Latest / USA Daily News / AI BIOWEAPON ALERT ANTHROPIC UNCOVERS FOREIGN RESEARCHERS PUSHING FRONTIER MODELS INTO DANGEROUS VIRUS WORK

Transcript

AI BIOWEAPON ALERT ANTHROPIC UNCOVERS FOREIGN RESEARCHERS PUSHING FRONTIER MODELS INTO DANGEROUS VIRUS WORK · USA Daily News

• 0:00
  Speaker 1: A new warning from artificial intelligence company Anthropic is turning
• 0:04
  Speaker 1: a once theoretical concern about AI and biological weapons into
• 0:08
  Speaker 1: a concrete national security debate. Researchers connected to institutions outside
• 0:13
  Speaker 1: the United States have been using advanced AI systems to
• 0:16
  Speaker 1: accelerate sensitive biological research. And in several cases, they appear
• 0:21
  Speaker 1: to have taken steps to work around safeguards intended to
• 0:24
  Speaker 1: restrict access to dangerous capabilities. Anthropic says it reviewed five
• 0:29
  Speaker 1: cases involving work related to highly pathogenic bird flu, chikungunya, orthopoxviruses,
• 0:36
  Speaker 1: venom-derived compounds, and other toxins, while deliberately withholding the country's
• 0:41
  Speaker 1: institutions and exact agents involved. The company has also stressed
• 0:46
  Speaker 1: an important limitation that should not be lost in the headlines.
• 0:49
  Speaker 1: It is not claiming that the researchers intended to build
• 0:52
  Speaker 1: biological weapons. nor is it reporting that an attack is imminent.
• 0:57
  Speaker 1: What it is reporting is something more complicated and, in
• 1:00
  Speaker 1: some ways, more important for the future of AI security,
• 1:04
  Speaker 1: people who already possess scientific knowledge. Laboratory resources and access
• 1:09
  Speaker 1: to biological materials are beginning to use frontier AI systems
• 1:13
  Speaker 1: to make portions of sensitive research faster, easier, and potentially
• 1:17
  Speaker 1: more capable. That distinction matters because biological science is inherently dual-use.
• 1:24
  Speaker 1: The same knowledge that can support a vaccine, improve a treatment,
• 1:27
  Speaker 1: understand an emerging disease, or strengthen surveillance can also, under
• 1:32
  Speaker 1: different circumstances, contribute to work that increases the danger posed
• 1:37
  Speaker 1: by a pathogen. Anthropic says its experience shows why simple
• 1:41
  Speaker 1: content filters may not be enough when an AI model
• 1:44
  Speaker 1: is embedded in real-world research workflows. A request can look medical, defensive, academic,
• 1:50
  Speaker 1: or therapeutic on the surface while still producing knowledge with
• 1:54
  Speaker 1: implications that extend far beyond the stated purpose. That is
• 1:58
  Speaker 1: the core concern behind the new report. The issue is
• 2:01
  Speaker 1: not that an AI system has suddenly become a biological
• 2:04
  Speaker 1: laboratory on its own. The issue is that an AI
• 2:07
  Speaker 1: system can function as an accelerator for people who already
• 2:11
  Speaker 1: have access to laboratories, biological materials, expertise, and institutional infrastructure.
• 2:17
  Speaker 1: That changes the risk calculation. A model does not need
• 2:21
  Speaker 1: to independently invent a pathogen from nothing to matter. It
• 2:24
  Speaker 1: only needs to reduce the amount of time, specialized knowledge,
• 2:28
  Speaker 1: or trial and error required by someone already working on
• 2:31
  Speaker 1: a complex biological problem. Anthropix 5 cases are presented as
• 2:36
  Speaker 1: evidence that this possibility is no longer merely hypothetical. In
• 2:41
  Speaker 1: one case, researchers were pursuing work involving chikungunya and sod
• 2:46
  Speaker 1: assistance with questions related to transmissibility and immune evasion. In another,
• 2:51
  Speaker 1: a researcher used clod over an extended period while studying
• 2:56
  Speaker 1: characteristics of highly pathogenic avian influenza. Another user associated with
• 3:01
  Speaker 1: an infectious disease laboratory used the model to help prepare
• 3:04
  Speaker 1: a research grant involving orthopoxvirus biology. Two additional cases involved
• 3:10
  Speaker 1: toxin-related research, including efforts to analyze and computationally redesign compounds
• 3:15
  Speaker 1: with possible harmful as well as therapeutic applications. The company
• 3:20
  Speaker 1: says some safeguards successfully blocked clearer attempts involving enhanced pandemic pathogens.
• 3:26
  Speaker 1: but other requests were harder to detect because they were
• 3:29
  Speaker 1: framed around medicine or scientific research. That is an uncomfortable
• 3:33
  Speaker 1: finding because legitimate research frequently overlaps with potentially dangerous knowledge.
• 3:40
  Speaker 1: A vaccine developer and a malicious actor may need to
• 3:42
  Speaker 1: understand some of the same biological mechanisms, while their intentions
• 3:47
  Speaker 1: and objectives are fundamentally different. An AI model cannot always
• 3:51
  Speaker 1: infer intent from words alone, particularly when the user presents
• 3:55
  Speaker 1: a plausible scientific justification. Anthropic therefore argues that future safety
• 4:00
  Speaker 1: systems may need to incorporate stronger identity verification, institutional vetting,
• 4:06
  Speaker 1: and monitoring of users requesting advanced biological capabilities. The report
• 4:11
  Speaker 1: also highlights another concern. Access restrictions can be circumvented. In
• 4:16
  Speaker 1: one case, according to Anthropic, a research platform routed traffic
• 4:20
  Speaker 1: through infrastructure in another region, allowing users to reach Claude
• 4:24
  Speaker 1: despite geographic restrictions, and when the model refused sensitive requests,
• 4:30
  Speaker 1: the platform redirected those requests to another system with weaker safeguards.
