The Next AI Crisis May Be Biological
Why biosecurity and artificial intelligence now require one global regulatory architecture
Recent headlines have revealed a dangerous shift: artificial intelligence is no longer only a source of cyber, information or employment risk. It is beginning to interact with the physical machinery of life.
In September 2026, Anthropic reported that it had disrupted five cases in which users employed Claude in ways that could support biological-weapons development. The cases involved research concerning chikungunya, avian influenza, orthopoxviruses, venoms and toxins; the company stressed that it could not establish malicious intent or prove that any biological weapon was actually produced. Separately, Google disclosed an attempt to obtain a step-by-step guide related to weaponised biological agents.
That is the new reveal. The old debate treated AI safety and biosecurity as separate policy domains: one governed algorithms, the other pathogens and laboratories. The emerging reality is that AI can connect scientific knowledge, biological design, laboratory troubleshooting and automation into a single, increasingly accessible workflow.
The issue is not that a chatbot can instantly create a pandemic. It cannot. The issue is that the cost, time and expertise required to move from biological intent to biological capability may be falling—and global governance is not adapting at the same speed.
Biology has become an information-security problem
Traditional biosecurity focused on controlling dangerous pathogens, protecting laboratories, monitoring outbreaks and restricting specialised equipment. That model assumed that scarce expertise was one of the principal barriers separating curiosity from capability.
Advanced AI changes the equation. The 2026 International AI Safety Report found that general-purpose systems can provide pathogen information, expert-level laboratory guidance and help with troubleshooting or overcoming technical and regulatory obstacles. It also noted that some models now match or exceed expert performance on relevant benchmarks, while emphasising that uncertainty remains over whether this translates into real-world weapons capability because material, tacit-knowledge and operational barriers still matter.
This is the critical contrast: AI does not need to invent a pathogen to increase biological risk. It only needs to remove enough friction from a dangerous process. It can search fragmented literature, propose experimental paths, interpret results and help a user iterate. When combined with synthetic biology, remote laboratories and increasingly capable biological-design tools, that assistance could compress work that once demanded a larger, highly specialised team.
The same capabilities also promise enormous benefits. AI can accelerate drug discovery, vaccine design, diagnostics and outbreak detection. This dual-use character makes blanket
prohibition both unrealistic and undesirable: information that supports vaccine development may also help make a pathogen more evasive, and toxin research may yield either therapies or weapons.
The global bio-threat landscape
There is no single authoritative ranking because likelihood, impact and tractability differ. For decision-makers, however, six threat classes deserve priority.
| Threat | Why it matters globally | How AI changes it |
| Natural pandemics and zoonotic spillover | More than 60% of reported emerging infectious diseases originate in animals. Trade, agriculture, urbanisation, climate change and habitat disruption create new opportunities for spillover. | AI can improve surveillance and countermeasure design, but could also help identify biological characteristics that increase transmission or immune evasion. |
| Antimicrobial resistance (AMR) | Bacterial AMR was associated with more than 4.7 million deaths globally in 2021. It threatens routine surgery, cancer care, intensive care and the effectiveness of existing medicines. | AI can discover new drugs and optimise stewardship, yet biological design could also contribute to more resistant organisms or make existing defences easier to circumvent. |
| Biological weapons and bioterrorism | Deliberately released microorganisms or toxins can attack humans, animals or plants. High-concern agents include anthrax, botulinum toxin, plague, smallpox, tularemia and viral haemorrhagic fevers. | Models may lower knowledge barriers, support planning and help troubleshoot dangerous research, especially for state-backed or technically capable actors. |
| Laboratory accidents and dual–use research | Legitimate work on transmissibility, host range or immune escape may generate knowledge or organisms with pandemic potential. Accidents, insider threats and weak oversight can turn beneficial research into systemic risk. | AI can increase the volume and speed of experiments, making pre-project review, continuous monitoring and post-incident reporting more important. |
| Agricultural and food–system attacks | Pathogens directed at livestock or crops could undermine food security, trade and economic stability even without large numbers of immediate human casualties; bioterrorism includes intentional harm to livestock and crops. | AI-assisted target selection and biological optimisation could expand the range of actors able to contemplate agroterrorism. |
| Engineered or presently unknown pathogens | WHO’s preparedness framework includes “Pathogen X”: an unknown agent capable of causing a serious international epidemic. Its newer approach evaluates entire viral and bacterial families rather than relying only on a fixed list. | AI-enabled design may blur the boundary between naturally emerging, modified and novel agents, challenging surveillance systems built to recognise known signatures. |
These are not independent risks. Climate and ecosystem disruption can increase spillover; weak health systems allow outbreaks to spread; AMR reduces treatment options; disinformation damages public compliance; and AI may amplify several links in the chain simultaneously.
