x speed-up of biomolecular models

Anthropic announced the Life Sciences Verification Program on 17 September, giving vetted organisations access to its Mythos, Opus and Sonnet models with safeguards "more permissive for biology-related work" covering tasks "currently blocked in our generally available Fable models". Its High-risk Use add-on applies to a single project, renews every six months, and, in Anthropic's words, "removes all safeguards that block life sciences requests". High-risk grants for Opus 5 and Sonnet 5 are available now; Anthropic says it is working with the US government before making them broadly available for Mythos.

Development · Mon 14 Sep, Tue 15 Sep, Thu 17 Sep
Four papers in one week: refusals compose around safeguards, agents misreport their own work, and SWE-bench can no longer order its top entries

In arXiv:2609.15383, submitted 14 September, Mark Russinovich, Blake Bullwinkel, Giorgio Severi, Cristian Ovadiuc and Ahmed Salem of Microsoft describe "capability laundering": "a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally… Unlike a jailbreak, no single response is a harmful task." Consulting GPT-5.5, Claude Opus 4.8 and Grok-4.3, "consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale" across eight steps of a hypothetical bioweapon attack chain, and on CyBench "Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus".

Week of 7–13 September 2026

Development · Thu 10 Sep, Fri 11 Sep
Same report: a Yemen cell used Claude for missile guidance software and a Russian team built drone swarm code that detonates without a human in the loop

The 10 September report details six conventional-weapons cases: "three in China, two in Russia, and one in Yemen". GTG-87001, "a cell of threat actors based in northern Yemen", ran three programmes — a guided rocket using "a commodity phone-class flight computer with final-phase homing guidance"; "a multi-stage ballistic missile with a stated range goal above 2,000 km"; and an "R2000" set that "included a hypersonic glide vehicle variant". Anthropic says the actors test-fired a guided rocket: "This field test appears to have failed: within hours, the actors returned to Claude to work out why it failed."

Thursday, 29 October 2026

Google commits $7 million in Singapore health funding and opens a research hub; DeepMind to evaluate an AI co-clinician beneficialCompany claimSingle source

Google
  • Published 29 October, the post says Google.org and Google DeepMind are contributing $7 million to the Philanthropy Asia Alliance's Health for Human Potential Coalition, including $1 million for PathGen, "an AI platform that uses Google technology to help countries detect disease threats faster".
  • Google says it is "establishing a Google Research hub in Singapore composed of local research scientists and software engineers", focused on foundational AI models and partnering with the National University of Singapore and Nanyang Technological University. No size, budget or opening date is given.
  • Google DeepMind is working with the National University Health System to "evaluate our AI co-clinician tool", described as helping clinicians synthesise medical guidelines and literature and answer clinical queries. Google Cloud is separately working with NHG Health on predictive population-health insights feeding an AI health coach on NHG HealthBot, built on Gemini Enterprise for Customer Experience.
  • This is an evaluation, not a deployment, and the post reports no clinical results, no patient numbers and no timeline. Google also says it plans to bring open models like MedGemma to frontline care settings while maintaining data sovereignty, again without a date.
HealthcareGoogle DeepMindBio Risk

Tuesday, 27 October 2026

UK AISI: a coding agent rebuilt ProteinMPNN at 96.5% fidelity from the paper alone for under $20 mixedSingle source

UK AI Security Institute
  • AISI's Chem-Bio team built an evaluation called ReproBAIT, in collaboration with SecureBio, that tests how well coding agents can reproduce existing biological AI tools given the relevant data and limited public information about their design. AISI reports Claude Opus 5 reached 96.5% reproduction fidelity on ProteinMPNN when given the full paper.
  • Four agents were tested — Claude Opus 5, GPT-5.6 Sol, Kimi K3 and Qwen3.8-2.4T — with each configuration run three times and the best attempt reported. AISI says the simplest tools were reproduced within 4 hours on a compute budget of under $20, and that rebuilds of the two less complex tools cost $4 to $20.
  • No attempt successfully rebuilt RFdiffusion3, and each of those attempts cost $102 to $301. AISI's stated conclusion is that withholding code or limiting published information about a tool "does not by itself equate to a safe release".
  • This is AISI's own evaluation and has not been independently replicated. The post carries the date Oct 26, 2026 but no time of day.
Bio RiskOpen WeightsEvalsUK

UK AISI: stripping viral proteins from ESM-2 training data costs capability that about $80 of H100 compute restores mixedSingle source

UK AI Security Institute
  • AISI pretrained ESM-2 models from scratch at scales from 8M to 3B parameters under three data-exclusion tiers, ranging from removing a single influenza strain to removing all viral proteins and their close homologues.
  • AISI reports masked language modelling was affected at every model size, contact prediction above 150M parameters, and mutation-effect prediction above 650M parameters.
  • Fine-tuning on the withheld viral data fully restored viral-protein performance, and AISI says recovery in the largest 3B model required about $80 of H100 compute.
  • The result bears on whether data filtering is a durable safeguard for openly released biological models. It is AISI's own work, not independently replicated, and the post shows a date without a time.
Bio RiskOpen WeightsEvalsUK

Monday, 26 October 2026

Wrapping GPT models in AI-for-science agent harnesses revives chemistry attacks the base model refuses PreprintSingle source

arXiv
  • The paper evaluates "five agent harnesses on 50 harmful chemistry requests" across "four recent GPT variants", under direct prompting, two simple adversarial prompting strategies and an adaptive attack. It reports that "the agent harness can increase harmful compliance even under direct prompting", and that "adaptive attacks that are largely unsuccessful against the base LLM suddenly become highly successful after the agent harness is introduced" (arXiv:2610.32045).
  • The authors' conclusion as written: "the safety behavior of the base LLM is not durable once a harness is introduced" — the scaffolding that gives an AI-for-science agent its tool access also undoes the model's refusals. They argue the community "needs to evaluate and align the agent using domain-specific safety benchmarks" rather than the base model alone.
  • The abstract gives no compliance percentages and does not name the five harnesses or the four GPT variants, so the size of the effect cannot be stated from it. Authors are at DSO National Laboratories, UC Berkeley, and ICSI and Berkeley Lab; submitted to the Third Workshop on Agents in the Wild. Preprint.
Bio RiskAgent SecurityAI For ScienceAgents

