AI-enabled bioterrorism is moving from a distant safety debate into a near-term governance problem for labs, startups and investors.
The concern is not that a bored novice can ask a chatbot to create a pandemic over the weekend. The more serious problem is quieter. Frontier models are getting better at explaining biological work, troubleshooting failed experiments and connecting pieces of technical knowledge that used to require years of training and institutional access.
That is why biosecurity specialists have become more anxious in recent months. According to The Economist's recent reporting, OpenAI, Anthropic and Google all increased precautionary safeguards last year because they could no longer rule out their models helping people with limited scientific training work toward biological weapons. That is a very different place from the older debate over whether chatbots merely repeated information already available on the internet.
The evidence is mixed, which is exactly what makes the issue hard for companies to manage. Britain's AI Security Institute reported in December 2025 that major models could produce scientific protocols for synthesising viruses and bacteria from genetic fragments. RAND researchers also showed that commercial models could assist with one of the more difficult steps in assembling poliovirus RNA. These are not consumer product demos. They are signals that models can reduce friction in sensitive workflows.
At the same time, the jump from a plausible protocol to a working pathogen remains large. Michael Imperiale, a professor emeritus at the University of Michigan Medical School, has cautioned that releasing a dangerous agent is not simply a matter of placing genetic material into cells and waiting for a virus to appear. Wet-lab work depends on judgment, tacit experience and the ability to understand why an experiment failed. Biology still resists neat automation.
But the models are improving at precisely those messy middle steps. SecureBio's Virology Capabilities Test, which asks difficult troubleshooting questions, has become a benchmark for this risk. In one study, expert virologists scored an average of 22 percent on portions of the test, while biology novices using large language models scored 28 percent. The newest models tested on their own scored far higher, in the range of 55 percent to 61 percent, close to top human virology teams.
That does not mean the machines are reliable lab partners. Active Site, a Cambridge nonprofit, ran a controlled wet-lab trial with 153 participants who had minimal biology experience. AI assistance did not produce a statistically significant uplift compared with internet search, and participants often received answers that looked convincing but were wrong. Joe Torres, one of the study's authors, has argued that this should temper fears about total novices.
The more uncomfortable question is what happens when the user is not a novice. Cassidy Nelson of the Centre for Long-term Resilience has noted that people with advanced biology degrees may be better positioned to extract useful help from models. Anthropic has also found that advanced models can help PhD-level experts work faster and draft stronger protocols, even though those outputs can still contain errors serious enough to sink the experiment.
For AI labs, biosecurity is becoming a cost center and a competitive divider. The largest companies can afford red teams, model evaluations, secure access tiers, usage monitoring and specialist review boards. Smaller labs and open model projects may not have the same resources, even when their tools are powerful enough to matter.
That creates a moat. Enterprise buyers, government agencies and pharmaceutical partners will increasingly ask whether a model has been tested for biological misuse, whether dangerous workflows are blocked, whether suspicious activity is logged and whether access can be restricted by user type. A startup selling into biotech or public-sector research may soon need credible biosecurity controls in the same way cloud companies now need security certifications.
The open-model question is harder. Once weights are released, access controls and refusal systems become much less useful. Cloud tools can be monitored. Agentic workflows can be rate-limited or audited. Open models can be modified, fine-tuned and wrapped inside systems their original developers never see. Current rules are not built for that full stack.
Biological design tools make the gap wider. Systems such as Evo 2, developed by the Arc Institute with Nvidia and academic partners, show how AI can model and generate genetic sequences at large scale. The legitimate upside is enormous, from drug discovery to new enzymes and vaccines. The risk is that tools built to design useful biology may also help design biology that evades today's screening systems.
A startup market is forming
There is also an opportunity here, though it is not the easy kind. Startups can build the infrastructure that responsible AI biology will need: sequence screening, customer verification, secure research environments, audit logs for model-assisted lab work and compliance tools for cloud labs. The strongest businesses will not sell fear. They will sell trusted access.
Investors should watch procurement language. Once hospitals, universities, defense agencies and pharmaceutical companies start requiring biosecurity attestations from AI vendors, the market changes quickly. Safety moves from a values statement to a buying condition. Liability also moves closer to the product team, especially when an AI system touches lab automation, synthesis ordering or agentic research planning.
The practical takeaway is clear. AI founders working anywhere near biology should treat biosecurity as product architecture, not public relations. Investors should diligence it before a company signs regulated customers. The world may not be on the edge of a nightmarish age of AI-enabled bioterrorism, but the governance burden is arriving now, and the companies that understand it early will have the cleaner path to market.
Also read: ChatGPT is turning game taste into a startup opening • A layoff at 55 turned an AI consultancy into a late-career bet • AI resume screening is turning hiring bias into a founder risk.
