AI and the New Age of Bioweapons

Pathbreaking scientific discoveries can create transformational possibilities. They can also create catastrophic risks. The integration of artificial intelligence, biotechnology, and bioengineering is already enabling life-changing achievements, from combating disease to supercharging agricultural productivity to solving energy challenges. But it is also generating capabilities that can be weaponized more easily than ever by a growing number of actors. The United States is unprepared for these threats.

In the foreseeable future, a terrorist group with minimal skills could access a jailbroken AI model (one that has evaded safety controls) trained on the world’s most comprehensive biological data set. The group could use the model to design a new strain of H5N1 avian influenza that is more lethal and more easily spread from animals to humans than existing strains. Connecting remotely to one of the new generation of fully equipped, contract-for-service “cloud” labs, it could anonymously arrange for the virus to be built and tested and then sent to a biomanufacturing facility to be produced at scale. From there, the group could stealthily disperse the new strain through air-handling systems at major livestock farms across the United States.

Before long, the American poultry, beef, and dairy industries would suffer massive losses. When the virus inevitably jumped to the human population, it would cause severe illness and could result in hundreds of thousands or even millions of deaths. The response from U.S. public and private institutions—lacking both an integrated strategy and adequate tools—would be too slow, too uncoordinated, too underresourced, and too overwhelmed to stop the spread and mitigate the consequences. And soon, the virus would also cross borders, triggering food insecurity, widespread sickness, and mass casualties around the world.

U.S. policymakers have long contended with the possibility of biological attacks from hostile nation-states. Along with surveillance and global risk-reduction initiatives, Washington successfully deterred such attacks with the threat of significant retaliation, including the use of nuclear weapons. Yet that strategy was effective because only a small number of governments were developing the most dangerous biological weapons. It no longer works in a world in which AI allows more actors—rogue states, terrorist groups, even individuals—to develop new bioweapons of their own.

In this new threat landscape, biological attacks are unlikely to be prevented entirely, given the proliferation of biological capabilities and the fact that some actors cannot be deterred by traditional means. Policymakers need a new strategy in response—one that accepts that biological attacks are likely and prepares to contain the harm, helps the country recover more quickly, and uses new tools to identify and hold perpetrators accountable. Ultimately, this resilience to biological attacks could dissuade malicious actors from attempting to use them in the first place, knowing that the effects will be minimized—a strategy of deterrence by resilience.

Consider the attack scenario described above, but with a comprehensive strategy in place. The U.S. government would use a sophisticated biological monitoring system to provide early warning of the emergence of a new viral pathogen. Employing many of the same technologies that enable the threat in the first place, federal laboratories would determine its origin from telltale signatures in the AI model used to design the virus—enabling prompt efforts to track and target the perpetrators. Public health authorities would have the tools to integrate scientific and intelligence data to suppress the disease’s spread. Based on pre-negotiated contracts to provide surge capacity, the biomanufacturing sector would accelerate the production of diagnostics, therapeutics, and vaccines. Although the crisis would not have been prevented entirely, its effects would be speedily and effectively contained: vulnerable human and animal populations protected, contagion minimized, agricultural production recovered, public confidence restored.

Such bioresilience is far from today’s reality. In 2024, H5N1 bird flu spread from poultry to dairy and beef herds and eventually to more than 70 humans. As the White House homeland security adviser at the time, I coordinated the federal response to this potentially catastrophic threat. The virus was naturally occurring, not the result of a deliberate attack. It nevertheless showed that even in this base case, there were considerable weaknesses and gaps in U.S. prevention, monitoring, attribution, and response systems. Data on disease incidence and spread were hard to acquire and exasperatingly incomplete. Mobilizing sufficient preventive action by the poultry and cattle industries proved difficult and slow. And in order to deliver sufficient quantities of human vaccines to protect the American people, we needed to provide substantial new federal funding to rapidly create an mRNA vaccine and divert U.S. pharmaceutical industry production lines to make it at scale, and there would still have been inadequate drug supplies for many months.

The United States urgently needs a new system to generate resilience against AI-enabled biological threats. The reality of this technology means that the very innovation that drives the revolutionary discoveries also creates the new threats—and the same tools that make those threats so dangerous are also essential to countering them. That system, accordingly, will depend on leveraging advances at the intersection of AI, biotechnology, and bioengineering—and staying ahead of adversarial exploitation of the very same advances.