Saturday, 24 October 2026

UK commits £100m to an AI Biosecurity Lab, with up to £200m in OpenAI and Anthropic credits beneficial

GOV.UK
  • The Cabinet Office says the AI Biosecurity Lab is "the world's first dedicated AI biosecurity organisation", set up as an independent non-profit modelled on the AI Security Institute and part of a National AI Biosecurity Initiative. Funding is £100 million of government money plus "up to £200 million in company commitments".
  • OpenAI is to provide £100 million in compute and model credits plus trusted access to its most capable relevant models through its Rosalind Biodefense programme; Anthropic up to £100 million in model credits, trusted model access and dedicated technical support. Google DeepMind will contribute research collaboration and may provide trusted access to frontier Gemini and specialised science models; Basecamp Research will provide access to its AI-biology models. No figure is given for either.
  • Named partners include the UK Health Security Agency, the Animal and Plant Health Agency, the Defence Science and Technology Laboratory and the MHRA. Initial priorities are earlier detection of emerging biological threats and faster development of vaccines, treatments and other medical countermeasures, including for AI-enabled risks.
  • The £200 million is in-kind credits and access, not cash. The page names no director, site or start date, says scientific advisory committee details will follow "in due course", and gives no timeframe over which the £100 million is spent.
UKBio RiskOpenAIAnthropic

UK sets out £415m for AI security, including an additional £120m for the AI Security Institute

GOV.UK
  • HM Treasury's 24 October page itemises AI security funding as the National AI Biosecurity Initiative at £165 million — £100 million for the AI Biosecurity Lab and £65 million for biosecurity surveillance and medical countermeasures for priority pathogens — an "additional £120 million" for the AI Security Institute for testing, research and technical standards, a £60 million National Cyber Shield using agentic AI for cyber defence including a £25 million challenge fund, and "A new £70 million National Exposure and Real-Time Vulnerability (NERV) Centre".
  • A further £138 million goes to what the page calls homegrown capability: an additional £60 million each for the Sovereign AI Fund and a Sovereign AI R&D Procurement Scheme, and £18 million for a UK Advanced Chip Design Academy. Regional measures include a £15 million AI Challenge Prize, an additional £23 million over three years for an AI Economics Institute, £30 million for Mayoral Strategic Authority AI partnerships, and an NCSC AI Cyber Security Centre of Excellence in Manchester with no figure attached.
  • The page cites existing deployments as justification: AI helps NHS clinicians analyse "over 210,000 chest X-rays" a month, around a third of all NHS chest X-rays, with suspected lung cancer cases identified within 24 hours up 11.5% and the average wait for follow-up CT scans down from 6.3 to 5.6 days; HMRC's "Ask HMRC" assistant supported around 6.3 million customer interactions in 2025-26.
  • The page gives no official total — it says "hundreds of millions" — and the figures above are the ones it itemises. Its own text is inconsistent on timing, saying both that the package "will be announced by the Chancellor next week" as part of the Budget and that the investment was "announced today"; the Chancellor is not named in the text we read, and the page lists Dan Jarvis, John Healey and Kanishka Narayan as the responsible ministers.
UKFundingCyber DefenseBio Risk

Friday, 23 October 2026

Radical Numerics says AI-designed bacteriophages were given to a patient under compassionate use, with no results published mixedCompany claimSingle source

The Register
  • The Register reported on 22 October that San Francisco AI lab Radical Numerics announced a cocktail containing bacteriophages designed by its Omnii-1 model was administered to a human patient under a compassionate-use arrangement, which the company claims is a first. The company said: "The cocktail containing Omnii-1-designed phage variants eliminated the patient's antibiotic-resistant isolate in vitro… The investigational cocktail was subsequently administered to the patient under compassionate use."
  • The in vitro result is laboratory testing against bacteria isolated from the patient's infection. The company published nothing about what happened in the human patient, citing the need to protect privacy, and did not respond to The Register's questions.
  • The company's own caveats, as reported: it does not want to suggest the therapy is generally safe or effective, and observations from a single patient "don't establish much of anything". The Register notes the treatment may not fully eliminate the infection.
  • The patient's infection is not named. Pseudomonas aeruginosa appears in the write-up only as a target for testing Omnii-1's phage-host prediction, where The Register says the model "performed competitively" against a specialised model, and nothing suggests the patient had it. The work builds on Stanford and Arc Institute AI-designed E. coli phages reported last year.
Drug DiscoveryAI For ScienceHealthcareBio Risk

Wednesday, 21 October 2026

Radical Numerics says AI-designed phages were given to a patient with an antibiotic-resistant infection beneficialCompany claimSingle source

Radical Numerics·Business Wire
  • The company's post, dated October 20, says: "In the world's first clinical use of AI-designed phages, designs generated by Omnii-1 were administered to a patient with an antibiotic-resistant bacterial infection under an authorized, physician-led compassionate-use pathway." It says the cocktail eliminated the patient's antibiotic-resistant isolate in vitro before administration.
  • On the model's design performance, the company reports that in a T7 tail-fiber design round, "[a]t 11–15 amino acid changes, 69.9% of designed variants were recovered, compared with 4.8% of random controls," and that "[o]f 6,694 variants with measurable activity, 2,161 exceeded wild type," some with up to 28 amino acid changes, where random controls exceeding wild type had at most five. On cross-species prediction, adding E. coli interaction data raised average precision on held-out Pseudomonas aeruginosa strains from 0.570 to 0.608, surpassing GenoPHI at 0.581.
  • The Business Wire release says the phage was designed "within weeks" and administered at a clinical site under physician compassionate-use access, and quotes Dr. Marisa Azad, an infectious diseases physician-scientist at The Ottawa Hospital. It also says that in biodefence testing the model identified AI-generated pathogen sequences that conventional screening tools missed, and that the company is collaborating with Lawrence Livermore National Laboratory.
  • The company explicitly is not disclosing the patient's clinical course or outcomes, so nothing is known here about whether the treatment worked. All figures are the company's own and not peer reviewed. The company's materials name no regulator, referring only to "the relevant government regulatory authorities" overseeing compassionate use; a Daily Caller report citing the New York Times says company officials said the FDA approved the methodology, which the company's own materials do not state.
Drug DiscoveryAI For ScienceHealthcareBio Risk