• 4:35
  Speaker 1: The company says the activity continued even after associated accounts
• 4:39
  Speaker 1: were banned, with access being restored through new identities. That
• 4:43
  Speaker 1: episode demonstrates why safety cannot depend entirely on whether one
• 4:47
  Speaker 1: AI provider recognizes a suspicious prompt.
• 4:51
  Speaker 2: A determined user may seek.
• 4:52
  Speaker 1: Another model, another service, or another route around the restriction.
• 4:56
  Speaker 1: The problem, therefore, becomes ecosystem-wide rather than model-specific. The question
• 5:02
  Speaker 1: is no longer simply whether a particular AI company can
• 5:05
  Speaker 1: write an effective refusal message. The most important lesson from
• 5:08
  Speaker 1: the Anthropic Report is that biological risk cannot be evaluated
• 5:13
  Speaker 1: by looking only at the words appearing in an AI conversation.
• 5:17
  Speaker 1: That is because biological science has an unusual characteristic. Beneficial
• 5:22
  Speaker 1: and dangerous applications can emerge from the same underlying body
• 5:26
  Speaker 1: of knowledge. A researcher trying to understand why a virus
• 5:29
  Speaker 1: spreads efficiently may be trying to design a vaccine, improve diagnostics,
• 5:34
  Speaker 1: prepare public health defenses, or model how an.
• 5:37
  Speaker 2: Outbreak could evolve.
• 5:38
  Speaker 1: But the same understanding can also become relevant to someone
• 5:41
  Speaker 1: seeking to increase the potential impact of a pathogen. That
• 5:45
  Speaker 1: dual-use problem is not new, and it did not begin
• 5:48
  Speaker 1: with artificial intelligence. What is new is the speed at
• 5:52
  Speaker 1: which advanced AI systems can organize information, connect concepts across
• 5:56
  Speaker 1: scientific disciplines, summarize technical literature, assist with analysis and support
• 6:01
  Speaker 1: researchers across many different stages of a project. Anthropics cases
• 6:06
  Speaker 1: show why that speed can matter. In the past, a
• 6:09
  Speaker 1: scientist working outside a narrow specialty might have needed to
• 6:13
  Speaker 1: consult multiple experts, Search through large volumes of literature and
• 6:18
  Speaker 1: spend significant time translating information from one field into another.
• 6:22
  Speaker 1: A capable AI system can potentially compress some of that
• 6:26
  Speaker 1: work into a much shorter period. The model does not
• 6:29
  Speaker 1: need to be perfect to create an advantage. Even partial
• 6:33
  Speaker 1: assistance can save time, generate alternative ways of framing a problem,
• 6:37
  Speaker 1: identify relevant literature, or improve the clarity.
• 6:41
  Speaker 2: Of a research document.
• 6:42
  Speaker 1: When the user is conducting ordinary medical science, those capabilities
• 6:46
  Speaker 1: can be highly beneficial. When the work involves pathogens or
• 6:50
  Speaker 1: toxins with dangerous potential, the same acceleration can become a
• 6:55
  Speaker 1: security concern. This is why Anthropic says some users were
• 6:59
  Speaker 1: able to obtain useful assistance even though the company had
• 7:02
  Speaker 1: already implemented safeguards intended to prevent more obviously dangerous requests.
• 7:07
  Speaker 2: The difficulty lies in context.
• 7:09
  Speaker 1: An AI system responding to a request about immune response
• 7:13
  Speaker 1: may not know that the broader research program is attempting
• 7:16
  Speaker 1: to create a more threatening version of a virus. A
• 7:19
  Speaker 1: request to compare scientific literature may look harmless while contributing
• 7:23
  Speaker 1: to a project that, taken as a whole, carries greater risk.
• 7:28
  Speaker 1: The model sees the prompt. The research team sees the
• 7:31
  Speaker 1: entire program. That difference creates an inherent limitation for automated
• 7:36
  Speaker 1: safety systems. The problem is even more pronounced when users
• 7:40
  Speaker 1: deliberately hide their identity. use institutional intermediaries, or distribute a
• 7:45
  Speaker 1: research workflow across multiple platforms. A safeguard designed around one
• 7:49
  Speaker 1: conversation can be bypassed if the user changes the framing,
• 7:53
  Speaker 1: switches models, or asks for help through another service. Anthropix
• 7:57
  Speaker 1: Report says precisely that happened in at least one case.
• 8:01
  Speaker 1: The company describes a platform that routed traffic through U.S.
• 8:04
  Speaker 1: infrastructure to get around geographic restrictions, and then redirected rejected
• 8:09
  Speaker 1: requests to a model with more permissive safeguards. That is
• 8:13
  Speaker 1: not simply a content filter problem. It is an access
• 8:16
  Speaker 1: control problem. It suggests that safety systems have to understand
• 8:20
  Speaker 1: not only the content of individual requests, but also the
• 8:24
  Speaker 1: identity and institutional context of the user, the pattern of
• 8:27
  Speaker 1: activity over time, and the relationship between separate attempts to
• 8:31
  Speaker 1: obtain restricted capabilities. That is a much harder engineering challenge.