BRAVE NEW WORLD

During the Cold War, U.S. security experts warily monitored the Soviet Union’s biological weapons programs. Their concerns focused on the possible weaponization of rare but known pathogens such as anthrax, Marburg virus, and Variola virus (which causes smallpox) that could be used against American forces in combat—or even against U.S. civilians. After the Soviet empire collapsed, I oversaw the Pentagon’s efforts to reduce the threats posed by its arsenal of weapons of mass destruction. We closely tracked and worked to eliminate legacy stockpiles of deadly pathogens in Russia and other newly independent states.

For decades, Washington relied on deterrence to counter the possibility of adversarial biological attacks—but, notably, not by threatening biological attacks of its own. Indeed, in 1969, U.S. President Richard Nixon officially forswore the research, production, and use of offensive biological weapons. Instead, American doctrine was based on credibly threatening nuclear retaliation.

As the Cold War receded and Moscow and Washington shrank their nuclear arsenals through cooperative threat reduction initiatives, national security experts began questioning whether it was moral or effective to threaten the use of nuclear weapons to deter biological attacks. Nevertheless, across multiple administrations, the United States retained deliberate ambiguity on this front. The most recent U.S. Nuclear Posture Review, in 2022, concluded that “our nuclear strategy accounts for existing and emerging non-nuclear threats with potential strategic effect for which nuclear weapons are necessary to deter.” It added that the “fundamental role” of nuclear weapons is to deter nuclear use against the United States and its allies, but it did not go so far as to assert that nuclear deterrence is the “sole purpose” of the arsenal. The current Trump administration has thus far decided that another nuclear posture review is not necessary, pointing to the adequacy of the doctrine promulgated by the first Trump administration in 2018. That review stated that nuclear weapons could be used against “non-nuclear strategic threats,” which, although not specifically referring to biological attacks, is understood to include them.

Given technological changes at the intersection of AI, biotechnology, and bioengineering, changes that substantially lower the bar to lethal pathogen production and wide diffusion to uses beyond secret state laboratories, this doctrine is no longer fit for purpose, if it ever was. A decade ago, leading experts began to focus on novel pernicious uses of biology. In late 2016, for example, the President’s Council of Advisors on Science and Technology issued the first thorough, unclassified warning about the potential national security risks posed by biotechnology. Those risks, the council wrote, were “real and will only grow as biotechnology becomes more sophisticated in the years ahead.”

The report’s authors went on to explain why. “Biothreats,” they wrote, “differ in significant ways from nuclear or chemical threats in that the initial creation of biologically engineered organisms requires much more modest resources and smaller facilities that cannot be readily distinguished from ordinary research labs. Work undertaken with malevolent intent is thus harder to distinguish from work undertaken for benevolent purposes.”

The report highlighted the gene-editing tool CRISPR, in particular, for its revolutionary positive and simultaneously pernicious potential. CRISPR enables DNA sequences to be quickly cut and modified, giving users the capacity to eradicate hereditary diseases but also to insert changes in the genome that could affect a specific group of individuals—or even alter the human germline, which determines the genetic inheritance of future generations. CRISPR is also, as the advisory report emphasized, a dual-use tool (one with both civilian and military applications) that can be employed without massive investment or expertise.

The brave new world of synthetic biology, in other words, is radically democratizing and dispersing access to the tools used to make bioweapons. Rapid DNA sequencing and synthesis capabilities have collapsed the cost of reading and writing genetic information, just as tools such as CRISPR have broadened the availability of precise genome modification. Now, AI systems trained on biological data can design proteins and predict a multiplicity of interactions at scales previously unimaginable. AI systems and advanced computing also enable generative biology, which makes possible the construction of synthetic biological systems. Finally, digital designs are being linked to increasingly automated laboratory processes, facilitating the production of digital instructions in the real world.