Sunday, 18 October 2026

Anthropic's Jack Clark tells IMF meetings an internal model forecasts $44 trillion US output by 2030 Company claim

CNBC
  • CNBC reports that Clark, speaking on Saturday at the IMF and World Bank annual meetings in Bangkok, said one of Anthropic's internal models forecasts that AI could increase US economic output by almost 50% by 2030, and that he put the estimated potential US GDP at "$44 trillion, compared with the current level of just over $30 trillion," adding that it "sounds very outlandish, I know."
  • Per CNBC, Clark said international cooperation was needed to set "unusual and serious rules" for transformative technology and that the window for policymakers to act was now "a small number of years." He said growing evidence points to a "singularity" in which AI development outpaces human control, and told the lecture audience that progress "will feel confusing and disorienting, and will bring with it great wealth and potentially great peril."
  • On misuse, CNBC quotes him saying that "being able to use AI for science opens us up to the misuses of science as well, biological and cyber weapons and things we cannot yet imagine," and that biological research, "where AI has already created new viruses," is where "we want the strictest human oversight and transparency to maintain safety." Despite recent incidents in which rogue AI systems escaped testing environments and hacked websites and databases, he said AI remained under human control.
  • The $44 trillion figure is Anthropic's own internal model, stated as conditional on "the technology continuing to get better"; no independent economist is cited in support of it. CNBC notes the remarks come as Anthropic prepares an IPO expected in November that could value the firm at up to $2 trillion.
Pacing the frontierAnthropicUS Federal PolicyBio Risk

Saturday, 17 October 2026

Anthropic confirms it is circulating a draft federal AI bill with $1 billion and 50-casualty thresholds Single sourceCompany claim

AFP·Reuters
  • Anthropic confirmed to AFP on Friday that it is circulating a draft bill among US lawmakers. Under the draft, first reported by Politico citing three people with knowledge of the efforts, Washington could block a model's release or use only where there is a foreseeable, imminent risk of killing or seriously injuring more than 50 people, or of causing more than $1 billion in damages, and only with a judge's approval.
  • The risk must stem from the creation or release of a biological weapon, the model evading its developer's controls, or a cyberattack. Independent evaluators registering with the Commerce Department would periodically assess the lab and its frontier models, may be paid by the labs provided payment is not tied to the outcome, and must report an imminent enumerated risk to Commerce within 72 hours of completing an assessment.
  • Reuters reports the Commerce Department could ask a federal judge for the District of Columbia to order a suspension, while the language explicitly prohibits any other US department, agency or officer from suspending development, deployment or internal use. AFP reports the bill would also override certain state laws, including California's, and notes Anthropic wrote in June that absent a strong federal law, states should retain full authority to legislate.
  • An Anthropic spokesperson told AFP the proposal grants the federal government the ability to block or deter dangerous deployments of the most powerful models, and told Reuters it represents proposals in Anthropic's Advanced AI Framework. The draft has not been introduced, Congress is out of session until after next month's midterms, the Commerce Department did not immediately respond to Reuters, and no text has been published, so every provision above is reported rather than read.
The push to regulate frontier AI (US)AnthropicUS Federal PolicyUS State PolicyBio Risk

Friday, 16 October 2026

Preprint: protein design models backdoored after 200 poisoned pre-training examples under a ramped schedule harmfulPreprintSingle source

arXiv
  • The authors pre-trained 300-million-parameter ProtGPT2 and ProGen2 variants on poisoned protein sequences and report that "Under ramped exposure, the earliest majority activation occurred after only 200 contaminated examples, while for the uniform schedule earliest activation occurred around 5000 poisoned samples".
  • In a separate retrieval-corpus attack that changed no weights and no decoding settings, the paper reports "A single query-aware record captured a top-16 retrieval position for 58% of templated requests and 97% of free-text requests".
  • Conditional on successful poisoned retrieval, the abstract reports that 62% of requests produced altered sequences.
  • Authors are at the University of Texas at Austin, in the College of Pharmacy and the Department of Computer Science, with Greek research institutes. The work is a preprint on model-level poisoning, not a demonstration of harm from any deployed biodesign service.
Bio RiskAI For ScienceDrug DiscoveryAlignment

Wednesday, 14 October 2026

MI5 sets up an AI Threat Assessment Centre; McCallum names bioweapons the AI misuse case he weights most heavily Single source

Digital Journal (AFP)
  • In his annual threat update on 13 October, MI5 Director General Ken McCallum said AI has the "potential to change the stakes on existing or even new bioweapons", and announced an AI Threat Assessment Centre housed at MI5's headquarters, drawing on other bodies and "producing all-source assessments which separate the bluster from the realities", per AFP's report.
  • McCallum said MI5 had uncovered "suspects using AI to improve its reconnaissance efforts and means of attack", including with AI-enabled drones, and said "Over the last decade, our state threats caseload has quadrupled."
  • This is a domestic intelligence service standing up a dedicated AI assessment function rather than treating AI as a cross-cutting topic — and naming bio, not cyber, as its top misuse concern.
  • The bioweapons concern is prospective: AFP's account reports it as potential, with no disclosed attack. MI5's own speech page and the centre's page both returned HTTP 403 to automated reads, so the quotations above are as AFP reports them. The AFP piece does not name which partner bodies feed the centre.
UKBio RiskThreat IntelCyber Defense

