The risk does not require AGI
Advanced AI could increase biological risk by helping a malicious actor search literature, compare options, troubleshoot laboratory work, or operate specialized biological tools. A model would not need consciousness, superintelligence, or complete autonomy to matter. It would only need to reduce one or more bottlenecks in an already dangerous workflow.
That mechanism is plausible and important, but its current magnitude is uncertain. The 2026 International AI Safety Report concludes that relevant capabilities have improved and that some newer studies find meaningful assistance on proxy tasks, while earlier studies found small or statistically insignificant effects. It also emphasizes continuing material barriers and major evaluation gaps (International AI Safety Report 2026). The accurate position is therefore neither “AI can already create a pandemic” nor “models merely repeat harmless internet facts.”
What researchers mean by uplift
An uplift study compares performance with AI assistance against a baseline such as internet access alone. The result depends on who participates, what task they attempt, what model and safeguards are used, how performance is scored, and whether the task is a paper plan, a proxy acquisition exercise, or actual laboratory work.
Information is only one part of a biological attack chain. An actor may need to select an agent, obtain materials, acquire tacit laboratory skill, perform quality control, scale production, avoid self-harm and detection, and achieve dissemination. AI could help substantially with one stage while the whole operation remains beyond the actor. Conversely, modest assistance at the right bottleneck could matter more than a large score improvement on an irrelevant test.
Safe studies avoid producing operational instructions and use expert review, controlled settings, and proxy tasks. Even then, external validity is difficult. Participants may not resemble real threat actors. Short studies cannot capture months of troubleshooting. Rapid model change can make a careful result obsolete soon after publication.
The evidence changed after early null results
A 2024 RAND red-team study found no statistically significant difference in expert ratings of biological attack plans made by teams with language-model access and teams using the internet alone. RAND concluded that attack planning lay beyond the tested models’ capability frontier as assistive tools, while warning that it had not measured how far beyond (RAND report). That was meaningful evidence about those models, participants, and planning task—not a permanent finding about all future systems.
Later evidence is more concerning but still incomplete. The 2026 International AI Safety Report describes a newer real-world uplift study in which unsafeguarded general-purpose AI provided substantial assistance on bioweapon-acquisition proxy tasks compared with internet access. It also notes studies of models supporting scientific work and laboratory equipment. These results update the picture: it is no longer accurate to say current systems have not meaningfully lowered practical barriers. It remains difficult to quantify how much overall risk has risen or which material bottlenecks persist.
Developer evaluations add evidence but have conflicts of interest and often withhold sensitive details. They should be labeled as company self-reports and interpreted alongside government and independent work.
What Anthropic’s ASL-3 activation means
Anthropic announced ASL-3 protections for the Claude Opus 4 family in 2025 because it could not rule out meaningful uplift in certain chemical, biological, radiological, or nuclear workflows. The company explicitly described the activation as precautionary and said it had not definitively established that the model crossed the relevant capability threshold (Anthropic ASL-3 announcement).
It is important not to collapse several concepts. An AI Safety Level is a package of security and deployment protections. A capability threshold is evidence that can trigger stronger safeguards. Anthropic’s policy has also distinguished non-novel chemical/biological production, novel weapons development, and uplift to more sophisticated programs. “ASL-3” is not a universal scientific rating and does not mean the model can autonomously build every class of CBRN weapon.
Anthropic’s policy has continued to change; its public archive lists version 3.4 as of August 2026 (Anthropic RSP). Readers should use the version and date attached to a model decision rather than importing language from an earlier framework.
Safeguards need several layers
Model and deployment controls include training systems to refuse dangerous assistance, input-output classifiers, monitoring for suspicious multi-step patterns, rate limits, account verification, and controlled access for vetted researchers. These measures can reduce casual misuse but can be bypassed through jailbreaks, task decomposition, access to less-protected models, or removal of safeguards from open weights.
Evaluation-gated release connects test results to decisions. Developers can test during training, commission outside evaluations, restrict tool access, and delay a release when evidence exceeds a defined threshold. Reports should describe residual uncertainty, not only whether a threshold was formally crossed.
Nucleic-acid synthesis screening addresses the bridge from digital information to physical material. Providers can screen customers and sequence orders against risk criteria, with appropriate privacy, appeal, and international coordination. Screening is not sufficient by itself: equipment, pathogens, laboratories, and supply chains vary globally.
Public-health resilience reduces harm regardless of whether an outbreak is natural, accidental, or deliberate. Surveillance, rapid diagnostics, indoor-air improvements, protective equipment, vaccine platforms, medical stockpiles, and trusted communication are broad defenses. Security policies that focus only on model refusals miss this larger system. For the household-level version of that resilience — respirators, air filtration, and isolation planning — see Personal Biosecurity Basics.
Laboratory governance and biosafety remain central. Training, institutional review, access controls, incident reporting, and safety culture address both malicious and accidental pathways. AI can also strengthen defense by supporting detection, drug discovery, and biological research; controls should preserve legitimate work where possible.
How to reason without sensationalism
Separate four statements. First, current models can provide substantial biological information; that is observed. Second, some evaluations indicate practical uplift on selected proxy tasks; that is emerging evidence with limitations. Third, a malicious actor could combine future AI with tools and materials to cause a catastrophic outbreak; that is a plausible risk pathway. Fourth, an AI-caused pandemic is imminent; available evidence does not establish that forecast.
The distinction matters for public trust. Exaggeration can encourage fatalism or advertise capabilities, while dismissal can delay defenses. Reports should describe the tested system, safeguards, baseline, participants, endpoint, uncertainty, and funding. Operational details that would enable harm should not be published.
The practical conclusion
AI-assisted biological risk is among the most concrete severe-harm concerns because useful scientific assistance and dangerous assistance overlap. Evidence has moved beyond the early “no significant uplift” result, but it does not show that models have erased the demanding physical and organizational barriers to a large-scale attack.
The rational response is layered and adaptive: continue independent uplift studies, link model capabilities to enforceable safeguards, secure biological supply chains, and strengthen public health. Those measures remain valuable across a wide range of AI timelines—and they avoid pretending that one company’s safety level is a verdict on the state of biological risk.