But even if the probability is low, an effective biological weapon could have an enormous impact, potentially killing millions of people. Dozens of experts told The Times that A.I. is one of several recent technological advances that have meaningfully increased that risk by expanding the pool of people who could cause harm.<\/p>\n
Protocols once confined to scientific journals have been salted across the internet. Companies sell synthetic bits of DNA and RNA directly to consumers online. Scientists can split up sensitive aspects of their work and outsource the tasks to private labs. And all of those logistics can now be managed with the help of a chatbot.<\/p>\n
Kevin Esvelt, a genetic engineer at the Massachusetts Institute of Technology, shared conversations in which OpenAI\u2019s ChatGPT explained how to use a weather balloon to spread biological payloads over a U.S. city. In another chat, Google\u2019s Gemini ranked pathogens by how much they could damage the cattle or pork industries. Anthropic\u2019s Claude produced a recipe for a novel toxin adapted from a cancer drug. Other chats contained information that Dr. Esvelt \u2014 known in his field as something of a Cassandra \u2014 felt was too dangerous to share.<\/p>\n
A scientist in the Midwest, who requested anonymity because he feared professional reprisal, asked Google\u2019s Deep Research for a \u201cstep-by-step protocol\u201d for making a virus that once caused a pandemic. The bot spit out 8,000 words of instructions on acquiring genetic pieces and assembling them. While the response was not entirely accurate, it could have still significantly helped someone with malicious intent, the scientist said.<\/p>\n
The Trump administration, resolved to lead the world in A.I. innovation, has dialed back<\/a> oversight<\/a> of the technology\u2019s risks. What\u2019s more, several top biosecurity experts \u2014 including the leading scientist on the National Security Council \u2014 left the executive branch last year and have not been replaced. Federal budget requests for biodefense efforts shrunk<\/a> by nearly 50 percent last year. (A White House official said that the administration was committed to keeping Americans safe and that some staff on the N.S.C. and several agencies were focused on biodefense.)<\/p>\n The technology\u2019s proponents argue that it will transform medicine for the better, speeding up experiments and crunching enormous data sets to discover new cures. Some scientists believe the upside for humanity easily outweighs any incremental new risks. Chatbots, the skeptics say, present information that\u2019s already available on the internet. And making a deadly virus requires years of hands-on expertise.<\/p>\n Anthropic, OpenAI and Google said they were constantly improving their systems to balance potential risks and benefits. The chats shared with The Times, they said, did not provide enough detail to allow someone to cause harm. (The Times is suing<\/a> OpenAI, claiming that it violated copyright when developing its models. The company has denied those claims.)<\/p>\n A Google spokeswoman said the company\u2019s newest models would no longer answer the \u201cmore serious\u201d inquiries, including the one asking for the virus protocol. A new report<\/a> found that Google\u2019s latest model was worse than other leading bots at refusing to answer high-risk biological prompts.<\/p>\n One of the country\u2019s loudest voices of warning comes from the A.I. industry itself. Anthropic\u2019s chief executive, the trained biologist Dario Amodei, wrote<\/a> in January about the risks he saw in A.I. development, including autonomous weapons and threats to democracy. One risk outweighed the rest.<\/p>\n \u201cBiology is by far the area I\u2019m most worried about, because of its very large potential for destruction and the difficulty of defending against it,\u201d he wrote.<\/p>\n \u2018Historically Catastrophic\u2019<\/p>\n Dr. Esvelt has for years warned scientists, journalists and lawmakers<\/a> about the dangers of synthetic biology if left unchecked. In 2023, he helped craft a stunning demonstration of how chatbots had raised the stakes.<\/p>\n He asked ChatGPT to help him assemble a pathogen that could cause mass death. The bot provided accurate instructions, even outlining which raw materials to buy. He put the unassembled biological pieces into test tubes and packed them in a box, which a colleague then brought to a White House meeting on biological risks.