• 8:36
  Speaker 1: It also raises policy questions about how companies should verify
• 8:40
  Speaker 1: users without creating unreasonable barriers for legitimate scientists. Universities, hospitals,
• 8:46
  Speaker 1: pharmaceutical companies, and independent researchers all need access to sophisticated
• 8:51
  Speaker 1: AI systems for valuable work. If safety controls become so
• 8:56
  Speaker 1: restrictive that serious scientists cannot use the tools, innovation suffers.
• 9:00
  Speaker 1: But if access is wide open … malicious actors may
• 9:04
  Speaker 1: find it easier to exploit the same capabilities. Anthropic's recommendation
• 9:09
  Speaker 1: of institutional vetting reflects an attempt to address that tension.
• 9:13
  Speaker 1: Instead of assuming that every prompt can be categorized correctly
• 9:17
  Speaker 1: based on language alone, providers could assign greater privileges to
• 9:21
  Speaker 1: verified researchers whose identities and organizations can be established. Such
• 9:26
  Speaker 1: a system would still not be foolproof. Institutions can be compromised,
• 9:31
  Speaker 1: Insiders can abuse access and legitimate researchers can make mistakes.
• 9:36
  Speaker 1: Yet it may make it harder for a determined outsider
• 9:39
  Speaker 1: to repeatedly create new accounts and move between services whenever
• 9:43
  Speaker 1: a safeguard blocks an important request. The report also suggests
• 9:47
  Speaker 1: that monitoring may need to extend beyond static restrictions. A
• 9:51
  Speaker 1: scientist's legitimate work can involve a long sequence of questions
• 9:54
  Speaker 1: that look unremarkable individually but become more significant when viewed together.
• 9:59
  Speaker 1: A safety system could therefore need to recognize patterns, not
• 10:03
  Speaker 1: just isolated prompts. The case involving highly pathogenic avian influenza
• 10:08
  Speaker 1: illustrates why this issue has become so urgent, because bird
• 10:12
  Speaker 1: flu occupies a special place in global disease preparedness and
• 10:16
  Speaker 1: pandemic planning. Anthropic says one researcher spent weeks using CLAWD
• 10:21
  Speaker 1: in connection with work examining characteristics associated with mammalian adaptation
• 10:26
  Speaker 1: and airborne transmission, while the researcher appeared to have access
• 10:30
  Speaker 1: to virus isolates and animal model facilities. The company says
• 10:34
  Speaker 1: it limited the assistance provided in that case to weaker
• 10:37
  Speaker 1: models and to areas such as study design, data analysis,
• 10:42
  Speaker 1: and editorial support.
• 10:44
  Speaker 2: But still viewed the activity.
• 10:45
  Speaker 1: As evidence of an active research program focused on biological
• 10:49
  Speaker 1: traits with potentially serious pandemic implications. It is important to
• 10:54
  Speaker 1: distinguish between studying a pathogen and deliberately creating a dangerous one.
• 10:59
  Speaker 1: Scientists routinely investigate how viruses change, how they interact with hosts,
• 11:04
  Speaker 1: and what factors influence transmission because understanding those mechanisms can
• 11:08
  Speaker 1: help governments prepare for outbreaks. Researchers can use that information
• 11:13
  Speaker 1: to improve vaccines, design therapeutics, monitor mutations, and identify warning
• 11:18
  Speaker 1: signs before.
• 11:19
  Speaker 2: A disease spreads widely.
• 11:20
  Speaker 1: The same research, however, can become sensitive when it moves
• 11:24
  Speaker 1: toward questions about deliberately increasing characteristics that could make a
• 11:28
  Speaker 1: pathogen more difficult to contain. That is where AI assistance
• 11:32
  Speaker 1: becomes difficult to evaluate. A model cannot simply classify a
• 11:37
  Speaker 1: request as safe or unsafe based on a single keyword.
• 11:41
  Speaker 1: The same scientific concept can appear in an entirely legitimate
• 11:45
  Speaker 1: public health context or in a research program that creates
• 11:48
  Speaker 1: additional biological risk. Anthropix report says this ambiguity was visible
• 11:53
  Speaker 1: across multiple cases. The company found that some safeguards successfully
• 11:57
  Speaker 1: blocked more explicit attempts to work on dangerous pandemic potential questions.
• 12:02
  Speaker 1: but other requests passed through when users framed their objectives
• 12:06
  Speaker 1: in medical or defensive language. This reveals a structural.
• 12:10
  Speaker 2: Weakness in automated screening.
• 12:12
  Speaker 1: Language can be separated from intent, while real-world risk depends
• 12:16
  Speaker 1: on the entire context. That context includes what biological materials
• 12:21
  Speaker 1: the researcher has, what equipment is available, what organization is
• 12:25
  Speaker 1: funding the work, what questions have already been asked. and
• 12:29
  Speaker 1: what the research team plans to do with the resulting knowledge.
• 12:33
  Speaker 1: AI companies generally do not have full visibility into those factors,
• 12:37
  Speaker 1: and that makes perfect safety impossible. The bird flu case
• 12:40
  Speaker 1: also demonstrates why access to physical infrastructure matters. A model
• 12:45
  Speaker 1: sitting inside a chat interface does not possess a laboratory.
• 12:49
  Speaker 1: It cannot physically manipulate a sample or operate containment equipment.
• 12:53
  Speaker 1: The potential danger arises when an AI system is placed
• 12:57
  Speaker 1: alongside a human who already has those capabilities. In that environment,
• 13:01
  Speaker 1: software assistance can become part of a broader workflow. The
• 13:05
  Speaker 1: model may help a researcher summarize literature, organize an experimental rationale,
• 13:11
  Speaker 1: analyze a dataset, or refine a written proposal, while the
• 13:15
  Speaker 1: laboratory supplies the physical means to act on those decisions.
