Biosecurity by Discretion: AI-Designed Viral Genomes and the Limits of Voluntary Restraint

Sixteen AI-designed bacteriophages worked. Three defence layers held because a careful team chose to hold them. The fourth, the only one backed by a government instrument, is scoped to a different problem and has been under revision since May 2025.

Introduction

On 6 August 2026, the journal Science published the first peer-reviewed demonstration that a generative AI model can design a complete and functional viral genome. Researchers at Stanford University and the Arc Institute, a nonprofit research organization in Palo Alto, used models trained on nucleotide sequence rather than text to write the genetic code for sixteen working bacteriophages. Bacteriophages infect bacteria and cannot infect humans, animals or plants, and these sixteen killed strains of Escherichia coli that had already evolved resistance to the natural virus the designs were modeled on.

Printed in the same issue was a warning from Thomas Inglesby and Moritz Hanke of the Johns Hopkins Center for Health Security, who wrote that the ability to compose viral genomes now exists while the governance to safely steer it does not. However, most coverage treated 6 August as the day a hole in biosecurity opened, and that framing is wrong as a matter of record. Ten months earlier a Microsoft team led by Eric Horvitz reported that AI protein design tools could produce variants of dangerous proteins the screening software used by DNA synthesis providers failed to detect, and that corrective patches had already reached providers worldwide.

Biosecurity has never rested on a single control, and the sixteen phages met several defenses, each with a different owner and enforcement mechanism. Some of those layers the experiment genuinely tested, whereas others held only because a careful team chose to make them hold, which raises the question of how much protection against engineered biology now rests on researchers deciding to be careful.

What the Stanford team built, and what it did not

Evo 2, the larger of the two models used, carries 40 billion parameters and was trained on more than nine trillion nucleotides drawn from over 128,000 genomes across all three domains of life. Its co-creator Brian Hie, an assistant professor of chemical engineering at Stanford, puts the premise directly. Evolution has left its imprint on biological sequences much as the world has left its imprint on the text used to train conversational models.

Fig 1: From two million genomes to sixteen working phages

Three details of the design decide how the result should be read, and all three cut against the most alarming interpretation. The team did not generate a virus from nothing, but worked from an existing bacteriophage called PhiX174 as a template, chosen because its small genome and long history in molecular biology made it a tractable and safe starting point. The models had been fine-tuned on roughly two million bacteriophage genomes, every virus capable of infecting a complex organism was deliberately excluded from the training data, and the work was carried out in a secure laboratory.

What the models produced was nonetheless more than a copy. Some viable designs diverged far enough from the template, sharing roughly forty per cent of its nucleotides, that they would qualify as distinct species, and one carried a functional truncated protein the designers had not specified. Going off script in a way rational human engineering would not have produced is the genuine novelty here, though the yield was low. Of roughly three hundred designs synthesized, sixteen worked.

A real capability, then, with a low hit rate on a small and deliberately harmless template, which raises the question the Science commentary was pointing at. If a team behaving this carefully still produced something no established review process had anticipated, the question is what happens when a team behaves differently.

Five layers of defense, and the two that are voluntary

Answering that means naming the defenses, because public discussion routinely treats as one thing what is in fact five, owned by different parties and enforced by different means. Filippa Lentzos, a reader in science and international security at King’s College London, argues that a layered approach is the only coherent way to think about the risk. The five are training-data curation, model access, synthesis screening, laboratory oversight, and public health surveillance.

Training-data curation governs what a model can learn in the first place, and here it held.

Model access governs who can run the model at all, and it did not apply, because Evo 2 was released openly with its training code, inference code, model parameters and the OpenGenome2 training dataset all published.

Synthesis screening governs what gets physically manufactured, and it is the only one of the five carrying a formal government instrument.

Laboratory oversight governs the conditions the work is done under, and here it held.

Public health surveillance governs what gets detected after a release, and it was never engaged here, since nothing ever left the laboratory.

Fig 2: The four layers the experiment engaged, and how each performed

The pattern is not that the defenses failed. It is that the ones which were held were held in place by choice. Nothing obliged the Stanford team to exclude human pathogens from its training data, and nothing obliges the next team to do so. Arc Institute’s position is that open release is a net benefit, because safety checks can be built into an AI tool in a way that is impossible when a pathogen evolves in nature. That is a serious argument, though it cannot be applied to the access layer, as a model whose weights and training data are public cannot afterwards be gated by anyone, including the organization that released it.

The gap was found in October 2025, not August 2026

Screening needs explaining before its limits can be assessed. When a laboratory orders synthetic DNA, the provider compares the sequence against reference databases of sequences of concern and flags anything resembling material from a regulated pathogen or toxin. The method is homology-based, which is a technical way of saying it tests resemblance, so its accuracy rests on an assumption stated plainly in a September 2026 review in Frontiers in Bioengineering and Biotechnology. A sequence worth worrying about will retain a detectable resemblance to something already in the reference database.

That assumption was tested, and it failed, roughly a year before the phages were published. The Microsoft project asked a single question, which Horvitz has since described in plain terms. Could the protein design tools then arriving redesign toxic proteins while evading detection by the screening tools then in commercial use. They could.

What Microsoft did next is the part almost entirely lost in the coverage of the phages. Rather than publish, the team treated the result as a biological zero-day. It notified the International Gene Synthesis Consortium and federal biosecurity experts, then spent ten months building corrective patches that reached DNA synthesis companies worldwide before a word appeared in print. The International Biosecurity and Biosafety Initiative for Science, which maintains the open-source Common Mechanism screening tool, confirmed its own tool was among those made resilient. The remediation was real and, by the authors’ own reckoning, incomplete, since after patching roughly three per cent of the dangerous variants tested still passed undetected.

