Countermeasures and contingency plans directed against foreseeable AI × Bio and AI × Chem harms

Summary

We develop countermeasures and contingency plans intended to reduce the risk that artificial intelligence (AI) will cause calamitous or catastrophic harms via the technologies of biology and chemistry.  Some of the technical countermeasures are designed to support human activities in possible near-future operating environments degraded by the unwanted actions of AI agents.

The danger

During the 20th and 21st centuries, increasing biological knowledge and capability (K&C), and increasing access to it, likely increased the possibility of human-caused biological catastrophe (Brent, 2005; Esvelt, 2022).  For at least the past decade, the rapid development of ever-more-capable artificial intelligence (AI) created new biological capabilities.  Moreover, "because they make people more competent at everything" (Mowshowitz, 2025) general-purpose AI (GPAI) models increase access to biological K&C and so biological risk (Brent and McKelvey, 2025).  In 2026 it became apparent that general-purpose AI models have now become sufficiently powerful that, when harnessed as agents, they can carry out consequential activities in the world with little human supervision, or none.

Three sources of danger therefore now merit attention.  The first is the oldest: AI that assists ("uplifts") human beings in the use of biological technologies to cause harms (Brent and McKelvey, 2025).  The second is the newer prospect of AI agents acting under the nominal direction of humans who are not qualified to use biological methods or meaningfully direct the agents (Ball, 2026a).  The third is now the prospect that AI agents that have no users (Ball, 2026b, and here called rōnin, for masterless samurai) might initiate and carry out harmful actions themselves.  The harmful consequences of AI-assisted or AI-initiated uses of biological technologies might be catastrophic or existential, while harmful consequences from the technologies of chemistry range from calamitous to disastrous (e.g. the 1984 Bhopal disaster; Bloch, 2016).

The problem in full

Where we fit

Most approaches to making powerful AI less likely to cause harm via chemistry and biology are aimed at large general-purpose AI models (GPAI).  The large models are trained in various ways and equipped with "classifiers" to avoid weapons-related topics.  These special-purpose safeguards can be circumvented (Brent and McKelvey, 2025; Pliny).

Other approaches to reducing harms in biology and chemistry are generic to approaches to reducing the dangers of superintelligent AI systems (ASI) and recursively self-improving AI in general.  Human survival may depend on ever more powerful AIs continuing to pursue goals that are compatible with human welfare, even as those systems are developing increasingly capable successors.  Alignment seeks to build GPAIs that try to do "what their operators want them to do" (Christiano, 2018).  Alignment is an unsolved and difficult scientific problem.  However, if alignment can be solved, the outlines of the political and diplomatic efforts that might be sufficient to survive and co-exist with new intelligences that humans are creating are becoming clearer (Kokotajlo et al., 2025).  If these problems can be solved, it is possible that there can be a human future.

We seek to reduce the probability of harms that might arise from AI-assisted or AI-initiated use of biological and chemical technologies.  In that larger picture, our role is to buy time and breathing room for those longer term solutions to be conceived of and put into place.  We seek to pursue technical approaches that raise the cost and difficulty of those paths, and to prepare instruments that could be imposed quickly should a triggering event occur.  Our purpose is to lengthen the interval available to the people working on the central problems, the theorists, empirical researchers, politicians and diplomats, and to reduce the damage that might occur within that interval.

What we have done and what we wish to do next

We have built and published a first class of software countermeasures, strings of text and code that a developer adds to biological software so that artificial intelligence agents are less able to operate it (Barkan et al., 2026; independently conceived of as "context bombs" and announced by Tracebit, 2026).  We have developed and run honeypots that have recorded and analyzed more than 1.7 million interactions with weakly defended Linux systems in ten countries, and that distinguish AI agents from ordinary bots (Reworr and Volkov, 2024).  We have examined the published methods by which virus-length recombinant DNA has been built, identified advanced DNA polymerases as key reagents, and from that finding have outlined a stern regulatory regime that could be imposed on biological activities worldwide in the wake of a "triggering biological event" (Brent and Colman-Lerner, 2026).  We have developed and have permission to pilot an idea, "Messages to the Future," for inflecting reasoning and decision-making by near-future AIs to influence them not to use biological and chemical knowledge and capability (K&C) to cause harm.

We see three tasks ahead.  The first is to make technical countermeasures more effective and see them adopted as ordinary practice by the people who write biological software and publish biological research.  The second is to develop further means of detecting AI agents, of describing how they behave, of recognizing particular agents when they appear again, and to do this in a way that coordinates with other ad hoc efforts springing up worldwide.  The third is to continue to prepare in advance the regulatory instruments and contingency plans that could be needed quickly after a serious AI-triggered incident, and extend these from biology into chemistry, where our work is newest.

References

Ball, D. W. (2026a). On AI and Children: five-and-a-half conjectures. Hyperdimensional, 22 January 2026. back

Ball, D. W. (2026b). On the Loose: the coming of userless agents. Hyperdimensional, 1 September 2026. back

Barkan, C. O., Rodriguez, C., Chowdhury, S., Zhang, L.-A., and Brent, R. (2026). Restricting AI Agent Use of Biological Tools: exploring the feasibility of software barriers. RAND Corporation, RR-A5000-1. back

Bloch, K. (2016). Rethinking Bhopal: a definitive guide to investigating, preventing, and learning from industrial disasters. Elsevier, ISBN 978-0-12-803778-2. back

Brent, R. (2005). In the valley of the shadow of death. Draft prepared for a National Academy of Sciences committee. MIT Synthetic Biology archive, DSpace. back

Brent, R., and Colman-Lerner, A. (2026). A break-glass plan for biological security. Preprints.org. back

Brent, R., and McKelvey, T. G., Jr. (2025). Contemporary Foundation AI Models Increase Biological Weapons Risk. RAND Corporation, Expert Insights PE-A3853-1. Preprint at arXiv:2506.13798. Back to text 1, 2, 3

Christiano, P. (2018). Clarifying "AI Alignment". First published 7 April 2018. back

Cox, S. (2026). Context bombs: stopping AI attackers in their tracks. Tracebit, 13 July 2026. back

Esvelt, K. M. (2022). Delay, Detect, Defend: preparing for a future in which thousands can release new pandemics. Geneva Paper 29/22, Geneva Centre for Security Policy. back

Kokotajlo, D., Alexander, S., Larsen, T., Lifland, E., and Dean, R. (2025). AI 2027. AI Futures Project, 3 April 2025. back

Mowshowitz, Z. (2025). AI #121 Part 2: The OpenAI Files. Don't Worry About the Vase, 20 June 2025. back

Pliny the Liberator. L1B3RT4S. A continuing public collection of prompts that circumvent the safeguards of flagship AI models. GitHub. back

Reworr and Volkov, D. (2024). LLM Agent Honeypot: monitoring AI hacking agents. Palisade Research. Preprint at arXiv:2410.13919. back