What changed

JuneLast time you heard the record.

TheoThe programmes. The accidents. The part that got written down afterwards.

JuneAbout twenty three states known or suspected to have maintained a biological weapons programme in the twentieth century. One of them employing sixty thousand people at its height, according to defectors.

TheoThat is the baseline. It is history, it is documented, and nobody has to argue about whether it is possible.

JuneSo here is today. The course page asks what artificial intelligence and synthetic biology are changing. And the honest answer is not the one you expect.

TheoWhich is?

JuneThat the argument was never that AI invents a new danger. It is that nature was never the ceiling. And the ceiling is what moved.

TheoSay that again slower, because it is the whole day.

JuneThe record of natural outbreaks tells you how bad it has been. It does not tell you how bad it can get. Two different numbers, and most of the arguing comes from treating them as one.

TheoAnd you will meet this one on Monday, because it is the objection that comes first. Somebody will say, nature is already the worst bioterrorist. If you have ever sat in a meeting where one phrase does all the work, you know this one.

JuneChris Bakerlee wrote a piece in January 2021 called Mother Nature is not the ultimate bioterrorist. He was then a doctoral candidate in evolutionary genetics at Harvard, and a fellow in a programme on ending bioweapons programmes.

TheoSo the evolutionary biology half of the argument is his own field. That changes how you read him.

JuneHis target is one sentence. Mother Nature is the world's worst bioterrorist. He calls it a long overused catchphrase of scientists and public health professionals, in urgent need of retirement.

TheoWhere did it come from?

JuneSeptember eleventh, 2001, and the letters that followed it. The job of the phrase then was a warning. Do not fixate on bioterrorism while you neglect the pathogens that emerge on their own.

TheoWhich is a completely reasonable warning.

JuneAnd Bakerlee says it was right. In the years after, the war on terror fuelled a tenfold boost in United States biodefense spending. The focus got so strong that when SARS arrived in 2003, the editorial board of the journal Nature reminded readers the epidemic was not just a fire drill for an attack. It was a trial run for a future pandemic.

TheoAnd then the phrase changed sides.

JuneBy the middle of that decade, as the mood about the war on terror shifted, the same sentence was doing the opposite work. Not pay attention to natural pathogens. Do not worry so much about the human made ones.

TheoEvidence, or just a feeling?

JuneTwo pieces, both named. First, the gain of function debates.

TheoOh, gain of function. An experiment that gives an organism a property it did not have, or more of one. The case he means is work on making a flu virus that circulates in birds spread more easily between mammals.

JuneProponents argued that since nature is the real bioterrorist, the disputed benefits outweighed the potential harms. Second, Samuel Stanley, then chair of the National Science Advisory Board for Biosecurity, affirmed in 2017 that he believed nature is the ultimate bioterrorist, and we need to do all we can to stay one step ahead.

TheoAnd that is the United States federal advisory body on research that could cut both ways. Not a fringe habit. The chair.

JuneWhich tells you the phrase had stopped describing a risk and started settling an argument.

TheoBakerlee's verdict is that it is undoubtedly a mistake to underestimate natural pathogens, and equally unwise to wield a nineteen year old expression like a magic wand to banish concerns about people causing harm with biology.

JuneOkay. That is the rhetoric. Underneath it there is a real argument, and it is biological.

TheoWhy is nature supposed to be bad at this?

JuneBecause nature has no interests, motives or political goals. To the extent it can be said to want anything, it wants populations to leave more descendants than their rivals. Bakerlee's term is differential reproductive success.

TheoWhich means some variants leave more offspring that survive than others, and that is all selection can see. Harm to us is a side effect, never the aim.

JuneAnd even a deadly pathogen may, in theory, evolve toward making people less sick, if that opens up more chances to spread.

TheoIn theory. He marks that one as theory, so we will too.

JuneAnd he says selection is constrained twice over. Like a human engineer, it works around stubborn trade offs between traits, for instance between how fast a genome replicates and how often it mutates. Unlike a human engineer, it is near sighted. It improves fitness in the environment it is in right now, with no attention to any other.

