For decades, biology's relationship with computers was
largely analytical. We used machines to sequence genomes, compare mutations,
predict proteins, identify pathogens and search enormous genetic databases for
patterns that humans could never spot unaided. That relationship is changing. The latest generation of biological AI models is moving from
reading biology to generating biology. And that distinction
matters.
Researchers from Stanford University and the Arc Institute
have demonstrated that genome-language models can generate complete
bacteriophage genomes that are viable in the laboratory, even though the
resulting viruses had not previously existed in nature. Sixteen AI-designed
phages were experimentally validated after hundreds of candidate designs were
synthesized and tested. The work represents an important proof point: an AI
system can learn enough of the statistical and functional grammar of genomes to
propose biological systems that actually work.
That sentence deserves to sit quietly for a moment.
We are no longer talking simply about AI predicting what a
known virus might look like. We are talking about a system learning from
existing biological information and using those learned patterns to produce a
genome that nature itself had not previously produced. And this is where the
scientific excitement meets the uncomfortable biosecurity conversation. Modern genetic databases are extraordinary repositories of
biological information. Public resources contain enormous collections of viral,
bacterial, plant, animal and human sequences. Scientists use these resources
for everything from outbreak surveillance to drug discovery and evolutionary
research.
The ecosystem has expanded dramatically through metagenomics
as well. Researchers have reconstructed huge numbers of previously uncultivated
viral genomes from environmental sequencing data, meaning that public databases
increasingly contain not only familiar laboratory viruses but an enormous
representation of the broader viral universe. AI changes what can be done with that information. A conventional search engine can tell us that two sequences
are similar. A conventional bioinformatics pipeline can classify a sequence or
predict whether a genome contains certain biological features.
A generative genome model attempts something more ambitious:
it learns statistical relationships across genetic sequences and uses them to
generate new sequences. The analogy to language models is useful, provided we do not
take it too literally. A language model learns patterns that allow it to
produce a sentence it has never seen before. A genome model learns patterns in
DNA that can allow it to produce a sequence that has never existed before.
In the Evo 2 work, the model was trained on an enormous
genomic corpus containing more than 9 trillion DNA base pairs across multiple
domains of life. The researchers then demonstrated generative capabilities at
the whole-genome level. The important achievement was not that a computer could
output four-letter DNA strings. Computers have been doing that for years. The
achievement was that some of those strings encoded enough coherent biological
information to produce functioning organisms, in this case, bacteriophages
capable of infecting bacteria.
The phrase "AI-created viruses" understandably
produces an alarming headline. But the scientific reality is more specific. The
demonstrated organisms were bacteriophages, viruses that infect bacteria. The
experimental system centered on a relatively small phage related to ΦX174 and
targeted E. coli. They were not human-infecting viruses, and the
researchers deliberately applied safety constraints to reduce the possibility
of producing something harmful to humans. Arc has stated that eukaryotic
viruses were excluded from Evo 2's training for safety reasons and that its
experiments were designed around bacteriophages as a comparatively lower-risk
system for demonstrating generative genome design.
That distinction is critical. It would be inaccurate to
conclude that researchers have demonstrated an AI system capable of casually
generating a novel human pathogen.
They have not. What they have demonstrated is arguably more
foundational: the general concept of generative biological design works at the
scale of an entire viral genome. And that is precisely why the result attracts
biosecurity attention. The concern is not necessarily what today's experiment
can do. It is what happens when similar capabilities become more powerful, more
general, easier to operate and connected to increasingly capable biological
engineering infrastructure. The biosecurity problem is bigger than the model. It is
tempting to frame this as an "AI safety" problem.
That is too narrow. The emerging challenge sits at the
intersection of AI, genomics, DNA synthesis, laboratory automation, public
databases and increasingly distributed biological infrastructure. Imagine the traditional research pipeline as a chain. A
scientist has an idea. They search the literature. They study known sequences.
They design an experiment. They order biological material. A laboratory builds
or tests it. Results feed back into the next experiment.