However, none of this establishes that screening would fail on an AI-designed bacteriophage, and the distinction matters more than the coverage allowed. The Microsoft paper describes its own remedy precisely. It improved detection of synthetic homologs, meaning redesigned variants of proteins already known and already listed as dangerous. A novel viral genome descended from a benign template is a different object, since no listed agent sits in its ancestry for a resemblance test to find.

The screening tools say as much about themselves. IBBIS notes that the biorisk database underpinning the Common Mechanism draws only on sequences already listed publicly, and that extending it requires sequence-to-function prediction tools that do not yet exist at the maturity the task demands.

It is to be noted that no published source establishes that the Stanford team’s own synthesis orders were screened and passed undetected, and nothing here should be read as claiming they were. The claim available on the record is structural. An architecture built to recognize known agents is not built to recognize a functional genome with no known agent in its lineage. Whether that gap has ever been exercised in practice, nobody has published.

The instrument that would close it has been under revision since May 2025

A limitation of this kind is ordinarily what a regulator narrows over time, which makes the American instrument the least reported part of this story. Screening became a federal expectation through section 4.4(b) of the October 2023 executive order on artificial intelligence, which directed the Office of Science and Technology Policy to build a framework encouraging verifiable procurement screening. The resulting Framework for Nucleic Acid Synthesis Screening issued in April 2024 and made screening a condition of federal life sciences research funding from 26 April 2025, its scope section expressly covering whole organism genomes, viruses among them.

Fig 3: Scheduled, superseded, and still pending

Then on 5 May 2025, Executive Order 14292 directed the Director of OSTP to revise or replace that framework within ninety days. As of 5 October 2026, the Administration for Strategic Preparedness and Response still stated only that agencies will revise or replace it. Two peer-reviewed assessments published during 2026 record the same finding independently, one noting that the resulting uncertainty extends to enforcement of the 2024 framework itself.

The timing carries a specific consequence, as the 2024 framework was written in two stages and the second falls due on 13 October 2026. It narrows the screening window from 200 nucleotides to 50, extends screening to sequences contributing to pathogenicity even where the source agent is not itself regulated, and requires providers to detect attempts to assemble short fragments into longer sequences of concern. That second stage is the part which begins to reach beyond the list of known agents, which makes it the part most relevant to everything above. It becomes due inside a framework its own government has been rewriting for over a year.

Further, no enforceable requirement obliges a provider to follow the guidance at all. The framework binds only the purchasing of federally funded researchers, making compliance a market consequence rather than a legal duty, as a 2026 analysis in Frontiers sets out. It also reaches only federally funded work, leaving an estimated quarter of United States human-pathogen research outside its scope entirely, and the Biosecurity Modernization and Innovation Act of 2026 has sat in Senate committee since January 2026.

All of this assumes the design and manufacturing steps are where the risk concentrates, and several researchers with standing in the field think that assumption is wrong. Tom Ellis, professor of synthetic genome engineering at Imperial College London, argues that taking an existing pathogen and making gain-of-function changes to it is far easier and far likelier to produce a real threat. He told Al Jazeera it would be ludicrous to use AI to design a pathogen when so many already exist in nature. Hsu Li Yang of the Asia Centre for Health Security in Singapore objects on different grounds, holding that the wet laboratory capability required to turn a sequence into a working organism remains substantial and has not changed.

Set against them, Lentzos holds that synthesis is where oversight matters most, because it is the moment a digital genome becomes a physical molecule, while Inglesby and Hanke want a legal prohibition on applying generative design to human pathogens. All four positions rest on judgment rather than measurement, since the disagreement turns on how much capability an actor needs beyond the design step and nobody has published a number for it.

Conclusion

The disagreement among the specialists is narrower than its tone suggests. Nobody quoted disputes that generative models can now produce functional viral genomes, and nobody argues that synthesis screening is unnecessary. Inglesby and Hanke, the most alarmed voices on the record, open by praising the team’s precautions. What separates the camps is urgency rather than direction, and the question dividing them, how much capability an actor needs beyond the design step, has no published number attached to it.

What the record supports is narrower than the coverage suggested, though not reassuring for that reason. Screening asks whether a sequence resembles a known dangerous agent, and a novel genome descended from a benign template is not that object. Nor did August 2026 open the gap, since Microsoft found a version of it ten months earlier and had patches with providers worldwide before anything appeared in print. That is the most encouraging fact in this story and also the most fragile, because the discipline it displayed was a choice, not an obligation.

Which is the pattern throughout. Three of the layers that protected this experiment held because a careful team decided they should. The fourth, the only one with a government instrument behind it, is scoped to a different problem, has been under revision since May 2025, and binds only federally funded purchasing even when it applies. The useful question after the sixteen phages is not whether the safety checks caught this experiment, because they were never built to see it. It is what stands behind them the next time.

About the Author

Ethan Seow is a Centre for AI Leadership Co-Founder and Cybersecurity Expert. He’s ISACA Singapore’s 2023 Infosec Leader, ISC2 2023 APAC Rising Star Professional in Cybersecurity, TEDx and Black Hat Asia speaker, educator, culture hacker and entrepreneur with over 13 years in entrepreneurship, training and education.