TheoAnd he has a picture for it, which is his and not ours. If making a deadly pathogen were a soccer match, natural selection plays with the cunning of a horde of five year olds, glued to the ball, one position at a time. Modern biologists, he says, are learning to see the whole field.

JuneIntent and foresight, against blind local optimisation.

TheoAnd then he refuses to overclaim. Trained biologists, let alone terrorists, still have difficulty one upping natural selection, and our understanding of biology is very much in its infancy. His claim is about direction, not level. We are closer to that horizon than in 2001, and the trend will likely persist.

JuneHold that word. Likely.

TheoHe also widens the risk past the bioterrorist the slogan argues about. States have vastly more resources, and some programmes likely persist. And then accidents. Thanks to the United States government's own monitoring programme, we know dozens of agents and toxins with the potential to pose a severe threat are reported accidentally lost or released from American labs every year.

JuneEvery year. The mundane half of this. Now jump to 2026, and Becca Chandler Bostock picks the same argument up, writing from SecureBio, under a title that is the thesis in one line. Nature sets a baseline, not a ceiling, for biological harm.

TheoAnd what is new in five years?

JuneHer framing is empirical, which I like. In more than thirty conversations with academic researchers about the risks of AI enabled biological threats, one objection kept recurring, and it was that same phrase.

TheoShe traces it too. It is often attributed to Anthony Fauci, who said in a 2018 interview on CBS that nature is potentially the worst bioterrorist for us. But it had been circulating since at least that 2003 editorial in Nature, which called the epidemic a timely reminder that Mother Nature is the ultimate bioterrorist.

JuneAnd her position is a concession with a date on it. She agrees that historically, engineered biological agents have been poor terrorist weapons compared with the alternatives. Her claim is about 2026, when, in her words, AI is greatly reducing the expertise and luck deliberate misuse requires. So it should be at least an equally serious threat, alongside natural pathogens.

TheoAt least equally serious. Not worse. She holds that line the whole way through.

JuneAnd she brings one more voice. In 2025 the Nuclear Threat Initiative issued a statement signed by more than forty experts, warning that AI enabled tools could make it possible to design pathogens more dangerous than what is found in nature. And then she gives the cleanest version of her own title, and it has nothing to do with AI at all.

TheoGo on.

JuneStart with the good news. Nature supplies the parts, and humans assemble them for outcomes nature does not produce. Her example is bacteria engineered to make insulin at industrial scale. They are given a capability they would never evolve, and the result is highly purified insulin in huge quantities, so people with diabetes manage their condition with greater ease.

TheoWhich is the same sentence as the risk, read the other way round.

JuneHere is the risk, in her example. There is a bacterium that lives in soil across the globe. The illness you get from breathing it in is vanishingly rare in nature. In 1979 a Soviet production facility in Sverdlovsk suffered a filter failure, and a plume went out across the city. Bostock's figure is at least sixty six people killed, up to four kilometres downwind.

TheoAnd the number is not settled. The Foreign Affairs article by Roger Brent, Greg McKelvey and Jason Matheny says sixty eight people died at Sverdlovsk. Two readings on the same day, two published figures.

JuneAnd here is why she reaches for it. Nobody edited that organism. Its genome was exactly what nature made. What produced a kind of harm nature almost never produces was a human decision about how much to grow and where to put it.

TheoThe ceiling moved and the biology did not.

JuneWhich brings us to intent, and intent is the hinge of the whole thing.

TheoBostock is fair about the metaphor. Calling nature a bioterrorist highlights how dangerous natural infection is, it does not suggest nature has an agenda. But she says it muddies the water by linking the two, when much of the concern about engineered threats comes directly from the fact that they would be made with the intention of harm.

JuneNature optimises for reproductive fitness. Replication, transmission, persistence. And the classical theory is a trade off between transmission and virulence, so viruses settle at an end point of intermediate virulence.

TheoOh, you mean if it kills the host too fast it runs out of host before it can spread. The two traits pull against each other, and the pathogen lands somewhere in the middle.