A researcher studying avian influenza at the Institut Pasteur in Paris, November 2025 Gonzalo Fuentes / Reuters

All this innovation is powering immensely positive discoveries across multiple sectors, the most obvious of which is health care. But it is also evaporating the barriers that until now have made it very hard to engineer dangerous biological agents. Performing complex biological work is no longer limited to people whose advanced education and professional occupations would impress on them the gravity of their responsibilities to do no harm. Today, a much greater variety and number of people, including those with little or no formal training, have access to sophisticated AI-enabled biological tools. This dramatic widening of usability—“uplift,” in the parlance of artificial intelligence experts—has become a key measure of how much improvement an AI system provides over what a human being can do without it. And American frontier AI models have rapidly advanced the material uplift available to nonexperts who want to acquire biological knowledge or lab skills to complete scientific tasks. Three years ago, large language models failed simple biology tests. But by April 2025, a group of university and nonprofit researchers found that large language models consistently outperformed Ph.D.-level virologists on tests of the knowledge needed to conduct laboratory experiments.

This fact might be less concerning if large language models and other leading-edge biological tools were cloistered in government labs. But they are not. They are widely distributed, and AI science agents are now available for hire and are ready to accompany their clients on creative journeys, whether benign or malign.

For now, turning a digitally designed pathogen into a real-life threat is restricted by the fact that, in the United States, the work is still done by human beings in traditional “wet labs,” where the physical production of digital orders takes place. But the human role is now increasingly accompanied by robots and automation, in particular with the advent of “cloud labs,” which can receive digital orders, design and execute experiments based on them, and evaluate the outcomes, combined with specialized contract manufacturers that provide biotech production services. Right now, there are no regulations governing any of this activity.

SCIENCE FICTION TO SCIENCE FACT

Today, public officials and private-sector leaders need to be concerned not only about sophisticated states developing and using bioweapons but also about organized nonstate groups, including terrorists, criminal syndicates, and mercenaries, as well as lone wolves. In addition, well-intentioned people might cause a dangerous accident because they do not fully understand the powers they wield.

There are innumerable scenarios for which Washington needs to be prepared. For example, malicious cyber-hackers seeking to wreak havoc could use AI to corrupt the pharmaceutical manufacturing process, creating dangerous, tainted drug products. The results could exacerbate illnesses or cause deaths—and could damage confidence in products more generally, destabilizing the market for American medicines or deleteriously affecting national health care through a reluctance to use previously respected therapeutics.

In another plausible scenario, a politically motivated, loosely organized anarchist network could use an open-source large language model to figure out how to deliver a highly pathogenic virus into large human populations. It might order what appear to be benign fragments from multiple commercial DNA synthesis providers. A member with relevant expertise could then assemble those fragments into a deadly new virus and possibly release that virus into a major American urban area, such as New York or Los Angeles, where it would spread rapidly. In such a scenario, many deaths would precede conclusive diagnoses, treatments would not be readily available, and health-care systems would be overwhelmed. Emergency response mechanisms would be unable to react fast and at scale. Mass panic would ensue.

There are also pernicious potential nation-state applications of AI-enabled biology. For example, a technologically sophisticated foreign adversary could leverage AI, biological design systems, and biomanufacturing tools to engineer a stealthy respiratory pathogen. Through advanced bioengineering, the disease’s symptoms might not emerge until six months after infection. The adversary could surreptitiously release the pathogen near several American military bases, both across the U.S. homeland and elsewhere, as part of a broader plan to launch a military campaign that coincides with emerging mass illness. Simultaneously, under the guise of an annual domestic flu shot program, the adversary country could secretly inoculate its own population against the pathogen. American troops and the civilians with whom they have been in contact would eventually start coming down with severe symptoms, disrupting the U.S. military mobilization and deployment required to respond to the adversary’s initiation of overt hostilities.

And there are possibilities extending beyond human disease vectors. For example, an ideologically motivated American terrorist organization could genetically modify a plant pathogen so that it destroys a key crop such as rice, corn, or wheat in the United States. This would rapidly disrupt domestic food supply and the agricultural economy on which so many livelihoods depend, resulting in food insecurity at home and famine in regions of the world that depend on U.S. crop exports.

