Artificial Science

AI

AI Just Became the 16th Biodefense Priority. The Reason Is a DNA Order Form.

The Bipartisan Commission on Biodefense added AI as the first new technology priority to the Apollo Program since 2021. The technical evidence behind that decision comes from a red-team exercise in which AI-redesigned toxin sequences slipped past the screening software that DNA synthesis companies rely on.

By Dr. Sreenu Vattipally 10 min read 1,805 words

There is a particular kind of policy document that only gets written after somebody demonstrates a problem in a lab. On 7 July 2026, the Bipartisan Commission on Biodefense published one. It added artificial intelligence as the sixteenth technology priority in The Apollo Program for Biodefense, the first new priority the Commission has added since it laid out the original fifteen in 2021 (Atlantic Council, 7 July 2026).

The original fifteen were things you can point at: vaccine candidates for prototype pathogens, next-generation personal protective equipment, distributed diagnostics (HSToday, 8 July 2026). AI is not that kind of thing. It is a general-purpose accelerant, and the Commission's framing reflects it: AI, they write, "is not a sector-specific technology but one that accelerates discovery, analysis, and design across biology, chemistry, and all other technical domains nearly simultaneously" (Atlantic Council).

So why now, and why this framing? Because of a specific, documented failure at a specific chokepoint.

What happened#

The Commission's decision followed its 4 June 2026 public meeting, "Pandora's Prompt: AI and the Biological Threat," which included OpenAI, Anthropic, and Microsoft alongside AI and biology experts (Atlantic Council; HSToday). The resulting brief asks the United States, working with industry and international partners, to invest across five lines: AI-enabled disease surveillance and diagnostics, medical countermeasure development, microbial forensics and attribution, model evaluation and safeguards, and adaptive nucleic acid synthesis screening.

That last item is the load-bearing one, and it traces directly to a study published in Science in October 2025.

A consortium led by Microsoft's Office of the Chief Scientific Officer, with IBBIS, Battelle, RTX BBN, the University of Birmingham, and the two largest commercial DNA synthesis providers (Twist Bioscience and Integrated DNA Technologies), asked a blunt question: can open-source AI protein design software rewrite a dangerous protein so that the biosecurity software used to screen DNA orders no longer recognises it?

The answer was yes. The team generated 76,089 AI-redesigned variants of 72 proteins of concern, mostly well-characterised toxins, and found that existing screening tools could not reliably detect them (Wittmann et al., Science 390:82–87, 2 October 2025; process details via IBBIS). This is peer-reviewed work, not a preprint.

Two things about how it was handled matter as much as the finding. First, the vulnerability was patched before it was published. The screening tool developers and synthesis providers updated their software, and the results were withheld until protective measures had been distributed (IBBIS). Second, the underlying data sits behind a tiered managed-access system administered by IBBIS, with an endowment from Microsoft to keep it hosted in perpetuity. IBBIS describes this as, to their knowledge, the first time a leading scientific article has formally endorsed tiered access to manage information hazards of this type.

The origin story is almost mundane. While preparing for a biosecurity workshop in October 2022, Microsoft researchers decided to test the hypothesis by generating thousands of AI-rewritten versions of ricin. Screening did not consistently catch them. The confidential collaboration that followed ran for roughly three years.

Why it matters#

DNA synthesis screening is the narrow point in the pipe. You can design a protein on a laptop; you cannot make one without ordering the DNA that encodes it, or building the synthesis capacity yourself. Every serious AI-and-biosecurity framework of the last several years has leaned on this chokepoint as the primary physical safeguard.

The Science result did not break that safeguard. It showed the safeguard was tuned to an older threat model, one in which a bad actor orders a sequence that looks like the wild-type hazard, and that a version tuned to the newer threat model is achievable. That is a genuinely good outcome, and it is the reason the Commission's fifth investment line says adaptive screening rather than just more screening. A static blocklist of sequences is the wrong shape of defence when the adversary has a generative model.

The defensive half of the ledger is moving too. On 29 May 2026, OpenAI announced its Rosalind Biodefense Program, offering sponsored access to its GPT-Rosalind life-sciences model to "trusted developers" building biodefense tools, with launch support for epidemiological modelling, early detection, screening, preparedness, and non-pharmaceutical interventions. The company said it had briefed the White House and several federal agencies, and is expanding access for selected US government and allied partners (Axios, 29 May 2026).

There is also a quieter, more immediately practical result. A team from the Centre for Long-Term Resilience and Aclid tested five large language models on customer legitimacy screening, the "know your customer" step that synthesis providers use to verify who is ordering and why. The best configuration (Gemini 2.5 Pro with four bibliographic and sanctions APIs) reached 90.2% flag accuracy against an expert human baseline of 89.0%, statistically indistinguishable, at roughly one-tenth the cost: $1.18 versus $14.04 per customer. For the information-gathering step alone, costs averaged $0.23 per customer (Acelas et al., Frontiers in Bioengineering and Biotechnology 14, accepted 15 June 2026). Note the sample: n = 41.