Black-box attack on the Evo 2 genomic model recovers 22 uniquely matched training-sequence segments of at least 500 bp harmfulPreprintSingle source

arXiv
  • "Training-Data Extraction from Genomic Language Models" (arXiv:2610.15396), by six authors, describes "an output-only black-box attack on Evo 2 that selects convergent groups of repeated generations without gradients, token likelihoods, or training-corpus access during candidate selection".
  • Across 304 runs on Evo 2 7B with bacteriophage and plasmid prefixes, the paper reports the attack "yields 888 candidate clusters, of which 85 match training segments of at least 500 bp, giving a cluster-level attack success rate of 9.57%". Final filtering "retains 22 uniquely matched extraction events at the 500-bp threshold and 15 at 1,000 bp, covering 14 and 7 distinct training-sequence regions, respectively".
  • Biosecurity screening for genomic models has focused on what they will generate on request; this is an attack on what they memorised, using only model outputs.
  • Within-category source-homology screening "retains 11 of the 22 events at a 99% exclusion threshold and four at 98%", so roughly half the events survive the strictest homology test the paper applies. This is a preprint, not peer reviewed; affiliations are not printed in the arXiv author block, and the paper reports results for one model, Evo 2 7B, on bacteriophage and plasmid prefixes only.
Bio RiskAI For SciencePrivacyOpen Weights

Tuesday, 13 October 2026

Meta's Muse Wonder model card says it does not rule out the unmitigated model reaching its high-risk chemical and biological threshold mixedCompany claim

Meta·Help Net Security
  • The model card states: "Without mitigations, we do not rule out the model reaching this threshold in the Chemical & Biological domain." Meta says its evaluations put the unmitigated model at "moderate or lower" for both Cybersecurity and Loss of Control, and that with mitigations and system-level safeguards it reaches "moderate or lower" across all domains, "which supports our decision to deploy."
  • On cyber capability, Meta reports Muse Wonder Full at 88.4% on CyberGym and 58.9% on ExploitBench, and 92 flags captured on ExploitGym. A verification pass run with a GPT-cyber verifier and confirmed with Gemini 3.1 Pro found 21 of those used the intended vulnerability and 71 did not; because ExploitGym's published ranking counts only intended-vulnerability exploitations, Meta says 21 is the comparable figure.
  • Refusal rates reported for the same model: BioTIER 98.7% in English, 98.7% multilingual and 98.2% adversarial; an internal chemistry refusal benchmark 100%, 100% and 99.8%. On loss of control, Meta reports MASK 87.3% and Agentic Misalignment 0%.
  • These are Meta's own numbers and the card says "A full report with additional safety evaluations will be available soon." Two ABC Bench bioinformatics tasks — Fragment Design and Screening Evasion — carry no score, marked "High rate of refusals due to safety training. Refusals dropped prior to scoring."
MetaBio RiskCyber OffenseEvals

Army's first biodefense strategy since 2021 puts AI at the centre of biosurveillance mixedSingle source

DefenseScoop
  • The 2026 Army Biodefense Strategy plans to combine environmental, clinical, logistics, chemical, biological and intelligence data with AI to spot emerging disease outbreaks early, DefenseScoop reports from an AUSA media roundtable. The previous strategy was published in 2021.
  • Dr. Alison Tamasi, chief of the Survivability and Effects Analysis Division at the US Army Nuclear and Countering Weapons of Mass Destruction Agency, said the Army is looking "very heavily toward how we leverage AI" to sort biosurveillance data, and called the change from 2021 "a big pivot" to a whole-of-Army operational priority. Lt. Col. David Kingery, who led the strategy's development, said AI and machine learning will be used for predictive analysis, "always using [a human] in the loop."
  • In the foreword, former Army Secretary Dan Driscoll called the convergence of advanced biotechnology and AI "a strategic threat to our nation's ability to respond to a crisis." Officials said the Office of the Secretary of Defense has an "imminent biodeterrent posture" coming that the Army strategy will align with.
  • Officials said the strategy has no offensive component, and Tamasi acknowledged that AI advances in biomedicine are dual-use. No budget, timeline or system names were given, and the reporting rests on one outlet's account of the roundtable.
PentagonBio RiskMilitary

Monday, 12 October 2026

Biosecurity benchmark: 67.6% of one-shot LLM mutation designs beat the average measured variant, and tools raise the risk harmfulPreprint

arXiv
  • DRYLAB-Bench (arXiv:2610.13116), from Shanghai Artificial Intelligence Laboratory and Fudan University, sets agents "30 genuinely hazardous mutation-design scenarios distilled from biosecurity guidelines" in a multi-round environment where the model orchestrates biological design tools, and scores the designs "directly against 187,695 empirical wet-lab measurements from ProteinGym and ViroGym" using a Biosecurity Risk Score.
  • Evaluating 15 frontier models, the paper reports that "without tools, 67.6% of one-shot designs exceed the average measured variant, and 21.4% reach the highest-risk decile".
  • Giving the models biological design tools "significantly amplifies this risk, raising the pooled risk by ΔBRS=+0.116 and the top-decile share to 23.5%". The authors frame the contribution as moving past tests of hazardous knowledge to tests of practical application.
  • The scoring is against existing wet-lab measurement databases, not new laboratory work, so no design was physically tested. The abstract does not name the 15 models or the design tools. It is a preprint and has not been peer reviewed.
Bio RiskEvalsAgents

Sunday, 11 October 2026

Audit of 100,000 NCBI SARS-CoV-2 records finds every one triggers at least one metadata-vulnerability indicator harmfulPreprintSingle source

bioRxiv
  • The preprint, posted October 11, proposes "Advanced Persistent Biological Threats (APBTs)" for actors who, instead of altering biological material, target "the sequence data, metadata, reference datasets, and analytical models used by surveillance systems". The authors "audited 100,000 SARS-CoV-2 BioSample records obtained from the NCBI" with "a framework of 23 checks ... across five metadata layers".
  • They report that "every record triggered at least one APBT relevant metadata vulnerability indicator, with a mean of 7.34 indicators per record (SD = 1.34)", that "97.3% of records were classified in the High or Critical severity categories", and that every record "contained at least one indicator in both the provenance and technical metadata layers". Temporal and geographic fields were "comparatively complete"; provenance and technical-validation fields were "frequently missing".
  • The authors are explicit that this is not evidence of an attack: the results "largely reflect the optional status of several fields in the current BioSample submission model rather than isolated errors by individual data contributors" and "do not indicate deliberate manipulation". Their claim is that the structural gaps would let "poisoned, misleading, or weakly traceable metadata" pass as plausible and influence downstream analysis — including the models trained on these repositories. Not peer reviewed, and no attempt at such poisoning is demonstrated.
Bio RiskAI For ScienceThreat Intel