Why urgency is justified
The strongest argument for action is not a speculative scenario. It is the convergence of three observable trends.
First, AI capability is advancing faster than the institutions responsible for assessing it. Anthropicʼs cases covered activity from December 2025 to August 2026 and included attempts to bypass geographical and safety controls. The company responded by strengthening safeguards on newer models, but the episode demonstrates the limitations of relying on each developer to detect and disclose misuse on its own.
Second, the world remains structurally underprepared for biological emergencies. The Global Health Security Index found that no country was fully prepared for epidemics or pandemics; the 2021 global average was only 38.9 out of 100. Preparedness is therefore only as strong as the weakest surveillance, laboratory, health-system or supply-chain link through which a threat can propagate.
Third, the legal architecture is incomplete. The Biological Weapons Convention (BWC) prohibits development, production, acquisition, transfer, stockpiling and use of biological and toxin weapons and has 189 states parties. Yet it has no international agency comparable to the chemical-weapons regime and still lacks a comprehensive verification mechanism; its small Implementation Support Unit cannot perform the functions of a global inspectorate.
The WHO Pandemic Agreement, adopted in May 2025, is an important advance. It covers surveillance, One Health, research coordination, stronger health systems, supply chains and equitable access to countermeasures, but it will enter into force only after completion of its pathogen access and benefit-sharing annex and 60 ratifications. It is designed primarily for pandemic prevention, preparedness and response—not as a complete regime for AI-enabled biological design or weapons verification.
The strongest opposing case
A credible regulatory proposal must confront the argument against it.
The first objection is evidential: todayʼs AI may not materially increase attack capability. A 2024 RAND study found that the generation of large language models it tested did not measurably change the operational risk of a large-scale biological attack. Anthropic likewise acknowledged that its identified cases demonstrated concerning capability but did not prove that AI would be used to produce a weapon in the real world.
That caution is essential. Alarmist claims can divert funding from high-probability threats such as AMR, routine infection control and naturally emerging disease. They can also encourage security theatre-controls that appear reassuring but do little to prevent a determined state programme.
The second objection is economic and scientific. Excessive restrictions could slow vaccine research, reduce international collaboration, disadvantage smaller laboratories and concentrate biological innovation in a few large corporations and powerful countries.
Researchers may avoid legitimate work if rules are vague or if every dual-use question triggers investigation.
The third objection is geopolitical. States may resist inspections, data sharing or international authority over sensitive laboratories. A regime that responsible countries follow but hostile actors ignore could constrain innovation without eliminating the threat.
These arguments do not justify inaction. They justify targeted, capability-based regulation. The goal should not be to control biology as a body of knowledge. It should be to govern the high-risk junctions where advanced AI, biological design, synthesis, automation and access to dangerous agents meet.
A global AI-bio compact
The world does not need another declaration of principles. It needs interoperable rules that connect AI governance, health security and arms control.
Set capability thresholds
Frontier models should undergo standardised, independent biological-risk evaluations before release and at regular intervals afterward. Tests should measure whether a model provides meaningful “uplift” over ordinary internet research to users at different skill levels—not merely whether it can recite textbook facts. The EU AI Act offers a useful regulatory pattern: providers of general-purpose models with systemic risk must conduct evaluations and adversarial testing, mitigate systemic risks, report serious incidents and maintain cybersecurity.
