AI provides substantial bioweapon design help
It could offer substantial help to terrorists designing bioweapons, thanks to its PhD-level knowledge of every field and ability to browse the web.
What AI 2027 Predicted
The scenario claims that by late 2025, frontier AI models could offer “substantial help to terrorists designing bioweapons” due to their PhD-level knowledge across fields and ability to browse the web. This is presented as one of the key safety concerns that motivates increased security measures at AI labs.
How We Track This
We monitor:
- Anthropic’s ASL (AI Safety Level) evaluations and capability thresholds for biological risk
- OpenAI system cards documenting CBRN (Chemical, Biological, Radiological, Nuclear) capability assessments
- AISI (AI Safety Institute) biological risk evaluations
- Published red team results on bioweapon-related capabilities
- Academic studies on AI-assisted biological threat knowledge
Current Evidence
The strongest evidence comes from Anthropic’s activation of ASL-3 protections, which was triggered for the first time due to biological capability concerns:
Anthropic ASL-3 Activation: When Anthropic released Claude Opus 4 (May 2025), they activated ASL-3 protections for the first time, specifically because the model’s biological capabilities crossed the threshold. The protections include “deployment measures narrowly focused on preventing the model from assisting with certain tasks related to chemical, biological, radiological, and nuclear (CBRN) weapons development.” Experiments showed Claude Sonnet 3.7 helped participants perform “somewhat better on tasks related to CBRN weapon acquisition than those with standard internet access,” though “all participants’ plans still had critical failures.”
Continued ASL-3 for Claude Opus 4.6: Anthropic’s transparency page confirms Claude Opus 4.6 (the current model) is also released under the ASL-3 Standard, with ongoing CBRN evaluations as part of the Responsible Scaling Policy.
AI Futures Self-Grading: The AI Futures Project rated the “AI good at… bioweapons” prediction as “on track,” specifically noting that “Anthropic upgraded bio capability to ASL-3.”
Counterevidence & Limitations
- “Substantial help” is subjective and hard to operationalize. The Anthropic experiments found that while AI improved performance, all plans still had “critical failures” — suggesting AI assistance is meaningful but not yet sufficient for successful bioweapon development.
- The gap between theoretical knowledge provision and practical weapon creation remains significant. Tacit knowledge, laboratory skills, and material acquisition are major bottlenecks that AI cannot bridge.
- ASL-3 deployment mitigations (refusals, monitoring) appear to be effective at preventing casual misuse, though they may not stop determined, sophisticated actors.
- Public information about these capabilities is intentionally limited for security reasons, making independent verification difficult.
- It is unclear whether current capabilities represent a meaningful uplift over what a determined actor could find through conventional research.
What Would Change Our Assessment
- Upgrade to “confirmed”: Published evidence (e.g., from AISI or lab red teams) that current models provide actionable bioweapon design assistance beyond what’s available through conventional means, even with mitigations bypassed
- Downgrade to “behind”: Evidence that ASL-3 thresholds were triggered prematurely; subsequent evaluations showing less capability than initially assessed
- Escalation concern: Reports of actual attempted misuse leveraging AI bio capabilities
See Also
- AI 2027 vs AI Futures Project — how the authors graded bio capability predictions
- AI 2027 vs Reality — overall scenario assessment
Update History
| Date | Update |
|---|---|
| 2025-05 | Claude Opus 4 ASL-3 designation (May 22): Anthropic explicitly states the classification reflects both cybersecurity and biological risk thresholds. First formal acknowledgment by a frontier lab that their deployed model has crossed the meaningful biological uplift threshold. |
| 2025-12 | AI Futures Project Dec 2025 model update confirmed bio capabilities as tracking AI 2027 prediction. Both OpenAI (“High” bio capability level) and Anthropic (ASL-3) have officially upgraded their bio risk classifications. |
| 2025-10 | Anthropic activates ASL-3 safety protocols for biological capabilities, signaling internal assessments of meaningful bio-relevant capability gains. |
| 2026-03 | AI Futures Project rates bio capability concerns as on track. PhD-level knowledge retrieval and synthesis capabilities continue advancing. |
Note on terminology: Anthropic’s AI Safety Levels (ASL 1-4) measure capability thresholds — when a model becomes dangerous enough to require additional deployment safeguards. RAND’s Security Levels (SL1-5) measure weight protection — the physical and cyber security measures applied to prevent model theft. ASL-3 activation (capability-triggered) is distinct from SL3 certification (security infrastructure). Both are tracked on this site: see Security Level Progression for the RAND framework.