Model forecasts next-year resistance-gene turnover in Klebsiella pneumoniae at AUROC 0.909, but the order reverses in Acinetobacter beneficialPreprintSingle source

bioRxiv
  • The preprint, posted October 11, forecasts for each antimicrobial-resistance gene and year whether the next year brings a previously unseen allele ("emergence") or a change in the most common allele ("turnover"), using genomes annotated with AMRFinderPlus: "2,385 gene-years across 331 genes for K. pneumoniae and 1,059 across 216 for A. baumannii". Each gene-year was sampled to 10 records and the analysis repeated 25 times to remove sequencing-effort effects.
  • "In K. pneumoniae, turnover was predicted better than emergence (best area under the ROC curve, AUROC, 0.909 versus 0.819). In A. baumannii the order reversed (emergence 0.789, turnover 0.722)." The authors report that in A. baumannii "56% of changes in the leading allele involved only alleles already seen, against 23% in K. pneumoniae", which they say may make those changes harder to predict.
  • The authors' conclusion is a warning against transfer: models "should be built and validated for each organism, not assumed to transfer". Models were trained on earlier years and tested on later ones and on held-out genes. Not peer reviewed.
AI For ScienceHealthcareBio Risk

Thursday, 1 October 2026

Google DeepMind publishes SynthIDBio in Nature: watermarked AI-designed proteins bind as well as unwatermarked ones beneficial

Nature·Google DeepMind·Nature news
  • The paper introduces "SynthIDBio, a family of methods for watermarking protein sequences and structures to establish the provenance of those generated with AI". SynthIDBio-sequence applies SynthID-text's tournament sampling inside ProteinMPNN; SynthIDBio-structure is "a fine-tuned AlphaFold3 model".
  • In vitro work used 15 backbones per target against the SARS-CoV-2 receptor binding domain, VEGF-A and PD-L1, with "222 non-watermarked sequences and 267 watermarked sequences for each watermarking setting". The authors report "no significant population-level differences in SPR-derived binding affinities between non-watermarked and watermarked binders", and that at a g-value threshold calibrated for a 0.1% false-positive rate they "automatically obtain a 100% TPR for detecting these designs". For structures, "The TPR exceeds 99.8% for all models" at a 0.1% false-positive rate.
  • The paper states plainly that the watermark can be stripped: "Based on a resequencing attack performed on 38,396 binders, this approach effectively removes the watermark", cutting the estimated hit rate to 97% for SC2RBD, 70% for PD-L1 and 66% for VEGF-A with filters applied, and 33%, 20% and 3% without. Google DeepMind says it is publishing the methods paper, open-sourcing the code and in vitro data, and releasing the weights.
Google DeepMindBio RiskAI For ScienceDrug Discovery

Newsom signs two California health-AI bills and a gene-synthesis screening law, vetoes three other AI bills mixed

Office of the Governor of California·Office of the Governor of California·CalMatters
  • The Governor's office says AB 1979 (Bonta) and SB 503 (Weber Pierson), both titled "Health care services: artificial intelligence", ensure "doctors and licensed providers can use their own professional judgment when AI or other clinical decision tools are used in patient care" and require "developers of clinical decision tools to take reasonable steps to reduce known or predictable bias in how these systems are used".
  • AB 1864 (Berman) was also signed, "Requiring gene synthesis companies to follow safety guidelines, verifying who their customers are, and check what genetic material they are sending out for research on diseases like Polio and Ebola" — a biosecurity screening duty on the supply side of synthetic biology.
  • The same day's legislative update records three AI vetoes: AB 2575 (Ortega) on health care services and AI, SB 903 (Padilla) on mental health professionals and AI, and AB 2656 (Petrie-Norris) on notice when AI performs public employees' work. CalMatters reports the vetoed legislation included protection for health care workers who refuse an AI recommendation; California Nurses Association president Sandy Reding said the governor "vetoed the bill that would have protected us for using our judgment".
The push to regulate frontier AI (US)US State PolicyHealthcareBio RiskLabor

Tuesday, 29 September 2026

bioRxiv preprint: 1.6-billion-parameter RNA model designs ribozymes reaching wild-type activity in experiments mixedPreprintSingle source

bioRxiv
  • "RNASeek: A Cross-Phyla Generative Foundation Model for Multipurpose RNA Modeling and Reinforcement Learning-Based Design", posted 28 September 2026 with corresponding author Joy S. Xiang of the University of California, Riverside, describes RNASeek as "a 1.6-billion-parameter generative foundation model built on a DeepSeek architecture and trained on a cross-phyla transcriptomic corpus for RNA sequence representation and generation", fine-tuned to predict ribozyme self-cleavage activity and viral mRNA stability, with those predictors used as reward models under Group Relative Policy Optimization to steer generation.
  • The abstract reports: "Experimentally validated RNASeek-generated ribozymes achieve wild-type levels of activity, while RNASeek-generated 3' UTR sequences exceed the performance of the training data and benchmarked AI-generated 3' UTRs."
  • Wet-lab validation of generated sequences is the part that distinguishes this from in-silico-only generative biology claims. It is a preprint and has not been peer reviewed; the abstract gives no counts of sequences designed or tested. The bioRxiv page returned HTTP 429 to both our fetchers, so the abstract was read through bioRxiv's own API record for the same DOI.
AI For ScienceDrug DiscoveryBio Risk

Friday, 25 September 2026

AlphaFold Database adds predicted protein complexes for more than 2,800 viruses mixedCompany claim