AI potentially accelerates several parts of that chain
simultaneously. The model can search and reason over enormous biological
datasets. It can propose candidates. Automated tools can evaluate those
candidates. DNA synthesis companies can manufacture sequences. Robotic
laboratories can perform experiments at increasing scale. The risk therefore isn't simply "someone asks an AI to
make a dangerous virus." The more serious governance question is whether the entire
ecosystem develops faster than the safeguards connecting those stages.
That is why biosecurity researchers increasingly advocate a
layered approach rather than relying on one magical safety filter. NIST
researchers and collaborators have called for safeguards embedded directly into
generative AI systems, while industry organizations emphasize screening
synthetic DNA and screening customers before biological designs become physical
material.
In other words, the safety system should not end with the
chatbot. It needs to continue all the way from digital design →
biological synthesis → laboratory use → monitoring and accountability. The uncomfortable problem with "sequence
screening"
For years, one of the principal defenses against misuse of
synthetic biology has been DNA sequence screening. The basic idea is straightforward: if someone orders DNA
resembling a regulated pathogen or another sequence of concern, a synthesis
provider can flag the order, investigate it and, where appropriate, prevent
fulfillment. This is an important control. But generative biology complicates the picture.
A sequence that has never existed in nature may not look
sufficiently similar to a known sequence of concern. A screening system built
primarily around exact matches or conventional similarity searches may
therefore struggle with genuinely novel biological designs. That doesn't make sequence screening obsolete. It makes it
more important, and potentially more sophisticated. Screening needs to evolve from asking only: "Does this sequence look like something dangerous that
we already know?"
And toward a broader question: "Does this sequence exhibit biological characteristics
that warrant additional scrutiny, even if it doesn't resemble a known
threat?"
That is a much harder computational and policy problem. It also introduces the possibility of false positives. A
legitimate researcher working on an unusual biological system should not have
their work blocked simply because an algorithm doesn't understand it. So the future of biosecurity will involve a difficult
balancing act: catch genuinely concerning designs without turning scientific
innovation into a giant red button marked "maybe."
A real-world industry example: Twist Bioscience and the
screening problem. This is not entirely theoretical. The synthetic-DNA industry
has already spent years confronting a version of this problem. Twist Bioscience, one of the world's major synthetic-DNA
providers, describes a comprehensive biosecurity program covering sequence
screening, customer screening, regulatory compliance, employee training,
reporting, record keeping and red-team testing. The company screens
double-stranded DNA orders for sequences associated with controlled organisms
and can stop an order while it verifies the customer's intended use and
relevant authorization.
But scaling that process is not trivial.
Synthetic DNA is ordered at enormous volume. Screening has
to be fast enough not to destroy commercial turnaround times, accurate enough
to catch meaningful threats and nuanced enough not to drown scientists in false
alarms.
Twist encountered exactly this tension as DNA synthesis
scaled. Industry discussions have noted that screening can impose substantial
fixed costs and that false-positive findings can require significant manual
review.
One practical response was to supplement internal screening
with specialized technology. The
International Gene Synthesis Consortium brings together gene-synthesis
organizations around common approaches for screening DNA sequences and
customers, while recent work has increasingly focused on adapting screening to
the realities of AI-assisted biological design.
The bigger issue: AI is compressing the biological design
cycle. Perhaps the most consequential change is not that AI can
generate one unusual genome. It is that AI can potentially compress the time between hypothesis
and experiment. Biological discovery has historically been slow partly
because biological systems are complicated. Researchers generate hypotheses,
design experiments, wait for synthesis, run experiments, analyze results and
repeat. Generative models can accelerate the design stage
dramatically.
That is enormously valuable. For antimicrobial resistance, for example, engineered
bacteriophages could eventually provide highly specific alternatives or
complements to traditional antibiotics. The recent work itself was motivated
partly by the possibility of designing phages capable of attacking bacteria
that have become resistant to existing treatments.
The same capability could eventually contribute to enzyme
engineering, vaccine research, diagnostics, industrial biotechnology and other
areas.
The paradox is that the same design acceleration that makes
beneficial research cheaper and faster can also lower the barriers to
experimentation with biology. That is the classic dual-use problem. The technology does not need to be "good" or
"bad." It needs to be governed according to what it enables. Why the current findings should neither be dismissed nor
sensationalized. There are two easy reactions to this development.