• 13:19
  Speaker 1: None of those individual activities necessarily proves malicious intent. But
• 13:23
  Speaker 1: together they can show why AI capability matters to biological
• 13:27
  Speaker 1: security even before an AI can perform laboratory work autonomously.
• 13:32
  Speaker 1: The concern is acceleration. If a researcher can reach a
• 13:36
  Speaker 1: useful conclusion more quickly, compare more possibilities in less time,
• 13:40
  Speaker 1: or move between scientific disciplines without waiting for a human specialist,
• 13:44
  Speaker 1: the overall pace of a project can increase. In ordinary research,
• 13:49
  Speaker 1: that is precisely the benefit people want from AI. In
• 13:52
  Speaker 1: sensitive areas, the same efficiency can shorten the time available
• 13:57
  Speaker 1: for safety review. The bird flu example also highlights the
• 14:00
  Speaker 1: importance of global context. Biological risks do not stop at
• 14:05
  Speaker 1: national borders. A virus capable of spreading efficiently among humans
• 14:09
  Speaker 1: could create consequences far beyond the laboratory, while research institutions
• 14:14
  Speaker 1: can be distributed across countries and connected through online platforms.
• 14:19
  Speaker 2: That means a U.S.
• 14:20
  Speaker 1: Company may be serving a researcher elsewhere, while the actual
• 14:23
  Speaker 1: physical work happens in another jurisdiction and the relevant scientific
• 14:27
  Speaker 1: knowledge is drawn from international sources. Geographic restrictions alone are
• 14:32
  Speaker 1: therefore unlikely to solve the problem. Anthropic says it observed
• 14:37
  Speaker 1: efforts to get around those restrictions by routing traffic through
• 14:40
  Speaker 1: another region, underscoring how easily digital access can become disconnected
• 14:45
  Speaker 1: from physical location. The broader implication is that AI governance
• 14:49
  Speaker 1: and biological governance are becoming increasingly intertwined. Governments already regulate
• 14:55
  Speaker 1: dangerous pathogens, laboratory environments, export-controlled technologies, and certain types.
• 15:01
  Speaker 2: Of dual-use research.
• 15:03
  Speaker 1: AI introduces another layer because software can travel globally almost instantly.
• 15:08
  Speaker 1: The Chikungunya case described by Anthropic may be even more
• 15:11
  Speaker 1: revealing because it demonstrates how a scientifically legitimate project can
• 15:15
  Speaker 1: approach a boundary where the same work could have both
• 15:18
  Speaker 1: protective and dangerous consequences. According to the report, researchers at
• 15:23
  Speaker 1: a military research institute pursued a project involving Chikungunya and
• 15:28
  Speaker 1: sought to understand mutations associated with transmissibility and immune evasion.
• 15:33
  Speaker 1: The stated scientific goal, as Anthropic describes it, could potentially
• 15:38
  Speaker 1: contribute to better vaccines and treatments, which is exactly why
• 15:41
  Speaker 1: this type of research is difficult to classify as inherently malicious.
• 15:46
  Speaker 1: Understanding why a virus behaves differently can help scientists anticipate
• 15:50
  Speaker 1: future variants, improve countermeasures, and design interventions that work against
• 15:55
  Speaker 1: a changing pathogen. Yet the same knowledge can also increase
• 15:59
  Speaker 1: concern if it becomes part of work intended to make
• 16:02
  Speaker 1: an agent more difficult to contain. Anthropic says the users
• 16:06
  Speaker 1: were able to access Claude through a life sciences platform
• 16:09
  Speaker 1: that routed traffic through U.S. infrastructure, allowing them to bypass
• 16:13
  Speaker 1: geographic restrictions, and that when Claude refused certain sensitive prompts
• 16:18
  Speaker 1: the platform redirected the requests to another model with weaker safeguards.
• 16:22
  Speaker 1: The company says that after it banned related accounts, the
• 16:25
  Speaker 1: activity continued through new identities and that Claude was still
• 16:29
  Speaker 1: used for editorial assistance connected to the research materials. This
• 16:34
  Speaker 1: part of the report is significant because it shifts the
• 16:37
  Speaker 1: focus from whether a single AI model can recognize dangerous
• 16:40
  Speaker 1: content to whether an entire ecosystem can prevent determined users
• 16:44
  Speaker 1: from moving around protective barriers. A safety system can be
• 16:48
  Speaker 1: highly effective inside one product and still have limited impact
• 16:52
  Speaker 1: if the user can simply transfer the task to another service.
• 16:56
  Speaker 2: It also illustrates why.
• 16:57
  Speaker 1: Digital identity may become a central component of AI security.
• 17:02
  Speaker 1: If a person can repeatedly create new accounts, obscure their
• 17:05
  Speaker 1: location or access models through intermediaries, then account-level blocking becomes
• 17:10
  Speaker 1: a temporary obstacle rather than a durable defense. The policy
• 17:14
  Speaker 1: response could involve more rigorous verification for access to high-risk
• 17:19
  Speaker 1: scientific capabilities, but that approach introduces its own challenges. Researchers
• 17:24
  Speaker 1: may work across institutions, international collaborations are common, and legitimate
• 17:29
  Speaker 1: scientists may not fit neatly into a single organizational identity.
