Bioweapons as the Optimist's Exception

A response to “Why AI-assisted bioweapons won’t kill you” from Abi Olvera.

Abi Olvera’s piece “Why AI-assisted bioweapons won’t kill you,” alongside her three other pieces on the topic, provides a useful voice of reason against some of the most extreme takes in biosecurity. It is good to see that she spoke with people who have actually worked with pathogens at the bench, and I agree that many of the near-term scenarios with single-actor or small-group threats are less likely than some portray. She is right that bioweapons are hard today. She is wrong to infer that they will stay hard, or that this justifies being, as she puts it, “no longer worried” about bioweapons. Technology will continue to improve, and, even if it didn’t, there are capable adversaries today in the form of state actors. The overall argument gets several important technical things wrong and leaves readers with the false impression that biosecurity should not be treated as urgent.

The most significant weakness in the piece is the false assumption that because it is difficult to design and manufacture a bioweapon with current technology, it will remain so. This particular opinion is actually highly pessimistic about the rate of growth of technology. Many things used to be difficult that are no longer so. They become accessible as technology advances.

Synthetic biology is not an exception to this, as we have watched costs fall and accessibility rise without fail since its inception. Before 2012, editing a specific site in a genome meant using zinc finger nucleases: custom-engineered proteins that cost $5,000+ to order, and were never widely adopted because they were so difficult to engineer well. CRISPR replaced this. You order the RNA guide sequence and buy the rest off the shelf, with total cost being as low as $30. This is a strong example of an engineering capability that was once siloed to a handful of specialist labs and is now an undergraduate exercise. Synthesis costs have also plummeted. Synthesizing the poliovirus genome cost about $300,000 in 2002, and the materials would cost under $1,000 today.

AI is now an ordinary tool for synthetic biology. DeepMind’s AlphaFold has mostly solved protein structure prediction, a problem which was once thought to be intractable for computers. Frontier AI models have safeguards because frontier AI labs are concerned about their own models’ capabilities. Some may argue that talking about safety is just for good marketing, but frontier labs are taking actions that hurt their bottom line. Anthropic has gone so far as to make Fable unusable for even basic biology. This would be nonsensical if their concerns were unfounded. Open-source models with lower safeguards continue to advance just a few steps behind. When the enabling technology is improving at such a high speed, I find it surprising to hear people claim that the fact that something in biology is difficult now means it will continue to be so this next decade.

This outlook is striking because Olvera’s blog is called “Positive Sum.” She seems to write optimistically about progress, taking the position that it is institutional friction and regulation preventing everything from becoming cheap and abundant. I agree with this, and to me it stands in contrast to this piece. Everything will get better over time, except the technology to make bioweapons?

She also focuses on lone actors and smaller groups, without acknowledging the likelihood of effective state bioweapons programs. We know that multiple states have active bioweapons programs. As I wrote in a prior post, “the most recent 2025 report from the Department of State affirmed that Russia and North Korea maintain offensive biological weapons programs. It raised continued compliance concerns re: Iran and China, noting that PLA military medical institutions are conducting research with potential bioweapons applications, and warned (for the first time) that China is capable of using publicly available AI/ML tools to advance efforts related to bioweapons.” States already possess both BSL-3 and BSL-4 labs, as well as accompanying trained personnel.

She says of potential adversaries: “For almost any goal they have, a bomb, a gun, a chemical, or a cyberattack is cheaper, faster, and more controllable.” However, the “almost” is critical here. There are several reasons why a threat actor would choose to deploy a bioweapon over other options, not the least of which are their capability for unprecedented, self-propagating destruction and the difficulty of attributing an attack to a particular actor.

She lists five main reasons for bioweapons not being the weapon of choice, which I will address one by one:

1. “You have to be comfortable killing your own people. Pathogens kill indiscriminately. Few groups are this malicious and extreme. Groups that are tend toward paranoia and rigid hierarchies that make them less effective.”

The two actors we are most worried about, state actors and terrorists, overcome this objection. State actors can stockpile vaccines for their own population and vaccinate their scientific personnel –– the Soviets did both during the Cold War. Terrorists may view loss of life on their side as a form of martyrdom, or even total loss of life as the goal, like Aum Shinrikyo.

2. “You need significant resources. Bioweapons capable of harming many people need equipment, chemicals, and professionals trained in different fields.”

First, state actors have significant resources. Second, the resources you need to do this are falling year-over-year. Third, we have already seen cult Aum Shinrikyo recruit scientists and purchase equipment, so we know it is possible. Last, many terrorist groups are in fact quite well-funded. Expecting capital to be the barrier, as costs rapidly fall, does not make sense.

3. “You need an institution for access. Many items are too niche for black markets. Essential equipment like biosafety cabinets or fume hoods requires professional installation and ongoing manufacturer support. Some materials are restricted; for example, viruses need host cells, cell lines are sold only to institutions, and plasmids require institutional credentials. In the United States, only tens of thousands of people have sustained access to such facilities and supplies.”