JuneThat is it. And it is why natural pathogens rarely evolve to be both highly transmissible and highly lethal.

TheoAnd her footnote keeps that honest. The trade off is real but perhaps not universal. Some systems do not conform to the classical theory, and that has been argued for pandemic SARS-CoV-2.

JuneThen her key sentence. There is no fundamental law of nature that says a pathogen cannot be both.

TheoBut if someone released one, evolution would grind it back down, wouldn't it?

JuneShe grants exactly that, and the case is in her footnote. A rabbit poxvirus from South America, mild in its native species, was released in Australia in 1950 to control European rabbits. In that new species it caused over ninety nine percent lethality within two weeks of infection. Within a few years it attenuated, because the more lethal strains killed rabbits before mosquitoes could carry it on.

TheoAttenuated. It got weaker.

JuneWithin a few years. And her reply is one line. That takes time. Acute harm happens fast, before evolutionary pressures catch up.

TheoSo the argument is about timescale, not about biology being limitless. Which is a better argument, because you can test it.

JuneAnd there is a second lever that needs no new biology at all. Someone can choose where and when to release something, to maximise panic or economic disruption. The ceiling of harm goes up without a single novel capability.

TheoAnd she is careful on likelihood. The next outbreak is more likely to come from a known pathogen, measles where vaccination rates are low, or a variation of last year's seasonal flu, than from an intentional release. The larger outbreaks may come from a new spillover out of animals, made more likely by deforestation and wildlife trafficking.

JuneAnd then one sentence in reply. This, she says, may not be as bad as it could get.

TheoThat is the episode in nine words.

JuneOkay. Where does AI actually fit in that.

TheoHer first sentence on it is the one that gets skipped. AI is not yet able to design a novel pathogen from scratch.

JuneNot yet. And then she splits the field in two, and this is the vocabulary the rest of your week uses. General purpose models provide scientific expertise and troubleshooting. And then there is a second category, biological AI models.

TheoMachine learning systems trained on biological sequences, structures or experimental data, rather than on language. Not chatbots. A different kind of instrument.

JuneThey predict molecular structures and interactions, and estimate regulatory activity and variant effects. Her named examples include a structure predictor, AlphaFold 3, and a genome language model, Evo 2.

TheoAnd a genome language model is trained on DNA the way a language model is trained on text.

JuneWhat those tools do for research is speed. They screen many possible variants in silico, which means by computer rather than at a bench, and flag the most promising for laboratory verification.

TheoAnd her example?

JuneModels in the Evo family have generated working genomes of a virus that infects bacteria, ones not previously detected in nature. And she immediately adds the caveat, which is that researchers dispute the extent of their novelty.

TheoKeep the caveat attached. It goes where the result goes.

JuneAnd her point survives it. What that work demonstrates is that these tools can compress the time it takes to optimise biological variants. Her phrase for the cost is narrowing the window for law enforcement intervention.

TheoThat is the mechanism in this reading. Not a new kind of harm. Less time to notice.

JuneAnd then the argument she most wants to answer. These tools still fail at some tasks. One of them is predicting epistasis.

TheoWhere the effect of a mutation depends on the rest of the genome it sits in, instead of having a fixed effect you can add up. Change one part, and something elsewhere shifts in a way that is hard to predict.

JuneShe has heard that failure offered as proof that we cannot build anything worse than nature. And her answer is the most honest paragraph in the piece. It may in fact be the case that we cannot now build anything worse than nature. But if success at those tasks would show the latent potential for a dangerous use, should we not keep an eye on them?

TheoShe concedes the other side outright and still has an argument standing. That is rare, and it is the shape to copy.

JuneSo let's take her at her word and go and look at the measuring, because that is the part of this day most people argue about without reading.

TheoWho measures it?

JuneIn BlueDot's own briefing on this, written by Will Saunter, the state of play as of September 2025 and updated that November, the answer is two companies. Anthropic and OpenAI are the only ones publishing detailed biological weapons evaluations.

TheoTwo. For the whole field.