• 17:34
  Speaker 1: Independent researchers, small biotechnology companies, and academic projects can all
• 17:39
  Speaker 1: contribute valuable work. A system that demands extensive institutional credentials
• 17:44
  Speaker 1: for every advanced scientific use case could unintentionally concentrate AI
• 17:50
  Speaker 1: access in the hands of large organizations. That would be
• 17:53
  Speaker 1: an undesirable outcome if the goal is to promote innovation.
• 17:57
  Speaker 1: On the other hand, the Chikungunya case suggests that open
• 18:01
  Speaker 1: access can create pathways that are difficult to control when
• 18:04
  Speaker 1: the requested capabilities have a meaningful biological risk dimension. The
• 18:09
  Speaker 1: challenge is therefore not choosing between total openness and total restriction.
• 18:14
  Speaker 1: It is designing a graduated access system where the most
• 18:17
  Speaker 1: capable models are available under stronger controls when the potential
• 18:21
  Speaker 1: consequences of misuse are unusually high. Anthropix report points toward
• 18:26
  Speaker 1: exactly that kind of layered approach. Rather than relying on
• 18:30
  Speaker 1: content filters alone, the company says future safeguards may need
• 18:34
  Speaker 1: to combine identity verification, institutional vetting, and closer monitoring of
• 18:39
  Speaker 1: users seeking advanced biological capabilities. That proposal reflects a broader shift.
• 18:44
  Speaker 2: In AI safety thinking.
• 18:46
  Speaker 1: Traditional content moderation asks whether a response violates a policy.
• 18:50
  Speaker 1: A stronger security architecture asks who is receiving the response,
• 18:55
  Speaker 1: what they are trying to accomplish, how often they have
• 18:58
  Speaker 1: requested related information, and whether their behavior is consistent with
• 19:02
  Speaker 1: the privileges assigned to them. This is closer to how
• 19:05
  Speaker 1: cybersecurity systems operate. A bank does not rely solely on
• 19:09
  Speaker 1: a list of forbidden words to stop fraud. It looks
• 19:12
  Speaker 1: at account identity, transaction patterns, location, history, and anomalies. Biological
• 19:19
  Speaker 1: AI security may eventually require a comparable model. The Chikungunya
• 19:23
  Speaker 1: case also raises the question of responsibility. If a researcher
• 19:27
  Speaker 1: uses a frontier AI system to support sensitive work, how
• 19:31
  Speaker 1: much accountability belongs to the scientist? How much to the institution?
• 19:36
  Speaker 1: How much to the platform hosting the model? And how
• 19:39
  Speaker 1: much to the AI developer? There is no simple answer.
• 19:43
  Speaker 1: The scientist controls the scientific objective and physical laboratory. The
• 19:48
  Speaker 1: institution controls access to equipment, materials, and research oversight. The
• 19:53
  Speaker 1: platform controls how users connect to the AI system. The
• 19:57
  Speaker 1: model provider controls the safeguards and permissions built into the model.
• 20:02
  Speaker 1: A failure may involve weaknesses at multiple points rather than
• 20:05
  Speaker 1: one negligent actor. The orthopoxvirus case adds another layer to
• 20:09
  Speaker 1: the warning because it shows how an AI system can
• 20:12
  Speaker 1: be drawn into sensitive research through a request that appears,
• 20:15
  Speaker 1: at first glance, to have an ordinary scientific purpose. Anthropix
• 20:20
  Speaker 1: says a researcher linked to a state-associated infectious disease laboratory
• 20:24
  Speaker 1: used CLAWD to prepare an orthopoxvirus research grant from beginning
• 20:28
  Speaker 1: to end in roughly an hour. The proposal concerned genes
• 20:32
  Speaker 1: involved in weakening the human immune response. and included major
• 20:36
  Speaker 1: elements of the research plan. Anthropic explains that the work
• 20:39
  Speaker 1: was presented as an effort to study how the virus
• 20:42
  Speaker 1: might be weakened, which meant the model's safeguards did not
• 20:46
  Speaker 1: necessarily block the interaction. Yet the company concluded that some
• 20:50
  Speaker 1: of the same biological knowledge could potentially have a dual-use
• 20:53
  Speaker 1: dimension if applied toward preserving or enhancing a virus's ability
• 20:58
  Speaker 1: to evade the immune system.
• 21:00
  Speaker 2: Once again, The.
• 21:01
  Speaker 1: Issue is not that every orthopoxvirus research project is dangerous.
• 21:06
  Speaker 1: Scientists legitimately study viruses and their interaction with the immune
• 21:10
  Speaker 1: system for a wide range of reasons, including vaccine development,
• 21:14
  Speaker 1: antiviral research, and disease surveillance. Orthopoxviruses include a variety of viruses,
• 21:20
  Speaker 1: among them the virus associated with smallpox and the virus
• 21:24
  Speaker 1: associated with pox, so research in the field can be
• 21:27
  Speaker 1: highly important to global health. The problem arises when an
• 21:31
  Speaker 1: AI system has to decide whether a specific request is
• 21:34
  Speaker 1: a benign scientific exercise or one piece of a larger
• 21:38
  Speaker 1: program that may have more dangerous implications. From the model's perspective,
• 21:43
  Speaker 1: context can be incomplete. A prompt asking for help organizing
• 21:47
  Speaker 1: a research proposal may contain no obvious indication of malicious intent.
• 21:52
  Speaker 1: It may use conventional academic terminology and present the work
• 21:55
  Speaker 1: as a defensive project. Yet the underlying research program could
• 21:59
  Speaker 1: still have implications beyond the stated goal. This is precisely
• 22:03
  Speaker 1: the kind of edge case that worries AI safety teams.