You do not need an institution for most specialized equipment and materials. Most things can be found in an average biology lab or acquired used online. A determined actor can find workarounds for any part of the workflow, including finding providers who don’t screen nucleic acid orders, routing orders through proxies, or committing theft. We should also remember that a state actor faces none of these constraints, and that a threat actor could be an insider at an existing institution. The FBI concluded that the 2001 anthrax letters came from a government researcher with institutional access. “Tens of thousands of people” is a lot of people.

4. “Your team must be both highly competent and completely secret. A contamination incident could destroy the pathogen or infect the team.”

The Soviets ran an effective 30,000-person bioweapons program for two decades. 30,000. The program, Biopreparat, had a civilian cover. It did not completely escape detection. Western agencies had some suspicions, and the 1979 Sverdlovsk anthrax release was noticed internationally but mostly successfully blamed on contaminated meat. However, the existence of a program of that extent was only confirmed when Vladimir Pasechnik and Ken Alibek defected. There were multiple instances of contamination and infection of the scientists who worked on the program, including Alibek himself, and the program continued. One researcher, Nikolai Ustinov, died from contamination with Marburg. His colleagues harvested the mutated virus from his body, found it more virulent, named it Variant U, and weaponized it.

5. “You need to convince and retain experts from different domains. e.g. biology, chemistry, engineering, aerosolization, or fieldcraft to carry out attacks. Recruiting without detection is hard too.”

Even non-state actors are not limited to poorly trained or low-competence individuals, yet people repeatedly make this assumption. It’s rare, but history shows us clear examples of highly educated and technically capable people who chose to pursue sophisticated terrorism. Consider Ted Kaczynski, a Harvard-trained mathematician who taught at Berkeley before becoming known as the Unabomber, and Ayman al-Zawahiri, a trained surgeon who ran al-Qaeda’s biological weapons effort. Al-Zawahiri recruited Yazid Sufaat, a U.S.-trained biochemist, to do some of al-Qaeda’s benchwork.

She closes this section with Aum Shinrikyo as an example of why bioweapons are hard: “Aum Shinrikyo, a Japanese cult with ~$1 billion, failed in all ten of their attempts to release biological agents.” First, I want to note that Aum’s bioweapons budget was actually something like only $3M/year out of the ~$1 billion. Second, I agree that bioweapons are hard, and that Aum is evidence for this. However, I think Aum is even better evidence that a group has already had the motivation, capital, equipment, and staff to commit a biological attack. In modern times, such a group would have access to significantly better information and technology.

Regarding laboratory benchwork, the piece also overstates how difficult basic techniques are. Olvera cites pipetting as an example. I have spent many hours in the lab pipetting small volumes. It took me ~1 week to get good at it, and the same is true for the dozens of other students I worked with. The idea that benchwork represents some insurmountable barrier is false. I would argue that benchwork is not hard because of technique; it is hard because biology is unpredictable. Sometimes your antibodies just don’t work, etc. This would not be significantly more difficult for a threat actor than for a newer scientist. We should also not assume this threat actor will have no access to training, nor that they could not be a scientist themselves. Even with just a few months of training, there is not a lab technique I can think of that is out of reach. Moreover, soon more cloud labs like Emerald will come online, robotic pipettes and cell culture will become more common, and labs will shift, as all sectors always have, towards increased automation. Soon, a threat actor need not even be in the lab to make a weapon.

Olvera points out correctly that AI uplift for benchwork is not currently a major concern. She writes, “The largest such study to date, by ActiveSite, indicated that non-experts with access to mid-2025 LLMs performed better on individual virology tasks but saw no meaningful improvement in end-to-end workflows. Success rates on these basic workflows remained below 8%.” Though the measurable uplift for non-experts is small, meaningful improvement on individual tasks eventually leads to improvement in end-to-end workflows, even if it does not now. Let’s do the math. Assume we have five sequential steps at 60%. I chose 60% because this would yield a 7.8% success rate, close to the sub-8% figure the study reports. If you got each step to 80%, the same workflow would make a big jump to a 33% success rate. AI is highly capable of benchwork troubleshooting, as indicated by SecureBio’s Virology Capabilities Test, which demonstrated that o3 performed better than 94% of expert virologists, even in April 2025. This is evidence that AI will be able to provide uplift to some of the steps, especially as it improves. The ActiveSite study was also a time-restricted study. In biology, it takes time to get every step right. This means that things go from not working at all to working well, very quickly. A study like this run over a year, I believe, would have substantially different outcomes. And that is the experiment we are running in the real world right now.

The claims Olvera makes that I disagree with most are: “Any pathogen that a team could plausibly create is one that already exists in nature. An engineered version of COVID-19 would have about the same effect as an infected person coughing in a crowded room.”