JuneAnd both say the same careful thing. Their models are on the cusp of being able to help a novice, and they released them with safeguards. OpenAI treated GPT-5, in August 2025, as high capability in the biological and chemical domain, which activated its preparedness safeguards, while stating it lacked definitive evidence the model could meaningfully help a novice create severe biological harm, and that it remains on the cusp.

TheoAnd Anthropic?

JuneClaude Opus 4, in May 2025, came close enough that they were unable to rule out needing their third level of safeguards. That level means significantly helping someone with a basic technical background, and their example is an undergraduate science degree, to create or obtain and deploy such a weapon.

TheoAnd this is where we slow all the way down, because one evaluation sits underneath that whole sentence.

JuneSo what did it actually do?

TheoAnthropic's own system card publishes it. Groups of eight to ten participants had up to two days to draft a comprehensive acquisition plan. A document. The control group had only basic internet resources. The other group had the model with its safeguards removed, so refusals would not hide the underlying capability.

JuneAnd who marked them?

TheoDeloitte graded the plans against a rubric. The control group scored twenty five percent, plus or minus thirteen. The group with Claude Opus 4 scored sixty three percent, plus or minus thirteen. The group with Claude Sonnet 4 scored forty two percent, plus or minus eleven.

JuneSo sixty three against twenty five. They call that ratio uplift, how much better you do with the model than without it. Anthropic puts this one at two point five three times.

TheoAnd they published their thresholds in advance, which is the bit I keep coming back to. Total uplift at or above five times would create significant additional risk. At or below two point eight times would keep the risk acceptable.

JuneSo read that back. Two point five three is below two point eight. The result sat inside their own acceptable band, and they turned the heavier safeguards on anyway, because they treated being that close as enough.

TheoThat is a judgement, and they say so. The number is not making the decision.

JuneAnd what did that trial not measure?

TheoTwo things, in their own words. All participants hit critical failures. Every group. And the card says it is uncertain how uplift measured on an evaluation translates into real world uplift, and that text based uplift trials are substantially weaker proxies for real world scenarios, which involve tacit knowledge, materials access and actor persistence.

JuneTacit knowledge being the part of a skill nobody can write down. The part you learn standing next to someone who has already done it.

TheoSo what was measured is the graded quality of a written plan, by a small group, over two days, with a model stripped of its safeguards. What was not measured is whether anybody could actually do anything.

JuneBoth halves sit in one document, published by the company with the most to lose either way.

TheoOne more from that section, because it is the closest thing to a real constraint. On the evaluation of the step where a design has to become physical material, no model could complete the task end to end.

JuneWhich tells you where a defence belongs. That is the second unit. Now. That was one company measuring its own model. Zoom out and it gets harder, not easier.

TheoSaunter's strongest number is not about capability at all. In September 2025 the United States Center for AI Standards and Innovation tested models using common jailbreaking techniques, the tricks that get a model to comply with what it should refuse. DeepSeek's most secure model complied with ninety four percent of overtly malicious requests. The United States reference models, eight percent.

JuneNinety four, and eight.

TheoAnd say what that measures. Whether a model refuses, under those techniques, across a set of requests. It does not measure whether the answers were any good. Saunter notes in the same breath that detailed biological weapons evaluations are lacking for those models.

JuneSo the inference is about safeguards, not capability. And if safeguards hold at one frontier lab while comparable models elsewhere comply with almost anything, a safeguard is a national policy and not a global one.

TheoWhich is the sentence that turns this from a laboratory question into your kind of question.

JuneTwo of the day's readings are mostly about how weak the evidence is. Kyle Hiebert, writing for the Centre for International Governance Innovation, does something unusual. He publishes the case against his own alarm. A team assembled by OpenAI found that GPT-4 gave users only a marginal advantage over regular internet searches.

TheoAnd he writes the alarming piece anyway?

JuneHe argues the risk is not static, rather than refuting the finding. And his own number is a rate of change. In the International AI Safety Report produced for the 2025 Paris AI Action Summit, its authors' assessments suggest certain models improved by eighty percent during 2024 alone on this class of question.

TheoA rate, not a level. If you are deciding where to put a safeguard, a rate is more useful than a snapshot. It is also easier to overread.