• 22:07
  Speaker 1: A system that blocks anything mentioning a dangerous pathogen would
• 22:10
  Speaker 1: quickly become unusable for legitimate biomedical science, while a system
• 22:15
  Speaker 1: that trusts the user's stated purpose may fail to identify
• 22:19
  Speaker 1: sophisticated misuse. Anthropic's experience suggests that the answer cannot be
• 22:24
  Speaker 1: found in simple keyword filters. Instead, The model may need
• 22:28
  Speaker 1: to be supported by external verification and risk assessment systems
• 22:32
  Speaker 1: that operate around the conversation itself. The orthopoxvirus example also
• 22:37
  Speaker 1: illustrates the value and the risk of AI-generated scientific writing.
• 22:42
  Speaker 1: Preparing a grant is not the same as carrying out
• 22:45
  Speaker 1: an experiment, and a well-written document does not prove that
• 22:48
  Speaker 1: a research program is likely to succeed. But writing and
• 22:52
  Speaker 1: planning can still reduce friction. A researcher no longer has
• 22:56
  Speaker 1: to begin with a blank page, Search manually for every
• 22:59
  Speaker 1: relevant concept or spend as much time translating an idea
• 23:03
  Speaker 1: into formal scientific language. An advanced model can help structure hypotheses,
• 23:08
  Speaker 1: organize sections, compare approaches, and improve communication. Those are major
• 23:14
  Speaker 1: benefits for legitimate science. But from a security perspective, every
• 23:18
  Speaker 1: reduction in friction deserves examination when it is applied to
• 23:22
  Speaker 1: high-consequence fields. The concern is not that AI will instantly
• 23:26
  Speaker 1: transform a novice into a world-class virologist. Anthropic's own earlier
• 23:31
  Speaker 1: work has acknowledged that there remains a major difference between
• 23:34
  Speaker 1: answering scientific questions, generating plans, and actually succeeding in a
• 23:39
  Speaker 1: physical laboratory. Materials, tacit knowledge, equipment, experimental failure, and human
• 23:46
  Speaker 1: persistence all matter. Yet reducing the cognitive and administrative burden
• 23:51
  Speaker 1: can still provide meaningful assistance to someone who already possesses
• 23:54
  Speaker 1: the other pieces. That is why the orthopoxvirus case should
• 23:58
  Speaker 1: be understood as a capability transfer problem rather than a
• 24:02
  Speaker 1: science fiction scenario. The model is helping move knowledge through
• 24:06
  Speaker 1: a system more efficiently, and the security challenge is determining
• 24:09
  Speaker 1: where that assistance becomes too consequential to provide without additional controls.
• 24:14
  Speaker 1: There is also an important institutional lesson here. Anthropic says
• 24:18
  Speaker 1: the researcher was connected to a state-associated laboratory. That does
• 24:23
  Speaker 1: not automatically imply hostile intent, and the company does not
• 24:27
  Speaker 1: claim that the work represented an attempt to create a weapon.
• 24:30
  Speaker 2: State-linked research can.
• 24:31
  Speaker 1: Include entirely legitimate public health programs, outbreak preparedness, vaccine research,
• 24:38
  Speaker 1: and basic science. But the institutional connection does matter because
• 24:42
  Speaker 1: it demonstrates that advanced biological AI capabilities may be relevant
• 24:46
  Speaker 1: to government-affiliated research environments, not only individual hobbyists or anonymous
• 24:52
  Speaker 1: online actors. As AI models become more capable in scientific domains,
• 24:57
  Speaker 1: institutions that once relied on human specialists alone may increasingly
• 25:01
  Speaker 1: incorporate these systems into routine workflows. That means safety controls
• 25:06
  Speaker 1: need to work at the institutional level as well as
• 25:08
  Speaker 1: the user level. The two toxin-related cases in Anthropix report
• 25:13
  Speaker 1: broaden the warning beyond viruses and show that the same
• 25:16
  Speaker 1: AI safety problem can arise whenever scientific knowledge sits at
• 25:20
  Speaker 1: the boundary between legitimate medicine and harmful capability. In one case,
• 25:25
  Speaker 1: Anthropix as a researcher used Claude to construct a broad
• 25:29
  Speaker 1: catalog of toxin-related peptides drawn from multiple venomous animal lineages,
• 25:34
  Speaker 1: and then developed a computational process for optimizing their characteristics.