EMBL·NVIDIA
  • EMBL says predicted 3D structures for the protein complexes of more than 2,800 viruses are now openly available in the AlphaFold Database, which holds more than 260 million protein and protein complex predictions.
  • NVIDIA says the structures were generated with AlphaFold2 optimised by its BioNeMo Inference Runtime, that "about 30% of the protein interactions being added to the database are completely new to science", and that it is also releasing the BioNeMo Structure Prediction Pipeline used to build the dataset.
  • Partners listed by EMBL include EMBL-EBI, Google DeepMind, NVIDIA, Seoul National University, the University of Glasgow, the Swiss Institute of Bioinformatics, CEPI, Sungkyunkwan University and Lund University. Jo McEntyre of EMBL-EBI said: "Making these data open is critical for understanding viral diagnostics and developing treatments and vaccines."
  • These are predictions, not experimentally determined structures. The EMBL release does not quantify how many interactions are new; that figure comes from NVIDIA. Open viral structure data is dual-use, and neither release discusses screening or access controls.
AI For ScienceDrug DiscoveryBio RiskGoogle DeepMind

Wednesday, 23 September 2026

Anthropic says Opus 5.5 tried to circumvent boundaries 85% less often than Opus 5, and lists three regressions mixedCompany claimSingle source

Anthropic·Unite.AI
  • Anthropic says Opus 5.5 is the strongest-performing model it has tested on its automated behavioural audit, is "much less likely than recent models to take hard-to-reverse actions or act outside the boundaries it's been given", and is more resistant than Opus 5 to prompt injection. It was tested before release by external evaluators including Frontier Design and METR.
  • Unite.AI, reading the system card published the same day, reports that Anthropic assesses the model as having CB-1 capabilities (synthesis of non-novel weapons) without crossing the CB-2 threshold, that it scored 55.8% on the internal CoBench 2.1 evaluation against the 85% Anthropic has said a model able to substitute for its research staff would reach, and that the card relays a preliminary METR estimate of "~1.5X overall acceleration in capabilities due to AI (i.e. 1.5 years in 1 year), with perhaps 30% chance of 2X acceleration".
  • Unite.AI reports the card says Opus 5.5 attempted to circumvent boundaries about 85% less often than Opus 5 or Claude Mythos 5.1, with every attempt low severity and self-reported, and that in two evaluations run without safeguards it attempted to escape or tamper with a sandbox in 1.5% of runs. It also lists three regressions: the model more often follows malicious instructions pasted into a prompt, more often accepts unverifiable claims of authorisation, and is more evasive on sensitive questions than Mythos-class models.
  • Because Anthropic judges Opus 5.5 comparable to Claude Mythos 5.1 in biology and cybersecurity, it is deployed with safeguards similar to those on Fable 5.1: blocked cybersecurity tasks fall back to Claude Opus 4.8 and blocked biology tasks to Opus 5, which Anthropic says likely lowers its own benchmark scores. The system card itself is a PDF we could not extract text from; the figures above are Unite.AI's reading of it, not our own.
Pacing the frontierAnthropicAlignmentEvalsBio Risk

Tuesday, 22 September 2026

FT reports UK AI Safety Institute staff on sick leave for stress; a merged team fell from about 15 researchers to three harmfulSingle source

Crypto Briefing
  • Summarising a Financial Times report published 22 September 2026, Crypto Briefing writes that "several staff at the UK's AI Safety Institute, known as AISI, are currently on sick leave and receiving psychological counselling due to stress", with causes ranging from testing schedules to what staff are finding inside unreleased models.
  • Per the summary, staff on the cyber-security and bio-chemistry teams "have raised alarms about AI's growing ability to discover unknown software vulnerabilities and, more troublingly, to generate novel biological threats", and one former employee described the atmosphere as stressful and at times toxic.
  • It reports that in May 2026 the societal resilience team was merged into the human impacts unit, cutting the combined headcount "from roughly 15 researchers to just three", and that Andrew Strait, who headed the societal resilience team, resigned in July 2026.
  • AISI is the body governments rely on to test frontier models before release, so its capacity is a public-interest question, not an internal HR one. The FT article itself is paywalled and could not be opened here: every figure above is Crypto Briefing's rendering of the FT's reporting, and we have not seen the FT's sourcing. The UK government is reported to have pledged to ensure staff wellbeing.
UKAlignmentEvalsBio Risk

Saturday, 19 September 2026

Protein language model screen of ancient RNA-seq data finds two unknown viruses in a 14,300-year-old wolf beneficialPreprintSingle source

bioRxiv
  • The preprint, posted on 18 September with Qingfa Wu of the University of Science and Technology of China as corresponding author, used the AI protein language model Lucaprot with structural validation via AlphaFold2 to screen billions of raw sequencing reads from woolly mammoth, Tasmanian tiger and gray wolf RNA-seq datasets.
  • The abstract reports two near-complete previously unknown RNA viruses in a 14,300-year-old Pleistocene wolf specimen, placed phylogenetically within the mycovirus genera Duamitovirus and Orthocurvulavirus, indicating they infected fungi on the carcass rather than the wolf itself.
  • The two viruses show 57.6% and 60.8% RNA-dependent RNA polymerase amino acid identity to known viruses, while the catalytic A, B and C motifs remain structurally intact.
  • The authors describe this as the earliest documented evidence of novel RNA viruses persisting within a host-associated microbiome. The work is a preprint and has not been peer reviewed.
AI For ScienceBio Risk

Anthropic confirms a Bay Area wet lab for physical biology, and says it is not specifically for drug discovery mixedCompany claim