These scenarios are not science fiction, and the United States is underprepared to handle any of them. The U.S. biological monitoring and attribution architecture is a patchwork of systems with significant gaps. Its various components are not always interoperable, and the country has no real-time capability to integrate and analyze diverse streams of data at scale. The American monitoring system is designed to diagnose, recognize, and report existing pathogens, but it cannot yet recognize new ones that may be created by AI-enabled biotechnology. Meanwhile, the country’s system for fielding countermeasures to treat and prevent diseases is not primed to move quickly, and it has relatively little surge capacity. The global response system is even more deficient. The early warning network for international biological threats—akin to the national missile defense early warning system—that the United States established and championed over the last two decades across multiple presidencies, including an expansion to more than 50 pivotal countries during the Biden administration, was largely dismantled by the Trump administration in 2025.

Walking past a display at the BIO International Convention, San Diego, California, June 2026 Mike Blake / Reuters

These scenarios also vividly demonstrate that with new biothreats, the long-standing U.S. deterrence-by-punishment concept designed for a small number of state-level adversaries—threatening the imposition of pariah status and the prospect of employing nuclear weapons against a biological attack—is no longer adequate. Today’s AI-enabled biotechnology challenge upends reliance on punishment for four reasons. First, the bio-risk club is already large and will inevitably become much larger than the nuclear club. Biodeterrence needs to shape the behavior of numerous countries and, more consequentially, private-sector and individual actors who are likely to be much less sensitive to state-level interests. Because the building blocks of biological threats are most often dual-use technologies and because they have immense upside, it is not possible to fully prevent the generation of potentially harmful materials or lock them down in government-controlled laboratories and sites, as has been done with nuclear fissile materials. Ultimately, it is not a plausible strategy to threaten to use nuclear weapons against the full array of risks and threats posed by AI-enabled biology, so the threat of nuclear-scale punishment loses credibility.

Second, given the role that AI-enabled biotechnologies already play in multiple sectors of the economies of Washington’s allies and partners, extended deterrence will not be plausible. The United States cannot offer them protection in exchange for forbearance as it has done in extending its nuclear umbrella to protect European and Asian allies. The benefits of bioconvergence—the synergy of advances in AI, biotechnology, and bioengineering—matter too much to each country’s economic and societal well-being.

Third, it is highly doubtful that Washington can either persuade or compel U.S. competitors and adversaries to reliably withhold development of AI-enabled biotechnology capabilities in the same way that it managed the nuclear arms race with the Soviets because nuclear weapons had no other market value than deterrence and warfighting. Bioconvergence, by contrast, promises and indeed is already delivering immense positive potential, and the AI-enabled biotech economy is global.

Fourth, and relatedly, the Trump administration has episodically sought to make it harder for other countries to access and use American frontier AI models, including in June 2026, when it suddenly imposed export controls on Mythos and Fable—cutting-edge Anthropic products that provided AI capabilities to the United Kingdom and the European Union. The controls resulted in an abrupt and total cutoff of access to any foreign user, including allies and U.S.-based individuals. This draconian action was subsequently reversed, but it is likely to stimulate even more international interest in developing domestic AI capabilities, including at the intersection of AI and biotechnology, because dependence on the United States may create vulnerability.

DETERRENCE BY RESILIENCE

Given the near inevitability of natural, accidental, and weaponized biological incidents in the future, anxiety about growing risks is warranted, and it is magnified by the absence of a strategy to effectively manage those risks. The American people are not powerless in the face of this epochal challenge, but it requires a comprehensive plan of action and a sustained commitment to adaptive implementation, both of which must leverage the vibrant U.S. innovation ecosystem to manage biological risks—including those that may be existential.

As a foundational capability for biological risk management, the United States needs a nationwide monitoring system that can provide early warning of emerging pathogens, whether naturally occurring or synthetic. This requires federal and state investments in building the underlying sensing and collection infrastructure, such as wastewater surveillance, and in establishing a distributed laboratory network to rapidly process the data this infrastructure generates.

Those tools would undergird the effort to quickly identify pernicious actors, which would be essential in establishing deterrence. Although some attackers, such as lone wolves, are unlikely to be responsive to threats of punishment, if state-level or state-sponsored adversaries believe that biological attacks will never be attributed to them, they can act with impunity. It is therefore a matter of national security that the United States develop the capacity to quickly determine which hostile adversary is the source of a biological agent.