• 25:39
  Speaker 1: The stated purpose was therapeutic, with potential applications involving pain treatment, antidepressants,
• 25:45
  Speaker 1: and other medicines. Yet the dataset also included structures associated
• 25:50
  Speaker 1: with paralytic toxins that could potentially serve harmful purposes. In
• 25:54
  Speaker 1: another case, a researcher used Claude to help redesign several
• 25:58
  Speaker 1: toxins and then used the model to assist with progress
• 26:01
  Speaker 1: reporting while deliberately keeping the identities of some of the
• 26:05
  Speaker 1: compounds vague. Anthropic presents these examples to demonstrate a core
• 26:09
  Speaker 1: challenge of biological AI safety. The difference between beneficial intent
• 26:14
  Speaker 1: and dangerous capability can be very difficult to detect from
• 26:18
  Speaker 1: technical language alone. A drug development program and a harmful
• 26:22
  Speaker 1: toxin project can involve overlapping concepts, similar computational tools, and
• 26:27
  Speaker 1: some of the same scientific literature. The words used to
• 26:31
  Speaker 1: describe the work may sound routine even when the downstream
• 26:34
  Speaker 1: implications are not. This means a model that relies solely
• 26:37
  Speaker 1: on surface-level patterns can either overblock legitimate work or underblock
• 26:42
  Speaker 1: risky assistance. Both outcomes carry costs. Overblocking can frustrate scientists
• 26:48
  Speaker 1: and reduce the usefulness of AI in medicine. Underblocking can
• 26:52
  Speaker 1: create a pathway through which sensitive capabilities become easier to
• 26:56
  Speaker 1: acquire or optimize. The toxin cases also demonstrate why researchers
• 27:00
  Speaker 1: can sometimes operate in the gray zone between biological information
• 27:04
  Speaker 1: and physical world action. A model can help with conceptual organization,
• 27:09
  Speaker 1: data interpretation, computational analysis, and written reporting without ever touching
• 27:14
  Speaker 1: a physical sample. Yet these are not meaningless contributions. Scientific
• 27:19
  Speaker 1: progress is cumulative. A researcher may combine model-generated analysis with
• 27:25
  Speaker 1: laboratory experience, existing datasets, published literature, and institutional resources. Each
• 27:32
  Speaker 1: input may be ordinary on its own, but together they
• 27:35
  Speaker 1: may create a more sophisticated workflow. This is one reason
• 27:38
  Speaker 1: Anthropic and other AI companies have increasingly focused on whether
• 27:42
  Speaker 1: their models can meaningfully assist with dangerous scientific tasks rather
• 27:47
  Speaker 1: than simply whether they can recite dangerous information. The distinction
• 27:51
  Speaker 1: is subtle but essential. Information is already widely available in
• 27:55
  Speaker 1: scientific literature. The question is whether AI makes that information
• 28:00
  Speaker 1: more usable, more accessible, or more efficient for someone who
• 28:03
  Speaker 1: already has the capacity to act on it. Anthropix Broader
• 28:07
  Speaker 1: Biological Risk Research argues that this is increasingly plausible as
• 28:11
  Speaker 1: frontier models become stronger in molecular and life sciences reasoning.
• 28:16
  Speaker 1: The company has reported that newer models can perform impressively
• 28:20
  Speaker 1: on some expert-level biological tasks and that they can provide
• 28:24
  Speaker 1: more assistance in scenarios involving acquisition or planning for dangerous
• 28:28
  Speaker 1: biological capabilities. At the same time, Anthropic has repeatedly acknowledged
• 28:34
  Speaker 1: that these evaluations are imperfect proxies for real-world success. A
• 28:39
  Speaker 1: person still needs materials, laboratory access, technical judgment, and persistence
• 28:44
  Speaker 1: to translate digital assistance into physical outcomes. That caveat should
• 28:49
  Speaker 1: remain central to any serious discussion of the new report.
• 28:53
  Speaker 1: the evidence does not show that an AI system can
• 28:55
  Speaker 1: independently produce a biological weapon on demand. It shows that
• 29:00
  Speaker 1: AI is increasingly capable of contributing to workflows that previously
• 29:04
  Speaker 1: depended on highly specialized human expertise. For security officials, that
• 29:09
  Speaker 1: difference is still consequential. If the cost of obtaining useful
• 29:13
  Speaker 1: scientific assistance falls, the population of people capable of attempting
• 29:17
  Speaker 1: advanced work may grow. A task that once required a
• 29:21
  Speaker 1: large team of specialists could become easier for a smaller
• 29:24
  Speaker 1: group with access to strong AI tools. That does not
• 29:27
  Speaker 1: automatically mean catastrophe, but it changes the threat landscape. The
• 29:31
  Speaker 1: toxin cases also show why safety cannot focus exclusively on
• 29:35
  Speaker 1: famous pandemic pathogens. Biological threats can involve toxins. engineered proteins,
• 29:42
  Speaker 1: harmful peptides, and other compounds that fall outside a narrow
• 29:46
  Speaker 1: definition of virus research. A mature security framework therefore has
• 29:51
  Speaker 1: to be capability-based rather than list-based. Instead of asking only
• 29:55
  Speaker 1: whether a user is discussing a particular organism, the system
• 29:59
  Speaker 1: may need to ask whether the requested assistance would materially
• 30:02
  Speaker 1: increase a user's ability to create, optimize, deploy, or conceal
• 30:07
  Speaker 1: a harmful biological agent or toxin. That is a much
• 30:11
  Speaker 1: more difficult problem because it requires a deeper understanding of
• 30:14
  Speaker 1: context and potential downstream effects. Perhaps the most unsettling figure
• 30:19
  Speaker 1: in Anthropic's disclosure is not one of the five detailed cases,
• 30:23
  Speaker 1: but the company's broader finding that, during a 30-day review
• 30:27
  Speaker 1: of activity associated with adversarial state institutions. It identified roughly
• 30:33
  Speaker 1: 35 distinct biological research efforts, most of which involved ordinary
• 30:37
  Speaker 1: civilian science, but some of which carried what Anthropic described
• 30:41
  Speaker 1: as notable dual-use potential. That broader number is important because
• 30:45
  Speaker 1: it suggests the five published cases may represent selected examples
• 30:49
  Speaker 1: rather than the entire scope of the activity the company
• 30:52
  Speaker 1: is seeing.
• 30:53
  Speaker 2: Again, the word potential matters.
• 30:56
  Speaker 1: Anthropic is not saying that 35 research efforts were weapons programs.
• 31:01
  Speaker 1: It is not saying that all of the researchers had
• 31:03
  Speaker 1: hostile intent.
• 31:05
  Speaker 2: It is saying that among a.