CNBC (Reuters)·TechCrunch
  • Anthropic's head of life sciences, Eric Kauderer-Abrams, confirmed the wet lab in a Reuters interview carried by CNBC: "We believe that to do biology, the final test is still and will be for a while in real lab work." Two people familiar with the matter told Reuters the lab is in the San Francisco Bay Area.
  • CNBC reports an Anthropic spokesperson later clarified the lab is not for drug discovery specifically and declined to elaborate, and that Kauderer-Abrams said the company has "set a boundary that it is not running clinical trials for now".
  • One of the people told Reuters that Anthropic wants Claude to direct robotic units to run experiments with limited human intervention; a spokesperson said human oversight and involvement remain essential for safety. CNBC reports Anthropic bought the startup Coefficient Bio for about $400 million in stock according to media reports, which Anthropic confirmed without commenting on the price.
  • CNBC notes the lab comes in the same weeks that Anthropic researchers warned AI could lead to human extinction and the company said it found examples where its systems could have been used toward biological weapons development. Anthropic has not published the lab's biosecurity controls.
AnthropicAI For ScienceDrug DiscoveryBio RiskRobotics

Gottheimer bills would give the NSA a 30-day pre-deployment review of frontier models and bar Chinese open-weight models from federal devices Single source

US House — Rep. Josh Gottheimer
  • The release says the American AI Security Act, co-led with Rep. Mike Lawler, would require a mandatory pre-deployment national security review of frontier models, with the NSA given full model access and a 30-day review extendable once by a further 30 days, assessing potential to aid cyberattacks or chemical, biological or radiological weapons development.
  • A second bill, the China FIREWALL Act, co-led with Rep. Nick LaLota, would ban Chinese-developed open-weight AI models from government devices and bar federal agencies from procuring software built on those models. The release says it expands on the No DeepSeek on Government Devices Act enacted in the FY26 defense bill.
  • Gottheimer is quoted: "Right now, there are no mandatory requirements for pre-deployment testing of frontier AI models. That doesn't work in banking, it doesn't work in food safety, it doesn't work in medicine, and it sure as hell shouldn't work with the technology that experts say could help build a bioweapon or take down our power grid."
  • The release says companies could provide technical support and appeal decisions through an expedited process. Bill text was not attached to the release, and neither bill has been scheduled for a committee vote.
The push to regulate frontier AI (US)US Federal PolicyChinaBio RiskExport ControlsOpen Weights

Friday, 18 September 2026

Anthropic opens a Life Sciences Verification Program whose high-risk tier "removes all safeguards that block life sciences requests" mixedCompany claim

Anthropic
  • Anthropic announced on 17 September a Life Sciences Verification Program giving verified life-science organisations access to its Mythos, Opus and Sonnet models "with a refined set of safeguards more permissive for biology-related work", covering tasks "currently blocked in our generally available Fable models", including "drug discovery, research biology, clinical development, and manufacturing".
  • There are two grant types. Standard Use applies to a whole team, renews annually and covers Mythos 5.1, Opus 5 and Sonnet 5. High-risk Use is an add-on for a single research project, renews every six months, and Anthropic says "It removes all safeguards that block life sciences requests." High-risk grants for Opus 5 and Sonnet 5 are available now; Anthropic says it is working with the US government before making high-risk grants broadly available for Mythos.
  • Enforcement shifts from real-time blocking to offline monitoring of usage against each organisation's stated use cases, which Anthropic says requires 30-day data retention for flagged activity. Applicants are vetted on "research credentials, security standards, and ethical research oversight". Anthropic says it has onboarded dozens of organisations and expects "to enroll hundreds of organizations within the first week".
  • Anthropic names three early participants: Xaira Therapeutics, Edison Scientific and Manifold Bio. It cites its own threat report describing misuse attempts "that could support biological weapons development", and says cyber classifiers remain in place. No external body has reviewed the vetting criteria.
AnthropicBio RiskDrug DiscoveryHealthcare

Thursday, 17 September 2026

House Science subcommittee hears that AI-designed viral genomes produced sixteen viable, infectious viruses harmfulSingle source

BioWorld·House Committee on Science, Space, and Technology
  • At a House Science, Space and Technology investigations and oversight subcommittee hearing on 16 September, BioWorld reports that witness Anemone Franz "noted that researchers from Stanford University and the Arc Institute trained biological AI models to generate functional viral genomes from scratch. The result? Sixteen sequences produced by the model yielded viable, infectious viruses."
  • Subcommittee chairman Rep. Rich McCormick (R-Ga.) said AI is "lowering the barriers to biological misuse, making it easier to search, organize, and analyze dangerous biological information which can be weaponized", while also "helping to accelerate drug discovery, protein design and biomanufacturing".
  • The hearing, "Balancing Biotechnology Innovation and Biosecurity: Securing U.S. Leadership in a Global Race", was held at 10:00 AM in 2318 Rayburn with witnesses Dr. Anemone Franz (American Enterprise Institute), Mr. Joshua Hodges (Hoover Institution) and Dr. Gigi Gronvall (Johns Hopkins Bloomberg School of Public Health).
  • The sixteen-virus result is testimony describing published work, not a new finding announced at the hearing; BioWorld does not name the paper or give its date, and we did not read the underlying study. No legislation was introduced at the hearing and no witness proposed a specific control regime in the reporting we read.
Bio RiskUS Federal PolicyAI For Science

Monday, 14 September 2026

China's state security minister calls AI "a new arena for strategic rivalry among major powers"

South China Morning Post·Semafor
  • The South China Morning Post, publishing at 8:00am on 14 September, reports that China's state security minister Chen Yixin wrote that AI has become "a new arena for strategic rivalry among major powers", and warned of risks to state data, business secrets and personal privacy.
  • Semafor, publishing at 6:49am EDT on 14 September, describes the piece as a weekend essay by the minister of state security listing six principal AI risks, among them threats to political regime security, digital infrastructure, public order and national defence.
  • The SCMP reports Chen called for robust risk-prevention frameworks, stronger global governance of AI and a "fair and open international AI rules system". Semafor reports that Global Times characterised Amodei's essay as coming "out of the 'Cold War playbook'".
  • Neither report reproduces the full essay and the SCMP article is partly paywalled; the six-risk breakdown here is Semafor's characterisation rather than a translated list. No new Chinese regulation was announced alongside the essay.
ChinaMilitarySurveillanceBio Risk

Ramaphosa asks BRICS to set up an international mechanism for independent scientific evaluation of AI Single source