That is a small study, but it points at the real bottleneck. Screening is expensive, and cost is a large part of why many providers do not do it.

Meanwhile the natural-origin side of the problem has not paused for the technology debate. Between 4 August 2025 and 10 June 2026, twelve human H5N1 infections were reported outside the United States, in Bangladesh, Cambodia, and India, three of them fatal. No person-to-person spread was identified in any of them, and CDC assesses the risk to the US public as low (CDC, 26 June 2026). Total human H5N1 cases worldwide since 1997 now stand at 1,022. Most of these infections followed direct contact with sick or dead poultry. CDC's own conclusion from the summary is about infrastructure, not alarm: these cases "underscore the need for strong systems to monitor and prepare for influenza, including robust surveillance and testing."

Surveillance and testing is exactly where AI-enabled tooling has the least contested value and the least hype. Sequencing throughput has outrun the human capacity to interpret it. That is a tractable machine-learning problem in a way that "predict the next pandemic" is not.

The limitations#

Several, and they are not small.

The patch is narrow. The Science study improved detection of "synthetic homologs more likely to retain wild type–like function" (Wittmann et al.). Homologs of known proteins of concern is a specific category. Detection approaches keyed to similarity with known hazards are, by construction, weaker against genuinely novel designs, and that limitation is the explicit subject of ongoing work in the field. Related open research on this problem, including a 2024 bioRxiv preprint on AI-resilient screening — not peer-reviewed — should be read as work in progress, not settled method.

Patched tools only help if anyone runs them. IBBIS's early findings from its Global DNA Synthesis Map indicate that screening "remains voluntary, inconsistent, and globally fragmented," and that it is not hard to find companies or intermediaries that do not screen order sequences at all (IBBIS). A patched screening tool with 40% market coverage is a patched screening tool with 40% market coverage. The Responsible AI x Biodesign commitments now carry over 180 signatories, but they are voluntary commitments.

The LLM verification result is preliminary. n = 41, one benchmark, one point in time, and the authors themselves recommend piloting AI only at the information-gathering step, with human reviewers retaining authority over follow-up and order fulfilment (Acelas et al.). "Statistically indistinguishable from human" at that sample size is a weaker claim than it sounds.

There is no public evidence of an AI-enabled biological attack. The Commission's case rests on capability trends and demonstrated technical vulnerabilities, not on incidents. Commission co-chair Donna Shalala's framing — "without deliberate investment and clear policy, AI could benefit the attacker before it benefits the defender" (HSToday) — is conditional, and worth reading as conditional rather than as a threat assessment.

A priority is not a budget. The Apollo Program is the product of a privately funded advisory commission. Naming a sixteenth priority creates an agenda item, not an appropriation. Watch what shows up in budget requests before concluding anything has changed.

FAQs#

Did AI actually design a bioweapon? No. Researchers generated redesigned versions of known toxin proteins in silico and tested whether screening software flagged them. Nothing hazardous was synthesised, and the paper does not claim the variants were validated as functional (Wittmann et al.).

Is DNA synthesis screening now fixed? The specific vulnerability tested was patched by participating tool developers and providers before publication. Coverage of screening across the global market is a separate and unresolved problem (IBBIS).

Does this mean open-source protein design tools should be restricted? The paper does not argue that, and the field is not settled on it. The study's own approach was to red-team responsibly and patch, then publish with tiered data access — an implicit argument that managed access to specific hazardous artefacts is more workable than restricting the tools themselves. Reasonable people in biosecurity disagree; when IBBIS consulted stakeholders, some recommended publishing as openly as possible and others recommended closed government-only briefings.

Is H5N1 becoming a pandemic? CDC reports no person-to-person spread among the twelve international cases from August 2025 to June 2026 and assesses the risk to the US public as low (CDC). This post is not medical advice; for guidance about your own situation, consult a clinician or your national public health authority.

What should I actually watch next? Three things: whether US budget requests fund the five Apollo investment lines; whether the share of globally screened synthesis orders rises, which IBBIS's Global DNA Synthesis Map is set up to measure; and whether AI-assisted customer verification moves from a 41-customer study to a provider pilot.

Sources#

Related observations

Adjacent work from the same lines of enquiry.

Two Doors Into Biology

OpenAI is giving 100,000 academic researchers free frontier model access with 75+ life science skills. Anthropic's newest flagship refuses to explain mitochondria. Both companies claim to be managing the same biosecurity risk — and the gap between their answers tells you how unsettled AI-for-biology governance really is.