AI and the Bioweapon Threshold: What the Safety Reports Actually Show

Photograph: Siduduziwe Nxumalo, Wiki Science Competition 2025 (CC BY-SA 4.0). Illustrative stock photograph of routine biosafety-cabinet lab work - not connected to any person, case or institution named in this investigation.

In September 2026, Anthropic published a report disclosing that it had identified and blocked misuse of its Claude models across seven harm categories between December 2025 and August 2026 - including attempts to use the AI for biological weapons research.^{[1] [2]} One case involved a person affiliated with a military research institute who asked Claude to help draft a grant application for gain-of-function research on chikungunya virus, seeking to make the pathogen more transmissible and better able to evade immune response. Anthropic blocked the request.^[2]

The evidence supports a real, still-developing risk, not a demonstrated attack. No case Anthropic or any other lab has disclosed has resulted in a synthesized pathogen or a real-world biological incident. What the record does show is a widening gap between what frontier models can do and what safeguards, screening rules and Congress have caught up to.^{[9] [14]}

This investigation follows directly from the shrinking decision window in nuclear command and control: a second catastrophic-risk category where AI's role is contested, safeguards are new, and the loudest voices on both sides have a stake in the answer.

The report, "Detecting and Countering Misuse of AI: September 2026," was published on 10 September 2026 and covers activity Anthropic's threat intelligence team disrupted between December 2025 and August 2026 across seven domains: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and attempted model distillation.^{[1] [4] [5]}

Anthropic said it could not always establish whether the people behind the flagged biology cases intended harm - the chikungunya grant-writing request, for instance, could plausibly have been legitimate vaccine or therapeutic research - but it blocked the activity anyway because "the potential consequences were too serious to ignore."^[2] The company framed the disclosure as a transparency choice: "We're publishing this work because we believe we have a responsibility to disclose malicious misuse of our services."^[2]

Anthropic said its 2025-generation models, including Claude Opus 4 and Sonnet 4.5, carried "less stringent" biological safeguards, focused mainly on stopping novices from recreating already-known bioweapons.^[2] For its newer frontier models, the company says it applies "stronger safeguards that restrict access to a wide range of dual-use biological research queries" - a broader net that also catches legitimate dual-use science.^[2]

That shift tracks Anthropic's own published Advanced AI Framework, which names biological weapons, offensive cyber operations, loss of control, and AI-accelerated research and development as its four catastrophic-risk categories requiring the highest safeguard tiers.^[7]

Independent of any single company's disclosures, a body of 2026 technical research has tried to measure how much frontier models actually help with biological weapons development. Published evaluations report that recent models can match or exceed expert performance on some biology benchmarks relevant to weapons development, including troubleshooting virology lab protocols.^{[11] [12] [13]}

The open technical debate is about "uplift" - whether a model materially shortens the path for someone who could not otherwise do this work, versus simply making already-public, already-accessible science faster to look up.^{[6] [9]} The published studies establish capability on narrow benchmarks; none of the sources reviewed for this file establishes that a real person has used a model to build a functioning weapon.

A survey of more than 100 national-security experts conducted by the Institute for Security and Technology reportedly found roughly 70% believe AI meaningfully increases bioweapon risk now, or will within two to three years.^[6]

Former U.S. Deputy Secretary of Energy Elizabeth Sherwood-Randall has argued publicly that the convergence of AI and biotechnology represents a genuinely new category of proliferation risk, distinct from earlier eras where technical and tacit knowledge bottlenecks limited who could attempt bioweapons work.^[8] In June 2026, a coalition describing itself as spanning life-sciences researchers, AI companies and biotechnology developers issued an open letter calling on Congress to make DNA-synthesis-order screening mandatory rather than voluntary, placing the compliance burden on synthesis companies rather than researchers.^{[16] [19]}

Not every biosecurity researcher agrees the risk is close or large. Allison Berke, a bioengineer at RAND who benchmarks AI models against biosecurity tests, has said her own probability estimate for AI causing a biological crisis is "a very, very small chance" - a view she describes as common among specialists who work closely on this problem.^[7]

Berke's argument is technical, not dismissive: she points out that even a model with perfect biological knowledge cannot yet operate the physical "cloud lab" equipment needed to "fully autonomously make a transmissible virus," and that benchtop synthesis automation has not become cheap or capable enough to meaningfully lower the barrier to actual production.^[7] She also raises an incentive question worth stating plainly: biosecurity is a comparatively easy risk category for AI companies to be seen managing - DNA screening and export controls are concrete, "discreet" interventions - compared to harder-to-solve, systemic risks like labor displacement or model bias.^[7] Her caveat matters: if benchtop synthesis technology gets dramatically cheaper or more autonomous, she says her own assessment would change.^[7]

The U.S. government's most direct move predates the current wave of AI disclosures: Executive Order 14292, "Improving the Safety and Security of Biological Research," signed in May 2025, directed the Office of Science and Technology Policy to revise federal oversight of high-risk gain-of-function research and to update the government's framework for screening nucleic acid synthesis orders.^{[14] [15]}

As of the Congressional Research Service's most recent public accounting, it was not able to confirm whether OSTP had completed either directive.^{[14] [15]} In September 2026, the House Committee on Science, Space, and Technology held a hearing - "Balancing Biotechnology Innovation and Biosecurity" - examining whether federal oversight has kept pace with the convergence of AI and biotechnology.^[17] A bipartisan Biosecurity Modernization and Innovation Act was introduced the same year, alongside broader AI legislation such as S.3952, the Future of Artificial Intelligence Innovation Act.^{[16] [18]}

Put together, the record supports a narrower claim than either side's loudest framing. It is documented that a major AI lab is now actively disrupting biology-related misuse attempts and has tightened its safeguards in response.^{[1] [2]} It is documented that independent benchmarks show growing model capability on biology tasks relevant to weapons development.^{[11] [12] [13]} It is not documented - in any source reviewed for this file - that an AI model has been used to produce a working biological weapon, or that current safeguards have failed to stop one. The honest gap is regulatory, not evidentiary: the U.S. government ordered stronger biosecurity screening in 2025, and as of the most recent public review, no one outside government has been able to confirm that order was carried out.^{[14] [15]}