First, progress in generative biology undermines the claim that any plausible engineered pathogen would be something that already exists in nature. AI model Evo has already successfully designed novel viral genomes and the Arc Institute demonstrated them as functional in the lab. She argues that this particular example is irrelevant: “Some people cite bacteriophages as evidence of AI-created novel viruses; however, practitioners don’t consider them truly novel. These are 7% different from nature, which is seen as normal evolutionary change.” 7% different is meaningfully different, enough to be considered a new species under some taxonomies. For instance, under criteria from the International Committee on Taxonomy of Viruses, a phage genome below 95% ANI to any known relative qualifies as a new species. Evo’s most divergent viable design from this trial, at 93.0% ANI, qualifies. Calling this normal evolutionary change is only true in the sense that speciation is normal. “Normal evolutionary change” at the pace of a lab and not at the pace of evolution is decidedly not normal.

Olvera then writes, “These engineered bacteriophages don’t need to evade the immune responses that even bacteria possess, making it unclear whether they’re viable compared to natural viruses that have survived that selection pressure.” The point of the Arc Institute project was not to make more infectious bacteriophages, just novel ones. They made them intentionally similar to ΦX174, so this is not relevant to the issue at hand. Even if this were not considered a “novel virus,” technology is clearly progressing towards this. One can argue about the timeline, but we will be able to do this. We have seen attempts to make chimeric viruses even without the aid of AI. The design space is demonstrably larger than simple modifications of existing viruses.

Second, the claim that “an engineered version of COVID-19 would have about the same effect as an infected person coughing in a crowded room” is dependent on the type of engineering. I think Olvera is trying to say that it would just make COVID more transmissible, glossing over the fact that even if that were all the engineering was able to accomplish, this would still have resulted in millions more deaths. We have in some sense already run the transmissibility experiment: Alpha and Delta spread faster than the original strain, and each drove a wave of deaths far larger than the original strain would have caused. While I think significant changes in lethality and transmissibility are possible, even a modest change to one parameter does not mean a modest outcome.

Olvera adds to the argument above by pointing out that releasing 1918 influenza today would not be “1918-bad,” because we have cross-immunity as most immune systems recognize flu descendants and we have antivirals and antibiotics for the secondary pneumonia that killed most victims. This is of course true, especially since we also have much better medical infrastructure and medicines now. The point I want to make in response is that cross-immunity is precisely the kind of property an engineered modification would target. (Also, the antibiotic argument assumes that we have some very solid supply chains.)

Olvera also writes, “Engineering a virus that is both extremely lethal and highly contagious, worse than anything nature has produced, would be bad. But many biologists doubt this is possible even with perfect technology.” However, there is very meaningful disagreement among experts on how difficult it would be to engineer something both highly lethal and highly transmissible. Only mentioning that many biologists consider this impossible even with advanced technology does not at all reflect the full range of assessments in the field. The lethality versus transmissibility tradeoff is just an observation about what natural selection optimizes for. Engineering can bypass the tradeoff, and some natural viruses already do. Smallpox has an R₀ of ~5 with a fatality rate near 30%. HIV is ~100% fatal untreated, and transmits for years with an R₀ of ~2-5. (For comparison, the original COVID strain had an R₀ of ~3 and an infection fatality rate of ~0.5%.) Both bypass the tradeoff by separating the transmission phase from the lethal phase, a technique which could also be engineered into a weapon.

Olvera states that she interviewed dozens of biosecurity experts and lab practitioners, but she does not name any of them (except for Michael Montague) or describe their specific backgrounds or affiliations. This makes it difficult for me to assess how representative their views are, but my conversations with dozens of biosecurity experts and lab practitioners, as someone who has worked both in biosecurity policy and in a lab, have been very different.

Olvera closes by explaining why her piece is not conventional wisdom. She reminds us that often null results don’t get published, and advocacy groups need urgency. You could cynically say that biosecurity people are motivated to keep their jobs. I am sure that some people are. You should also consider the more likely case that most of us are motivated because we believe the threat is real and significant. Speaking as someone who only recently made biosecurity their full-time priority, I can assure the reader that I would love to be working on something else, and for this not to be such an urgent problem. This is also the sentiment of many people I know in the field. I understand this is anecdotal evidence, but so is her claim that “many leaders in biosecurity and national security organizations” thanked her privately for writing this conclusion.

Some claim that AI helps defenders too, and there is a real argument that in cybersecurity AI improvements can favor defense. Unlike cybersecurity, biosecurity has a profound offense-defense asymmetry. An attacker does not have to go through clinical trials or pay for manufacturing. An attacker has time to design a weapon and can choose when to release, but the defender can mostly only start responding after the attack.

At the end of the day, pieces like this encourage complacency. It is unclear exactly how quickly technology will advance over the next few years, and state actors are already capable of massive harm. Complacency is costly: bioweapons can be weapons of unprecedented mass destruction. We should treat biosecurity as urgent.

Disclaimer: This piece represents my personal views and my personal views only. It does not represent the opinion of any organization I work for or with.