No Single Safeguard Stops AI-Aided Bioweapons, Analysts Argue

NOBODY builds a bioweapon in one sitting, each step is another chance to be stopped. Analysts at RAND Corporation (the Santa Monica policy nonprofit) now argue that no single safeguard can stop an AI-assisted biological attack, because different attackers get stopped by different things: a lone person with little training may be blocked by cutting off information and materials, while a well-funded group or a state program mostly can’t be, and has to be deterred instead. Their report, released in August, lays out nine overlapping defenses meant to catch whoever slips past the last one. Not a forecast, then. A design brief.

The report is deliberately narrow. It covers only high-consequence events, defined as roughly ten times the scale of the COVID-19 pandemic or worse, and it concentrates on stopping a release rather than coping with one afterward.

Why worry at all? The authors say AI might lower the technical, operational and motivational barriers that keep most people away from biological weapons, and they point to a few routes: a general-purpose AI model can act as a stand-in specialist consultant, biological design software can speed up the cycle of designing and testing a pathogen on screen, where oversight may be weaker, and the same software could propose DNA sequences that look nothing like known threats to the screening programs gene-synthesis companies run on incoming orders. That last route matters because those programs mostly work by matching an order against a list of dangerous sequences, so a functional look-alike with a different spelling could sail through, as researchers showed when open-source protein-design software produced variants that current screening tools did not reliably catch (they patched the gap afterward).

Who Gets Stopped, and by What

The team sorted would-be attackers into six profiles, from a lower-resourced individual or small group up to a near-peer state (one with AI and life-science research close to America’s), and found a trade-off. Some are fairly amenable to disruption but hard to deter, ideologically driven nonstate groups for example, while others, such as highly capable states, are very hard to disrupt before an attack but seem quite deterrable.

The nine defenses fall into four classes. Three manage access to dangerous information: safeguards that survive tampering on open-weight AI models (the kind whose settings are published, so anyone can retrain them and strip the guardrails out), protection for the most sensitive biological datasets, and tiered-access platforms for powerful AI tools.

One screens gene-synthesis orders and customers, and wants the practice stretched to cloud labs, contract research firms and plasmid repositories, because coverage today is uneven and largely voluntary. Three deter attackers through early-warning systems (wastewater monitoring is the example the authors lean on, and in one Indian city’s COVID-19 data the sewage signal ran one to two weeks ahead of confirmed cases), forensic attribution, and rapid-response capacity shown off often enough that a would-be attacker doubts the payoff; the last two detect misuse as it happens.

Steph Guerra, head of AI x Bio at RAND’s Center on AI, Security, and Technology and the report’s lead author, says the trouble is that “today’s safeguards are fragmented across companies, governments and countries and are not designed to work together.” The gap she describes is one of visibility, and the report’s answer is to pool what each party sees.

A Pattern No Single Company Can See

Detection is where the report leans hardest, because the authors judge that refusals alone won’t hold: existing safeguards can be circumvented with enough resources, time and expertise. Blocking a suspicious query tells the person asking that they tripped something, which gives them a chance to adjust (or to head for a model nobody monitors); quietly watching is closer to a smoke alarm than a locked door, and it lets an AI company set its flagging threshold lower than it could ever stand for refusals, since a flag triggers a review rather than a slammed door.

The stronger step is pooling the flags. Someone who probes several AI models, spreads a DNA order across several vendors, and sources materials from yet more suppliers might look unremarkable at every stop and unmistakable in aggregate, so the authors want a central clearinghouse where AI developers, synthesis firms and cloud labs share hashed user identifiers, with a flagged person’s identity unmasked only once a credible threat pattern emerges. No company or agency has that view today, the report says, and voluntary swaps between pairs of firms are no substitute.

None of it is quick. The roadmap wants the defenses that are technically ready (order and customer screening, access-control standards, misuse monitoring and wider early-warning coverage) at scale by early 2028, with the clearinghouse and international data rules stretching beyond four years. “We don’t know exactly how fast AI capabilities in biology will advance, or which actor will try to exploit them first, but we do know that the window for building preventive infrastructure is open now,” says Sella Nevo, who directs RAND’s Center on AI, Security, and Technology.

Judgment Calls Behind the Nine

How much weight all this can bear is a fair question. The report is a policy analysis rather than a journal paper, and the only peer review it mentions comes from two readers named in its acknowledgments. Its authors started with 67 candidate defenses from academic and gray literature, then winnowed them by running scenarios against each other and against 13 future conditions, with actor profiles and feasibility rated by team discussion rather than measurement; the report itself calls its main success indicator, no attempted attacks, hard to measure robustly. Even the starting premise is partly precaution: OpenAI and Anthropic labeled some of their models as potentially giving novices meaningful help with bioweapons out of caution, the report notes, not because they had seen that uplift happen.

The authors lean on government. Federal action is, they say, a necessary condition for nearly every defense at scale. Voluntary industry effort has produced early examples, but coverage is uneven and standards inconsistent, and fragmented oversight is a worry a National Academies review of synthetic cells raised too. Several defenses are weakened if the United States goes alone, and the report calls dialogue with China an enabling condition, since both countries lead in AI and biotechnology.

Whether a clearinghouse like that can be built within legal and constitutional limits is, the authors admit, still unanswered. So is how much watching the public will tolerate before it stops trusting whoever does the watching.

FAQ