The first is panic: AI can now create viruses, therefore
the apocalypse is around the corner.
The second is dismissal: They're only bacteriophages, so
there is nothing to worry about.
Both miss the point.
The current experimental system has meaningful limitations.
The organisms were small bacteriophages, the researchers deliberately excluded
higher-risk viral classes from parts of the training and experimental design,
and the work does not demonstrate the ability to generate a dangerous human
pathogen. Recent analysis has also suggested that the demonstrated designs
remain relatively close to known evolutionary sequence space, and that the
findings should not simply be extrapolated to much larger or more complex
viruses.
At the same time, the experiment establishes something
important enough that policymakers and industry cannot reasonably wait until a
more capable system appears. The lesson is not "AI has created a bioweapon."
The lesson is: AI has demonstrated that biological design can be automated
at a level that previously required substantial human expertise and
experimentation. That changes the risk landscape. The next generation of safeguards needs to be AI-native. The old biosecurity model was built around biological
materials. The emerging model needs to protect biological knowledge,
digital designs and physical synthesis simultaneously. That could mean stronger screening of DNA orders, better databases
of sequences and biological functions of concern, model-level restrictions
around high-risk biological design, independent red-team evaluations,
provenance tracking, customer verification and clear escalation mechanisms for
suspicious activity.
It could also mean that AI systems used for biological
research need to behave differently from ordinary consumer chatbots. A general-purpose assistant can be evaluated primarily on
whether it produces accurate and useful information. A biological design system needs another dimension: What happens if the answer is acted upon?
That is a fundamentally different safety question. NIST researchers and collaborators have argued for built-in
safeguards such as model alignment, anti-jailbreak mechanisms, unlearning and
other AI-native controls. At the same time, the synthetic-biology industry is
working on screening standards and technical infrastructure around DNA
synthesis.
Neither layer is sufficient alone. Together, they begin to resemble a real security
architecture. A new definition of "biological infrastructure". There is a broader lesson here for technology leaders. We tend to think of infrastructure as servers, cloud
platforms, networks and databases. In the age of AI-driven biology, infrastructure increasingly
includes genetic databases, foundation models, synthesis providers, laboratory
automation platforms and the controls connecting them. That means biosecurity cannot remain exclusively inside
laboratories or government agencies. AI companies need to understand biological risk. Biotech companies need to understand AI risk. DNA synthesis companies need to understand both. Governments need enough technical expertise to regulate
without accidentally freezing beneficial research. And researchers need to accept that once biological design
becomes software, cybersecurity-style thinking becomes part of the scientific
discipline.
The most important security boundary may no longer be the
laboratory door. It may be the interface between a model and the physical
world. The road ahead: The emergence of de novo viral design is an inflection
point, but it is not the end of the story. Today's successful demonstration involved a relatively
simple bacteriophage. Tomorrow's models will almost certainly become better at
understanding longer-range genomic relationships, cellular context and
biological function. Evo 2 itself was designed as a general biological
foundation model rather than a single-purpose virus generator, and its
capabilities continue to expand across genomic prediction and design.
That trajectory creates enormous scientific opportunity. It could also create a world in which biological
experimentation becomes increasingly software-defined. And once biology becomes software-defined, the familiar
technology question returns: Who controls the API? Who audits the model? Who monitors the
outputs? Who controls the physical interface? And what happens when the system
is wrong?
Those questions are much more important than whether we call
the technology "AI-generated viruses."
The real story is that the boundary between discovering
biology and designing biology is beginning to disappear. Nature spent billions of years exploring biological
possibilities. AI is learning from the record. The responsible challenge now is to make sure that humanity
can explore the next part of that design space without accidentally turning the
world's biological knowledge into an uncontrolled engineering toolkit.
That is the real biosecurity conversation, and it needs to
begin well before the next generation of models arrives.
#AI #Biosecurity #SyntheticBiology #Genomics
#ArtificialIntelligence #Biotechnology #GenAI #DNA #LifeSciences #Cybersecurity
#RiskManagement #ResponsibleAI #DigitalBiology