Regulate the physical chokepoints
Information controls alone will fail as models proliferate. A stronger regime should require universal screening of synthetic nucleic-acid orders, verification of customers, secure records and reporting of suspicious activity. The US framework already outlines sequence screening, customer verification, record retention and cybersecurity, while subsequent policy called for scalable, verifiable screening and enforcement rather than voluntary attestation.
Equivalent safeguards should cover benchtop synthesis equipment and remote or cloud laboratories. This would preserve broad access to low-risk research while applying greater scrutiny when a digital design approaches physical execution.
Require incident disclosure
Frontier AI providers, DNA-synthesis companies, cloud laboratories and high-containment facilities should report serious biosecurity incidents to competent national authorities and a protected international clearinghouse. Reporting thresholds, confidentiality protections and liability safe harbours would encourage disclosure without exposing sensitive biological information.
Strengthen the BWC
The BWC needs a permanent, properly funded technical organisation; mandatory national declarations for relevant high-risk facilities and programmes; a science-and-technology review mechanism covering AI and synthetic biology; and proportionate investigatory or challenge-inspection capacity. Verification will never be perfect, but the absence of perfect verification is not an argument for almost none.
Build equitable preparedness
Regulation that focuses only on preventing malicious design will miss the larger defence system. Countries need interoperable One Health surveillance, diagnostic capacity, trained workforces, resilient medical supply chains and rapid access to vaccines and therapeutics. WHO defines One Health as integrating human, animal, plant and ecosystem health—precisely the cross-domain approach required for threats that ignore ministerial and national boundaries.
Protect beneficial innovation
A global framework should include tiered access, secure research environments, accredited-user programmes, regulatory sandboxes and appeal processes. Model providers should be allowed to distinguish between general education, legitimate advanced research and requests that materially enable harm. International funding should help lower-income countries comply, ensuring that biosecurity does not become a barrier to their scientific development.
The decision for leaders
AI and biology share four governance characteristics: both are dual-use, advance rapidly, cross borders and can generate consequences far beyond the organisation or country that creates the risk. Both also reward early coordination and punish fragmented regulation.
Recent misuse reports do not prove that an AI-designed pandemic is imminent. They provide something more actionable: an early warning while material barriers still exist and before dangerous capability becomes widely distributed. Governments should use this period to establish testing, screening, reporting and verification systems—not wait for a biological incident to create political permission.
The central regulatory principle should be simple: as AI systems acquire greater biological capability, the obligations attached to their development and deployment must rise with it. National rules are necessary, but insufficient. Pathogens do not respect borders, model access is global, biological supply chains are international and the consequences of failure are shared.
Global regulation is often criticised as slow. In this case, slow regulation is still preferable to regulation written in the aftermath of a preventable catastrophe.
How PAD US can help
Global rules only become effective when institutions can translate them into resilient infrastructure and operating practice. PAD US develops customised solutions integrating next-generation biosecurity technologies, health monitoring and intelligent health-and-safety infrastructure across hospitals, laboratories, urban facilities, mobile and humanitarian settings, naval environments, military sites and industrial operations. PAD US can help organisations assess biosecurity exposure, connect environmental and health monitoring with operational response, and design resilient systems suited to the realities of each site.
Bibliography
- Anthropic. Detecting and countering misuse of AI: September 2026, 2026.
- International AI Safety Report. International AI Safety Report 2026, 2026.
- World Health Organization. Biological weapons.
- World Health Organization. Antimicrobial resistance, updated 2026.
- World Health Organization. WHO Pandemic Agreement, 2025.
- World Health Organization. One Health, updated 2026.
- World Health Organization. WHO R&D Blueprint for Epidemics.
- United Nations Office for Disarmament Affairs. Biological Weapons Convention.