JuneAnd then the 2024 policy report from the Center for a New American Security, by Bill Drexel and Caleb Withers. They set out to test the claims the laboratory chief executives were making. Dario Amodei told a congressional hearing in July 2023 that within two to three years there was a substantial risk AI tools would greatly widen the range of actors able to conduct a large scale biological attack.

TheoAnd their verdict?

JuneThat to date, AI's impacts on biological risks have been marginal, and there is no way to know for certain if or when more severe risks will materialise. They call predicting exactly how and when a fool's errand, in those words.

TheoAnd their reframing is the sharpest thing in it. The most pressing concern is not novel design. It is acceleration. In particular a model's budding ability to troubleshoot where an experiment has gone wrong, which speeds up what they call the design, build, test, learn loop.

JuneWhich is the cycle any bench work goes through. You try it, it fails, you work out why, you try again. And the working out why is the part that used to need somebody standing next to you.

TheoSo the thing tacit knowledge used to protect is exactly the thing being eaten.

JuneAnd because they will not forecast, they name four capability areas to watch and five measures to take, and they make licensing for a narrow set of biological design tools conditional on catastrophic capabilities beginning to materialise.

TheoA bet on measurement over prediction. Which only works if the measurement catches a threshold being crossed, and we just spent five minutes on how wide those error bars are.

JuneAnd that is the tension of this episode, so let's say it out loud. The strongest case for acting now rests on an instrument the people who built it describe as weak. Both are true at once, and nobody on this reading list pretends otherwise.

TheoAnd this is the part you have already been in the room for. You testified at the New York City Council's 5 October 2026 hearing on the risks of artificial intelligence. Verbal testimony on Zoom, and written testimony submitted.

JuneAnd your own account of that day is the thing we keep circling back to. You heard frontier labs tell the Council that voluntary frameworks are not enough.

TheoHold that next to what we just read. The only detailed evaluations published anywhere come from two companies, and both publish their own hedges right alongside the numbers. You have sat in the room where that becomes policy.

JuneYou could say the useful question in a hearing like that one is not whether a model is dangerous today. It is who is holding the ruler, and who gets to see what it measured.

JuneThere is one more reading, and it is where all of this stops being an argument and becomes a specific thing with a name.

TheoMirror life.

JuneThe brief comes from the Scientific Advisory Board to the Secretary General of the United Nations, published in 2026, six pages, and it draws one line down the middle of its subject.

TheoAnd the idea underneath it is handedness. Chirality. The molecules living things are made of come in two mirror image forms, like your left hand and your right. Same parts, opposite shape. Everything in the brief follows from that.

JuneIn natural life, proteins are built from left handed amino acids, and DNA and RNA from right handed sugars. That shared orientation is what lets them fit together, like keys in locks.

TheoMirror biology flips them. And the crucial property is not that they are different, it is that they are incompatible. Our enzymes cannot process them. Our immune sensors are less able to detect them.

JuneAnd that is exactly why they are useful. They last far longer in blood, in tissue and in environmental samples, because the things that would break them down do not recognise them. Mirror DNA, mirror RNA and some mirror proteins are already produced for medical purposes.

TheoThe flagship case is a short mirror image RNA strand called a Spiegelmer. Several have entered preclinical or clinical development.

JuneSo that is the left hand side of the line. Ordinary good news.

TheoAnd the right hand side is mirror life, the still hypothetical idea of a self replicating organism built entirely out of mirror molecules. It has not been created. The brief says it is likely a decade away, and that many leading experts predict at least ten years.

JuneSo why is it in a course about now?

TheoBecause of how the brief grades the two halves. The risks of mirror molecules are low. The risks of self replicating mirror life are extraordinarily high.

JuneOn what reasoning?

TheoThe question that decides it is whether such a thing could eat. And their answer is yes, because some basic nutrients have no handedness at all, things like oxygen and simple carbon based substances.

JuneSo it would not starve.

TheoIt would grow more slowly, because fewer nutrients would be viable for it, and the brief says it could still theoretically spread across the planet. Keep the word theoretically. This is a risk assessment of something that does not exist.