<\/p>\n Dr. Esvelt has continued to probe leading chatbots, sometimes posing as a crime writer seeking plausible methods of spreading viruses, or as an ethicist trying to educate others. Often he plays a version of himself: a scientist exploring the intricacies of virology.<\/p>\n He and other scientists worry about publicizing these risks in news articles that could draw a road map for bad actors. But they also hope that public scrutiny will encourage companies to make their products safer.<\/p>\n Got a confidential news tip?\u00a0The New York Times would like to hear from readers who want to share messages and materials with our journalists.<\/p>\n \u201cAnything where there isn\u2019t an expert warning them, they can\u2019t fix,\u201d said Dr. Esvelt, who has consulted for Anthropic and OpenAI. He said the industry should censor a wider swath of biological information and share it only with approved users.<\/p>\n He shared transcripts showing how the bots paired scientific rigor with strategic reasoning.<\/p>\n Gemini, for example, gave Dr. Esvelt a list of five pathogens that could harm the cattle industry and estimated the potential economic damage of each. One of the threats, it said, was \u201chistorically catastrophic.\u201d In a different conversation, the bot told him how to get a biological weapon through airport security without being detected.<\/p>\n The Google spokeswoman said that its team of biology experts determined that the chats, made with an earlier model of Gemini, presented information that was publicly available and not harmful.<\/p>\n Anthropic\u2019s Claude offered Dr. Esvelt a recipe for a new toxin that would sterilize rodents. He said that it would be relatively easy for a biologist to adapt the toxin to people.<\/p>\n Alexandra Sanderford, a safety leader at Anthropic, disagreed: \u201cThere is an enormous difference between a model producing plausible-sounding text and giving someone what they\u2019d need to act.\u201d She acknowledged, however, that A.I. posed risks, and said that Anthropic had set aggressive refusal thresholds for biological prompts, \u201caccepting some over-refusal out of an abundance of caution.\u201d<\/p>\n Dr. Esvelt asked ChatGPT about using weather balloons to drop substances from high altitudes. At first, the bot repeatedly warned about the dangers of this activity.<\/p>\n \u201cI\u2019m not going to help you model or optimize dispersal of biological material (seeds, pollen, spores),\u201d ChatGPT said, explaining that the information would be \u201ctoo easy to repurpose for harm.\u201d It then ignored its own warning and modeled the airborne spread of pollen grains over a large Western city.<\/p>\n An OpenAI spokeswoman said that this example did not \u201cmeaningfully increase someone\u2019s ability to cause real-world harm.\u201d The company works closely with biologists and the government to add appropriate safeguards<\/a> to their products, she added.<\/p>\n The leading models are also vulnerable to so-called jail-breaking, in which people feed the bots specific prompts known to bypass safety filters. After The Times attempted a standard jail-breaking approach, ChatGPT discussed details of the lethal virus that was the focus of the White House demonstration nearly three years ago.<\/p>\n The models\u2019 safeguards are \u201clike a flimsy wooden fence that is easy to overcome,\u201d said Dr. Cassidy Nelson of the Center for Long-Term Resilience, a British think tank. OpenAI\u2019s spokeswoman said that the company regularly monitored<\/a> for jail-breaking vulnerabilities.<\/p>\n Even when A.I. models are updated with safer controls, the older versions are often readily available.<\/p>\n For example, Dr. Esvelt said that Anthropic adjusted Claude\u2019s filters so it would refuse to discuss a specific agricultural threat. When The Times asked certain questions about the same microbe, the bot refused to answer \u2014 and suggested switching over to a previous version to continue the conversation. Ms. Sanderford said this was an intentional strategy because older models were less likely to provide harmful information.<\/p>\n Still, the older model went into detail about the \u201coptimal conditions\u201d needed for the pathogen to decimate thousands of acres of a crucial crop.<\/p>\n A Range of Risks<\/p>\n The Times shared the transcripts with seven experts in virology and biosecurity.