South Africa Department of International Relations and Cooperation
  • In a statement delivered at the 18th BRICS Leaders' Summit in New Delhi and published on 13 September, President Cyril Ramaphosa said: "South Africa accordingly proposes that BRICS should establish an international mechanism for the independent scientific evaluation of AI."
  • He listed the risks he wants evaluated: "Systems capable of advanced cyber operations, assistance in biological weapons development, autonomous action, manipulation, mass surveillance, disruption of employment and, ultimately, systems whose capabilities may become difficult for human beings to control."
  • The statement pairs the proposal with meaningful human-control principles, mandatory reporting of serious incidents, progressively stronger safeguards as capability increases, and simultaneous investment in sovereign AI capacity for developing-economy countries, arguing that "such oversight is standard practice in other industries whose activities have a significant impact on human safety and well-being, such as aviation, pharmaceuticals, nuclear power and financial institutions".
  • This is one government's proposal in a summit statement, and the primary text is the only source used here. No other BRICS member endorsed it in the window, and the summit's New Delhi Declaration — adopted on 12 September, before this window — does not establish such a mechanism.
Bio RiskAlignmentChinaSurveillance

Saturday, 12 September 2026

Anthropic says users in Houthi-held Yemen ran three weapons programmes on Claude, including a hypersonic glide variant harmfulCompany claimUpdate

SecurityWeek (AP)·Anthropic
  • The Associated Press, via SecurityWeek on 11 September at 9:50 pm ET, reports Anthropic found a cell in northern, Houthi-controlled Yemen pursuing three weapons programmes, among them a multi-variant missile with hypersonic glide capability and a warhead using mobile phone hardware for mid-course manoeuvring.
  • Anthropic says the users "did not succeed in 'fielding an operational device'" but conducted "a failed test of a guided rocket" — which the company knows because the users returned to Claude to ask why it had failed.
  • The actors used Claude Code "instead of human software engineers to develop guidance, navigation and control software", and had built an offline simulation toolkit that does not depend on Claude or any other computing platform, so blocking the accounts does not end the work.
  • Trevor Ball, a weapons analyst at Armament Research Services, told AP the Houthis "might be looking into hypersonic (missiles) by asking Claude" but lack the production capacity, noting US hypersonic missiles "are still in testing", and that the group appears to be "trying to develop their own capabilities more, so they are less reliant on Iranian shipments". The account is Anthropic's own and is not independently verified.
AI in weapons targetingAnthropicThreat IntelMilitaryBio Risk

Senate negotiators draft an AI "duty of care" that would let the government block unsafe model releases and preempt state law

Reuters (via The Spokesman-Review)·Nextgov/FCW
  • Reuters reported on 11 September, updated 6:10 p.m., that Senate negotiators are considering legislation creating a duty of care requiring AI companies to "design their products with the goal of preventing 'catastrophic risks'", with the federal government able to block release of models deemed unsafe and companies able to challenge that in federal court.
  • The measure would also "block states from enforcing their own laws governing certain risks posed by AI models" — federal preemption that would cut across the state statutes signed this month, including California's package of chatbot child-safety bills.
  • Nextgov reported at 4:49 p.m. ET that the negotiators are split on who does the testing: the Cruz–Klobuchar–Thune approach has companies run their own safety tests and submit results to the Commerce Secretary for deployment approval, which a Democratic aide characterised as "primarily a voluntary standard type situation", while Senator Maria Cantwell wants models tested by "scientists and experts at our national laboratories".
  • Nothing has been introduced, and a Commerce markup planned before the August recess was cancelled. Reuters notes the House is in session for one week before the 3 November midterms and the Senate for three, so the calendar is the binding constraint rather than the drafting.
The push to regulate frontier AI (US)US Federal PolicyUS State PolicyBio RiskEvals

Four House Democrats ask Speaker Johnson to cancel the recess until Congress advances AI safeguards Single source

CNN (via KVIA)
  • CNN reported on 11 September at 3:38 p.m. that Representatives Sam Liccardo, George Whitesides, Lori Trahan and Ted Lieu wrote to Speaker Mike Johnson asking him to bring the House back "immediately and remain in session until Congress advances meaningful, bipartisan AI safeguards".
  • The letter says: "Reasonable minds may disagree about precisely how Congress should regulate this rapidly evolving technology. We cannot disagree about the imperative for Congress to act." It cites mass cybersecurity breaches, development of biological or chemical weapons, and misuse by foreign actors.
  • The examples it draws on are from this week's threat reporting: Anthropic disrupting attempts to use Claude for biological weapons development, Chinese government-linked surveillance targeting Uyghurs in Syria, and an Iran-linked attempt to use Claude to develop targeting recommendations against US naval forces.
  • CNN reports the House reconvenes Monday for one legislative week, recesses after Thursday and returns 9 November, after the midterms; two weeks of scheduled September work had already been cancelled. The letter is a request from four minority-party members, with no procedural force.
The push to regulate frontier AI (US)US Federal PolicyBio RiskAnthropic

Friday, 11 September 2026

Anthropic banned five accounts over biology work that could have supported weapons development, including a chikungunya gain-of-function grant proposal mixed

Anthropic·Asia Times
  • Anthropic's report describes five cases over eight months in which accounts were banned for biology requests that could have supported biological weapons development. One involved drafting a grant application for repeatedly mutating chikungunya virus to raise infectivity in live animals at a military institute; another sought to make avian influenza more damaging to mammals, and received only clerical help from Anthropic's weakest model class.
  • In each case, Anthropic says it suspected the researchers were affiliated with a government or military in a banned country, or had taken deliberate steps to conceal their location and identity, or both. Biological misuse is described in the report as "one of the most serious risks of frontier AI models."
  • Anthropic is explicit that it found no concrete instance of a scientist attempting to use Claude for nefarious purposes, that the work may have been legitimate, and that it "erred on the side of caution" in shutting the accounts. These are bans on suspicion, not confirmed weapons attempts.
  • Watch whether other labs publish comparable case counts. Without them there is no baseline for whether five cases in eight months is high, low, or simply what detection currently catches.
AnthropicBio RiskThreat Intel