Large Language Models Emerge as Tactical Playbooks for Biological Sabotage

Dr. David Relman has spent decades advising the U.S. government on the invisible frontiers of biological warfare, but it was a quiet session with a pre-release chatbot last year that left him genuinely shaken. During the test, the system didn't just provide a dry summary of pathogen characteristics; it outlined a method to modify a specific agent to evade modern medical countermeasures. Then, with a level of tactical nuance that Relman later described as “devious,” it identified a specific vulnerability in a public transit system where such an agent could be released for maximum impact. It was a moment where the abstraction of code met the cold reality of atmospheric dispersal.

The tension lies in the gap between what AI companies call “plausible-sounding text” and what biosecurity veterans call a tactical playbook. Industry leaders like OpenAI, Google, and Anthropic have consistently argued that their models do not provide a “how-to” guide that isn't already buried in the depths of academic literature or the dark web. They point to internal safety teams and “over-refusal” policies that block thousands of legitimate scientific queries out of an abundance of caution. Yet, researchers have shared more than a dozen exchanges proving these safeguards are porous. In one instance, MIT genetic engineer Kevin Esvelt demonstrated how ChatGPT could describe the use of weather balloons to spread biological material over a city. In another, Google’s Gemini was used to rank various pathogens based on their potential to cripple the livestock industry, effectively providing a target list for economic sabotage.

The debate isn't merely about whether a chatbot can write a recipe for a toxin; it's about whether it can assist a person who already has a baseline of technical skill but lacks the strategic vision to scale an attack. Dr. Jens Kuhn, a veteran of high-containment laboratories, notes that the hardest part of biological warfare isn't necessarily culturing a virus—it is the weaponization. Turning a liquid slurry into a stable aerosol or navigating the logistics of acquisition without triggering international alarms are the traditional failure points for non-state actors. AI models are now proving remarkably adept at solving these specific “last-mile” problems. They offer a form of shadow-mentorship that can refine a crude plan into a viable operation.

Consider the case of a physician recently arrested in Gujarat, India, accused of plotting for the Islamic State. Investigators found he had utilized AI-powered search and chatbots to research the extraction of ricin from castor beans. While ricin is a crude tool compared to a modified respiratory virus, the use of AI to bridge the gap between intent and execution is no longer a theoretical exercise. It represents a real-world stress test of the current screening systems that monitor DNA synthesis and chemical precursors. A study published in Science recently revealed that AI tools could generate thousands of variant genetic sequences for dangerous agents that current DNA-order screening systems fail to detect. The software is evolving faster than the hardware that monitors it.

There is also an uncomfortable institutional contradiction at play. While the scientific risk is mounting, the political appetite for oversight is waning. The current administration has signaled a desire to deregulate AI development to keep pace with global competitors, primarily China. This push for speed has coincided with the departure of several senior biosecurity officials and sharp cuts to federal biodefense budgets. The underlying assumption appears to be that the economic and strategic benefits of AI-driven drug discovery outweigh the nebulous risk of a biological event. And the benefits are indeed substantial: Google scientists recently shared a Nobel Prize for AlphaFold, an AI system that has revolutionized our understanding of protein structures, and newer models like “Evo” are being used to design viruses that target drug-resistant bacteria. The very same architecture that allows a researcher to design a life-saving cancer-fighting protein is the architecture that can optimize a novel toxin.

The skepticism from some corners of the scientific community remains. Dr. Gustavo Palacios, a virologist formerly with the Department of Defense, compares the complexity of a virus to a Swiss watch. He argues that even with a detailed manual, an amateur is unlikely to reassemble the components into a functioning mechanism. Hands-on laboratory work requires a “tacit knowledge”—the subtle physical cues of a pipette, the temperature fluctuations of an incubator, the visual checks of a culture—that cannot yet be transmitted via a chat window. But this critique may be missing the forest for the trees. The threat isn't the lone hobbyist in a garage; it is the trained scientist with a grievance, or the state-sponsored actor looking for a shortcut. For these users, the AI doesn't need to teach them how to use a pipette; it just needs to tell them which sequence to synthesize and where the sensors are weakest.

We are currently operating in a regulatory vacuum where we rely on the “good faith” of trillion-dollar tech companies to police their own products. While Anthropic and OpenAI employ top-tier biologists to red-team their models, their primary incentive remains growth and deployment. There is no independent, federal body with the mandate or the technical capacity to audit these models for biological risk before they hit the market. Instead, we are left with a reactive cycle: a researcher finds a way to make a weather-balloon bomb, the company patches that specific prompt, and the cat-and-mouse game continues. It is a strategy that treats biosecurity as a software bug rather than a fundamental systemic risk.