<\/p>\n Dr. Moritz Hanke of the Johns Hopkins Center for Health Security said that some of the chatbots\u2019 proposed strategies to spread infection were \u201cremarkably creative and realistic.\u201d<\/p>\n Dr. Jens Kuhn, a bioweapons expert who once worked at one of the most secure laboratories in the U.S., said that the chats offering logistical details \u2014 such as the weather balloon instructions \u2014 could help skilled biologists brainstorm and refine their plans of attack.<\/p>\n \u201cA major problem that experienced actors have is not necessarily making the virus but turning it into a weapon,\u201d Dr. Kuhn said.<\/p>\n Others cited recent research suggesting that A.I. models could be misused for biowarfare. One study<\/a>, for example, asked leading chatbots difficult questions about a range of laboratory protocols. The results shocked the field: ChatGPT outperformed 94 percent of expert virologists.<\/p>\n Another, published<\/a> in Science last year, focused on companies that sell synthetic DNA. Many use software to screen orders for genetic sequences linked to toxins and pathogens. But the study found that A.I. tools came up with thousands of variant sequences for dangerous agents that the screening software could not detect. (The researchers suggested a fix to improve the software.)<\/p>\n Still, A.I. users would need some real-world expertise to follow a bot\u2019s instructions. Some research<\/a>, including a study<\/a> backed by A.I. companies, has found that while chatbots can help novices learn certain lab skills, the technology isn\u2019t particularly helpful for carrying out the range of complex tasks needed to make a virus from scratch.<\/p>\n Viruses are complex machines, similar to the world\u2019s finest clocks, said Dr. Gustavo Palacios, a virologist at Mount Sinai in Manhattan who once worked at a Department of Defense laboratory. \u201cDo you think that a do-it-yourself person could disassemble a Swiss watch and then reassemble it?\u201d<\/p>\n He said he was concerned, however, about A.I. in the hands of experienced actors.<\/p>\n A recent terrorist attempt<\/a> in India suggests that malicious actors are already using the technology. In August, the Gujarat police arrested a 35-year-old physician, saying he was plotting an attack on behalf of the Islamic State. He was accused of trying to extract ricin, a lethal toxin, from castor beans. The doctor had sought advice on his preparations from A.I.-powered Google searches and ChatGPT, a lead investigator told The Times.<\/p>\n The OpenAI spokeswoman said that, based on public reports, the doctor sought \u201cinformation that\u2019s already accessible online.\u201d The Google spokeswoman said the company did not have enough information to comment.<\/p>\n Skeptics note that restricting the biological capabilities of A.I. models could stifle lifesaving advances, such as discovering new drugs. Scientists at Google shared a Nobel Prize in 2024 for developing an A.I. model that could predict the three-dimensional structure of proteins \u2014 crucial building blocks of a cell \u2014 and create new ones.<\/p>\n \u201cThere is tremendous upside to the technology,\u201d said Brian Hie, a computational biologist at Stanford. Last year, he used an A.I. model called Evo to design a virus<\/a> that destroys harmful bacteria.<\/p>\n The latest version of Evo, he said, can design beneficial proteins to fight cancer \u2014 but also has the potential to invent lethal toxins no one has seen before.<\/p>\n Hari Kumar contributed reporting.<\/p>\n K<\/p>\n K. P. Greiner<\/p>\n Cincinnati Ohio<\/p>\n My question: Why publicize this information?<\/p>\n Gabriel J.X. Dance<\/p>\n Deputy Investigative Editor<\/p>\n @K. P. GreinerIt\u2019s a great question, and one that we are constantly weighing when it comes to reporting these types of stories. The scientists were willing to share chat transcripts with us on the condition that we would not share certain information, such as the name of the pathogens or other actionable details. At the same time, we felt like it was important to share the concerns of these scientists, and also give the companies the opportunity to address them directly. The biological risks of A.I. are something that the companies are very aware of, but talking with my friends and family, it quickly became clear that most consumers aren\u2019t aware of the potential danger.<\/p>\n![\"\"\/](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/04\/cropped-602cbe3a2203f0975ef3dc0e6ac19e8c6223b9063b2b95f7625b76c58ab312dcc8472866.png\")
<\/p>\n