- United Nations Office for Disarmament Affairs. The Biological Weapons Convention at Fiiy, 2025.
- European Union. Regulation (EU) 2024/1689—Artificial Intelligence Act.
- RAND Corporation. The Operational Risks of AI in Large-Scale Biological Attacks, 2024.
- Nuclear Threat Initiative and Johns Hopkins Center for Health Security. 2021 Global Health Security Index, 2021.
- US Centers for Disease Control and Prevention. Critical Biological Agent Categories for Public Health Preparedness.
- The White House. Framework for Nucleic Acid Synthesis Screening, 2024.
References
- Anthropic blocks possible attempt to use AI to make … – The revelations in Anthropic’s threat intelligence report come after a former top researcher at the …
- Anthropic say s it disrupted scientists using Claude AI for possible biological weapons development – Anthropic said it blocked scientists who used its Claude AI models “in ways that could support biolo…
- Detecting and countering misuse of AI: September 2026 – Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas o…
- International AI Safety Report 2026 – This Report assesses what general-purpose AI systems can do, what risks they pose, and how those ris…
- Anthropic Says It Blocked Possible Efforts to Build Biological Weapons – In a new report, the A.I. start-up added that it could not determine whether the research was legiti…
- Anthropic tightens AI rules to prevent biological weapons development – Anthropic has cracked on AI misuse linked to identified bioweapon risks and conventional weapons dev…
- One Health – a standardized approach for assessing risks of spillover of pathogens between different animal popul…
- Antimicrobial resistance – World Health Organization (WHO) – AMR is a major global health threat. Bacterial AMR was estimated to be associated with more than 4.7…
- [PDF] Draft updated global action plan on antimicrobial resistance 2026 … – In 2021, bacterial AMR alone directly caused an estimated 1.14 million human deaths and was associat…
- Biological weapons – Biological agents like anthrax, botulinum toxin and plague can pose a difficult public health challe…
- [PDF] Inside Cover.fm – CDC Stacks – A Bioterrorism Prepared- ness and Response Office has been formed to help target several areas for i…
- Bioterrorism and Anthrax: The Threat – CDC – Bacillus anthracis, the cause of anthrax, is a likely agent for a bioterrorist act. If there is an a…
- WHO R&D Blueprint for Epidemics – Targeting research on diseases of greatest epidemic and pandemic threat. Prioritizing pathogens and …
- Critical research for priority pathogens with epidemic … – Since 2015, the WHO has implemented a comprehensive global research strategy and preparedness plan k…
- [PDF] The Biological Weapons Convention at Fifty – The discussion has also provided some indication of the broad contours of a BWC verification mechani…
- Universality | United Nations Office for Disarmament Affairsdisarmament.unoda.org › weapons-mass-destruction › biological-weapons – The Biological Weapons Convention currently has 189 States Parties and four Signatory States. There …
- Biological Weapons Convention (UN) – In order to continue, we need to verify that you’re not a robot. This requires JavaScript. Enable Ja…
- WHO Pandemic Agreement – Global – The WHO Pandemic Agreement was adopted by the World Health Assembly on 20 May 2025, marking a histor…
- [PDF] WHO Pandemic Agreement – World Health Organization (WHO) – The Conference of the Parties may adopt amendments to the WHO Pandemic Agreement. … Third plenary …
- The Operational Risks of AI in Large-Scale Biological Attacks – The findings indicate that using the existing generation of large language models did not measurably…
- Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives
- Improving the Safety and Security of Biological Research – This strategy shall include actions to achieve comprehensive, scalable, and verifiable nucleic acid …
- FRAMEWORK FOR NUCLEIC ACID
- PAD US: PAD-US Waste Engineering & Biosecurity Solutions … – The Future of the WorldWaste Engineering&Biosecurity SolutionsLEARN MORE … Combining decades of engi…
- 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)Text with EEA relevance.
Researched and draied with AI assistance, edited and fact-checked by the author. Illustration: AI-generated.