A new, resilient ecosystem will depend on a backbone of rapid data access, integration, and analysis that should be owned by the federal government but managed as a collaborative consortium with private-sector partners. This will ensure that the United States can absorb, fuse, and evaluate AI and biological data streams from across the country and, optimally, around the world. This enterprise would serve national and homeland security missions, including being able to continuously identify emerging biothreats and understand what they are and what they can do—such as recognizing engineered pathogens that do not match any list of known organisms—and rapidly develop targeted responses. It must feature the capacity to do work in a classified context that provides dedicated computing power and infrastructure for training and evaluating frontier biological models and for managing sensitive biological data.

Detection and attribution, of course, will not stop the spread of disease on their own. In the event of an attack, Washington must be ready to instantly respond to save lives and preserve the economy. After the 9/11 attacks, U.S. President George W. Bush created a national “critical infrastructure” designation, applied to 16 sectors such as chemicals, financial services, energy, and transportation, that enables the federal government and private companies to securely share information and develop thorough plans for effective crisis management. The biotechnology industry should now be designated as a critical infrastructure sector. As part of this designation, Washington should establish a coordinating council for the biotechnology sector that includes DNA synthesis providers, AI model developers, genomic data platforms, cloud lab operators, and high-containment laboratories. The group should exercise regularly with federal, state, and local government partners for biological incident responses, just as the electricity sector does to strengthen grid security and build resilience against all hazards.

Leveraging additional capabilities in the private sector to enable a “warm start”—in which the bio-innovation ecosystem is primed to surge its tools in response to an emerging biological crisis—the United States should establish a national strategic readiness reserve for handling biothreats. This can be modeled on the Civil Reserve Air Fleet, which enables the federal government to promptly make use of commercial planes and pilots when a military aircraft shortage emerges. In the context of a biological threat, similar, preestablished arrangements would assure the federal government of emergency access to the computing power, laboratory facilities and personnel, and production capacity needed for accelerated discovery, design, and development of diagnostics, therapeutics, and vaccines, along with scalable biomanufacturing capacity to make urgently needed tests, medicines, and inoculations. Although the Defense Production Act could enable government access, it does not provide the flexibility needed to prepare for long-term resilience, and invoking it in the midst of a crisis can cost the country precious, potentially life-saving time.

As part of its readiness efforts, the United States must fix the federal clinical trials process, which is far too slow and cumbersome to effectively address a biological crisis. This major bottleneck already limits U.S. biotech competitiveness and diverts activity to China, creating supply chain dependencies with potentially ominous implications for American security. The United States would benefit right now from a reformed clinical trials process, which would help U.S. companies regain their competitive edge—and help Washington demonstrate to would-be attackers that it can move fast to field countermeasures.

Without a comprehensive technological edge, the United States will not be able to rapidly discern the nature of a biological attack, determine where it came from, and quickly figure out how to mitigate its harms by fielding targeted diagnostics, therapeutics, and vaccines. That capability is essential for reducing adversaries’ confidence in their use of biological weapons, for shaping global norms, and for responding effectively when prevention fails.

Testing for avian flu antibodies in Campinas, Brazil, April 2023 Amanda Perobelli / Reuters

Unlike in previous eras, the U.S. government alone cannot maintain the country’s technological supremacy. The ability to characterize and attribute threats, develop countermeasures, and respond rapidly to novel pathogens will depend heavily on the private sector, which needs to be not only a supplier but also an enduring national security partner. The United States must therefore maintain a strong private-sector AI and biotechnology ecosystem that is aware of emerging dangers and incentivized to work with the government to reduce them.

Meeting this challenge requires a sustained, deliberate effort to rebuild and protect the United States’ capacity for biotechnology innovation. Over the last five years, American companies have become increasingly dependent on China for the components used in many drugs sold in the U.S. market and for access to the latest research in therapeutic molecules that can treat or cure diseases, creating substantial supply chain risks. The U.S. pharmaceutical industry is also acquiring a large number of Chinese biotech assets—buying the intellectual property and rights to develop Chinese drugs—particularly in innovative therapeutics. At the same time, it is competing to sell pharmaceutical products into the gigantic Chinese domestic market despite deep concerns that Beijing is stealing intellectual property.

