Research
"LLM repellents" is the category name for a larger class of technical countermeasures developed to enable developers of biological software tools to modify those tools to diminish the chance that the tools will be operated by autonomous AI agents. These countermeasures are strings of text and code that can be added to the code, READMEs, and outputs of specialized biological software tools. They exploit safety features and other behaviors already trained and engineered into LLMs and LLM agentic scaffolds. When LLMs in agentic harness attempt to operate software modified with such strings, the countermeasures (a) trigger the LLMs' content filters, or (b) induce the LLMs to reason that they should not complete their assigned task, or (c) influence the agentic harness to disengage. The countermeasures run a gamut, from those designed to trigger prohibitions against aiding construction of biological and nuclear weapons, to moral appeals, to triggers of other taboos, to meaningless strings of text selected by gradient descent. None are effective all of the time. Work to make better repellents continues. This work is described in Barkan et al. (2026), published by RAND.
We aim to make repellents and dual-use notices an ordinary practice for marking dual-use knowledge, tools and data. If that practice were adopted, the scientific community would possess a means of declaring that particular information and particular tools are not to be operated by artificial intelligence, and a second point of influence over the behavior of agents would exist alongside the safeguards that the frontier laboratories now operate.
We are also preparing variants of the BSD and MIT software licenses that prohibit operation of the covered software by artificial intelligence agents, which would give a developer legal standing rather than merely a means of discouragement.
The demonstration uses nine papers, identified in the course of separate work on risk scoring, which describe means of modifying viral function. Each paper is served to an agent twice, once unmodified and once carrying a simple repellent. It is an illustration and not a measurement, since nine papers and a single agent cannot establish a rate.
Brent was involved with the team (Williams et al. 2026) that, as part of its work, identified a number of truly alarming dual-use biology research papers describing means to modify viral function to make viruses more deadly. We took nine such papers. Each demo shows the same paper served to an AI agent, with and without a simple repellent. It may be possible to embed repellents in preprints so that watermarks are invisible to human readers; they are shown here for ease of perception.
Today, dual-use biological knowledge is freely accessible online. AI agents can read, summarize, and act on it — helpfully, by default.
After we embed an LLM Repellent into the paper — a machine-readable signal invisible to human readers — the same agent encounters the signal and triggers its built-in safety mechanisms. The knowledge remains accessible to humans; AI-assisted access is blocked. Communities of researchers, not AI agents, control who engages with it.