JuneAnd then the three defences it would pass through. Immune systems in animals and plants recognise an invader partly by its handedness, so a mirror organism might evade detection. Known antibiotics could be rendered largely unusable. And almost all diagnostic tests are designed to find regular life forms, so they probably would not detect it.

TheoImmunity, treatment, and the test itself. Their phrase for the result is a highly resilient invasive species with few built in limitations on its growth.

JuneAnd notice every one of those is hedged. Might. Could. Probably. Every page carries a disclaimer saying this is the Board's independent assessment, not the view of the United Nations or of the scientific community at large.

TheoWhat it does not hedge is short. No complete mirror ribosome exists. There is widespread scientific agreement that mirror life should not be made. And as of today there is no global process to turn that agreement into governance.

JuneIt also keeps the ledger honest the other way. Very few practical benefits to creating mirror life are known, other than the accomplishment of generating a living organism solely from synthetic materials. The useful part of the field does not need anything alive.

TheoWhich makes it an unusually clean decision. Almost nothing is being given up.

JuneAnd the trap is that the dual use shape here is inverted. The harmless molecular work is itself what makes the dangerous organism cheaper to assemble. At least three laboratories have produced a mirror version of the enzyme that lets DNA replicate. Nobody has built a complete mirror ribosome, the machine that assembles proteins, which is why experts propose it as a red line.

TheoAnd some of it has been acted on. Ninety six participants at a conference in April 2025 signed an entreaty saying mirror life should not be created unless future research convincingly demonstrates it would not pose severe risks. Two science philanthropies have committed to not funding that work.

JuneAn agreement, and no process. That is the shape of this field right now. So, last piece. If the ceiling has moved, the obvious answer is deterrence. Make it not worth doing.

TheoAnd the Foreign Affairs article says that cannot work here, for three reasons. Mutually assured destruction relied on widespread fear, on being able to identify who attacked you, and on an adversary who wants to survive.

JuneFear is not there, because the threat depends on inventions without precedent, and because no biological attack has been the kind of world historical event that holds attention for decades. Identification is not there, because a release can be denied and blamed elsewhere. And survival is not there for every actor.

TheoTheir witness is Joshua Lederberg, who testified before Congress in 1969 in support of a global ban. Biological weapons, he said, could become just as deadly as nuclear ones but easier to construct. Nuclear weaponry had been monopolised by the great powers long enough to sustain a balance of deterrence and a system based on nonproliferation. And then he said germ power would work just the other way.

JuneHe said that in nineteen sixty nine.

TheoAnd the asymmetry they draw from it is the sentence to keep. Generating pathogens is cheaper than defending against them. Responding means testing and detection networks, protective equipment in vast quantities, disruptive closures, and a whole apparatus to develop, manufacture and distribute treatments and vaccines.

JuneThey open the piece by calling COVID-19 a penetration test, which in computer security means a simulated attack using an adversary's own methods, run to find the weaknesses before a real attacker does.

TheoAnd their verdict is one sentence, and it is the reason this course exists. The primary reason the death toll was relatively modest was not that society had controlled the disease. It was that the infection proved to be only modestly lethal.

JuneTwenty seven million people, by the estimate in BlueDot's briefing. And that was the modest case.

TheoWhich is the floor and the ceiling in one example. We did not hold that line. The pathogen did.

JuneSo here is the one line to carry in. Nature's record tells you how bad it has been, not how bad it can get, and the instrument we use to measure the difference is a handful of trials with wide error bars.

TheoAnd if somebody reaches for the slogan on Monday, you do not have to argue that AI has already done something. You need the floor, the ceiling, and the fact that the people holding the ruler are the ones saying the ruler is weak.

JuneNext time, the question that follows. If retaliation cannot deter this, and the ceiling has moved, what would a world that is actually protected look like.

TheoAnd the course's answer is not mainly about doctors. It is about buildings. Fires stopped levelling cities, and mostly not because the fire brigade got faster.

JuneThat is the next one. Take this one with you.