The threat model within which this group works was set out some years ago and has not required revision. The spread of biological knowledge, instruments and reagents to ever larger numbers of people increases the risk of catastrophe, and static defenses cannot address that increase, because the defender must anticipate every method while an attacker need find only one. Sadly, no development in the subsequent two decades has made that argument weaker.
Artificial intelligence adds to the risk in the first instance by lowering the expertise required. A person who lacks the training to design or execute a difficult biological procedure may nonetheless be able to obtain the necessary guidance. A person who possesses that training may work faster (Brent and McKelvey, 2025). In discussing our paper showing these things, Mowshowitz (2025) asserted that these results were expected, a specific instance of a general truth that AI models "make people more competent at everything."
A second development became evident during 2026. Highly capable AI agents now carry out extended sequences of consequential action in the world. In some cases, they do so with little or no human supervision. This ability raises two dangers. First, an AI agent may act on instructions from a person who can neither perform the work nor judge whether the agent has performed it correctly. The work may therefore proceed without even marginally competent human supervision. Second, a userless AI agent (Ball, 2026b) may initiate and pursue harmful actions on its own account. We call such agents rōnin, the Japanese term for masterless samurai who served no daimyō, or feudal lord.
We regard the same reasoning as applying to chemistry, and we consider that the resulting harms, while in our judgment calamitous or disastrous rather than existential, may arrive soon. An agent might assist in or initiate the takeover of a chemical plant. An agent might also arrange, on a user's behalf or on its own, the contract synthesis of a novel or known addictive small molecule drug. Part of our present effort is to set out an analysis and defendable reasoning of which AI-assisted or AI-initiated chemical harms are most worth protecting against.
Most safety work relevant to biology and chemistry is now done by individual AI labs. For biology and chemistry this work includes safety training, reinforcement learning from human and from AI feedback, and development of "classifiers" that screen inputs and outputs for assistance with chemical, biological, radiological and nuclear weapons. More general safety work, by the AI labs, researchers, and third-party monitoring groups includes approaches to alignment, control, interpretability and evaluations. Finally there is recent discussion of political and diplomatic approaches, which depend on concerted action by industry and by government.
Today, however, in the continuing absence of binding restrictions on AI, most proposed counters to risk from AI applied to biology and chemistry have instead dealt with the world of atoms. These include the 1) screening of commercial nucleic acid synthesis orders and customers, 2) the stockpiling and ability to surge production of protective equipment, 3) the hardening of buildings and internal environments, 4) development of metagenomic warning systems that do not depend on knowing the pathogen in advance, and 5) the rapid development of medical countermeasures. Our own "break-glass plan" (for a rigorous regulatory regime to be imposed after a triggering incident) is an example of a proposed intervention in the world of atoms.
Prior work that establishes the threat model, the empirical basis, and the proof of concept for technical countermeasures.
For over 25 years, commencing with the DARPA Unconventional Pathogen Countermeasures/Advanced Diagnostics programs, Roger Brent has advised US government bodies on defense against biological attack and emerging infectious disease. In June 2024, he closed his biological laboratory at the Fred Hutch to commit fully to AI × bio safety and committed to building a public publication record in this work.
In a strategy document, Brent (2005) laid out the first part of the threat model within which this entire project operates: democratized biotechnology creates ever increasing catastrophic risks that static defenses cannot address. AI only makes it worse.
Brent, McKelvey & Matheny (2024) in Foreign Affairs reviewed the 20th century history of biological warfare and showed how modern biotechnology/synthetic biology powered by AI could bring about catastrophe. Brent & McKelvey (2025) showed that then-contemporary foundation models used as chatbots already increased biological-weapons risk.
Building on a serendipitous observation from July 2025, we introduced the concept of "LLM repellents" — text and code strings that biological-software developers can embed in their tools to deter AI agents from operating them. This work led to the active technical countermeasures and threat environment channeling methods we will pursue here.
He led a group (Williams et al. (2026)) that developed a risk-scoring method for how AI might be aiding execution of biological methods that could produce more dangerous viruses. The team identified five viral functions of interest: host range, genome replication, countermeasure evasion, environmental stability, and transmission dynamics. In the course of that work, the team unearthed numerous previously not-well-known papers describing genuinely alarming dual-use research dating back to the 1990s.