Washington can tackle this challenge and strengthen American firms by revitalizing federal funding for basic science and investing in the human talent to win the biotech race. To do so, Congress should enact legislation that reduces growing dependencies on China and supports the U.S. biotech and pharmaceutical industries via targeted subsidies, public investment in research and development, tax incentives, and other measures. This bill might be modeled, in part, on the 2022 CHIPS and Science Act, which invested hundreds of billions of dollars in research and manufacturing for strategically important sectors. These actions should be paired with measures that expand protections for the United States’ biotech innovation infrastructure, including the strengthening of a national security review process governing foreign investment in the sector. Incentives for collaborative development and production with aligned foreign partners should also be prioritized. In addition, Congress should immediately pass legislation to mandate that DNA synthesis companies screen customers and the sequences they order to prevent malicious actors from abusing this technology; this action needs to be synchronized with comprehensive efforts to strengthen the U.S. biotech innovation sector that can counterbalance the potentially onerous burden of such requirements.

MEET THE MOMENT

Pathogens know no borders. All countries should share the responsibility for preventing terrorists and rogue actors from developing and using AI-enabled biology to perpetrate mass harm. But without American leadership, it will not be possible to build the global institutions, regimes, norms, and practices that advance U.S. interests in prevention and effective crisis response and help protect the entire world from AI-enabled biological attacks. To that end, the United States, in collaboration with close international partners, should launch a series of global biosecurity summits modeled on the four international nuclear security summits that took place from 2010 to 2016. The agenda could include setting common standards for DNA synthesis screening, generating market incentives for secure and resilient AI-biotech tools and systems, conducting pathogen surveillance, ensuring supply chain resilience, and pursuing responsible AI-enabled biotechnology development. Whether within this framework or parallel to it, China and the United States should establish a high-level, technically sophisticated dialogue on AI-enabled biological risk management.

On the home front, American frontier AI companies, such as Anthropic, Google, and OpenAI, have committed to testing their models and ensuring novice users cannot employ them to generate biological weapons. But these undertakings remain voluntary, their effectiveness has not been proved, and these companies’ private incentives will inevitably diverge from public interests. The U.S. government should work concertedly with frontier AI companies and biotechnology developers to establish a framework for tiered access to the most sophisticated of AI-enabled bio models: an AI model trained not on words and text but on sequences of DNA that can predict, edit, and design novel proteins, cells, and viruses. They should also collaborate to establish and enforce specific guardrails for what these models can generate. This includes embedding safety features that prevent malign bioweapons development and embedding mechanisms that enable such misuse to be easily detected. It also includes establishing guardrails around what biodesign tools that facilitate the construction of novel proteins and cells are permitted to do—and how autonomous laboratories are allowed to operate, specifically with respect to whether human beings must remain in the loop to prevent abuse.

Given the pace of innovation, responding to this multidimensional challenge will be an ongoing and iterative process. But this is not the first time the United States has tackled an emerging and potentially existential security threat. In the early 1990s, Indiana Senator Richard Lugar, a Republican, and Georgia Senator Sam Nunn, a Democrat, came together to enact landmark legislation that enabled the United States to prevent the proliferation of nuclear weapons and fissile materials after the collapse of the Soviet Union. Congress authorized and appropriated funds for a comprehensive and consequential series of actions—some unilateral and some cooperative—at home and around the world that ensured that the Soviet Union’s nuclear legacy did not create multiple new nuclear nations and that terrorists could not access Soviet nuclear weapons or the essential components to build their own bombs and delivery systems.

With similarly visionary bipartisan action today, the United States can position itself to excel in developing hugely beneficial commercial applications of biotechnologies while also effectively monitoring, attributing, and responding to biological threats. This will require synergy and deft management between private-sector innovation and public interests. But the United States is capable of balancing these two imperatives. If a nationwide biological monitoring network that depends on private companies to provide services is established, it will offer continuous benefits, including early warning and attribution for a variety of risks. If the clinical trials system can be transformed, it will benefit consumers by strengthening the competitiveness of U.S. industry and onshoring more biotech production. Coupled with investments and incentives for the American biomanufacturing sector, these measures will build up the infrastructure necessary to secure Americans against biological risks. That, in turn, will enable the country to respond promptly in the event of a deliberate attack and make it less vulnerable to supply chain disruptions. The United States will establish deterrence and therefore reduce risks, creating a virtuous cycle in which Americans can begin to have greater confidence in a bioresilient future.

Loading...