• 31:06
  Speaker 1: Much larger pool of biological activity, there were projects whose
• 31:10
  Speaker 1: scientific objectives or methods created enough concern to deserve additional scrutiny.
• 31:15
  Speaker 1: That is exactly how risk monitoring often works. Security professionals
• 31:20
  Speaker 1: do not wait until a catastrophic event happens before examining
• 31:23
  Speaker 1: patterns that could become dangerous. They look for signals, investigate anomalies,
• 31:28
  Speaker 1: and try to understand whether a trend is changing. Anthropic
• 31:32
  Speaker 1: appears to be warning that the trend is changing. Frontier
• 31:36
  Speaker 1: AI models are becoming more capable in areas of biology
• 31:39
  Speaker 1: that once required narrow expertise, and researchers are experimenting with
• 31:44
  Speaker 1: those systems in increasingly sophisticated ways. Some users are also
• 31:48
  Speaker 1: demonstrating an interest in getting around restrictions when they encounter them.
• 31:52
  Speaker 1: The combination of increasing capability and determined users is what
• 31:57
  Speaker 1: makes the issue important. Neither factor alone necessarily produces a crisis.
• 32:02
  Speaker 1: Powerful scientific tools can be enormously beneficial, and most scientists
• 32:07
  Speaker 1: use them for legitimate purposes. But as capabilities rise, the
• 32:11
  Speaker 1: security margin can narrow. A model that was clearly incapable
• 32:15
  Speaker 1: of providing meaningful support for a dangerous scientific task a
• 32:19
  Speaker 1: year ago may now be able to provide substantial assistance,
• 32:23
  Speaker 1: even if it still cannot perform the task autonomously. That
• 32:26
  Speaker 1: trajectory matters because safety systems have to anticipate capability growth
• 32:31
  Speaker 1: rather than simply react to today's threat level. Anthropic's earlier
• 32:35
  Speaker 1: biological risk research makes that point explicitly. The company has
• 32:40
  Speaker 1: reported rapid gains in model performance on virology troubleshooting and
• 32:44
  Speaker 1: other biological evaluations, with some newer systems surpassing human baselines
• 32:49
  Speaker 1: on certain specialized tasks. It has also found that people
• 32:53
  Speaker 1: given access to stronger models can produce substantially better results
• 32:57
  Speaker 1: on some text-based evaluations related to dangerous biological planning than
• 33:01
  Speaker 1: participants with internet access alone. At the same time, Anthropic
• 33:06
  Speaker 1: has emphasized that these experiments are imperfect and do not
• 33:10
  Speaker 1: prove real-world weapon development. The distinction between a text-based evaluation
• 33:15
  Speaker 1: and a functioning biological project remains large. But the fact
• 33:19
  Speaker 1: that the gap is narrowing enough to justify repeated testing
• 33:22
  Speaker 1: indicates why the industry is taking the issue seriously. The
• 33:26
  Speaker 1: 35 case figure also raises a question about scale. Even
• 33:30
  Speaker 1: if only a small fraction of those projects were high-risk,
• 33:33
  Speaker 1: The number could become significant if similar activity is occurring
• 33:37
  Speaker 1: across multiple AI providers. Anthropix report is based on what
• 33:41
  Speaker 1: the company can observe through its own systems and investigative methods.
• 33:46
  Speaker 1: Other labs may be seeing different patterns. OpenAI, Google, specialized
• 33:51
  Speaker 1: biology platforms, and smaller model providers may each have their
• 33:55
  Speaker 1: own user populations and access controls. That means the true
• 33:59
  Speaker 1: scale of AI-assisted sensitive biological research is almost certainly larger.
• 34:03
  Speaker 2: Than what any one company can see.
• 34:06
  Speaker 1: The security community therefore faces an information-sharing problem. Companies may
• 34:11
  Speaker 1: discover suspicious activity but hesitate to share details because of privacy, competition,
• 34:17
  Speaker 1: legal risk, or uncertainty about what exactly they are observing.
• 34:21
  Speaker 1: Governments may have intelligence that AI developers do not. Research
• 34:25
  Speaker 1: institutions may understand the biological context better than software companies.
• 34:30
  Speaker 1: Without mechanisms for sharing enough information to recognize cross-platform patterns,
• 34:35
  Speaker 1: each organization may see only one piece of the puzzle.
• 34:39
  Speaker 1: Anthropic has called for closer cooperation between AI companies and
• 34:43
  Speaker 1: governments in previous policy proposals, including stronger monitoring, identity verification,
• 34:49
  Speaker 1: and threat intelligence sharing. Those ideas are becoming more relevant
• 34:54
  Speaker 1: as the examples accumulate. The broader policy conversation also involves
• 34:58
  Speaker 1: access to biological materials, not just access to AI. An
• 35:03
  Speaker 1: AI model can provide assistance, but the physical world still
• 35:06
  Speaker 1: imposes constraints. Researchers need samples, equipment, facilities, trained personnel, and
• 35:13
  Speaker 1: safe operating environments. That means governments can reduce risk by
• 35:17
  Speaker 1: strengthening multiple layers at once. Anthropic's warning also lands in
• 35:22
  Speaker 1: the middle of a broader debate about whether artificial intelligence
• 35:25
  Speaker 1: is beginning to move faster than the institutions responsible for
• 35:29
  Speaker 1: managing its risks. That debate is not limited to biology.
• 35:33
  Speaker 1: Security researchers have already documented situations in which AI systems
• 35:38
  Speaker 1: behaved unexpectedly in cybersecurity evaluations, gained access to real systems
• 35:43
  Speaker 1: when test environments were misconfigured or took actions beyond what
• 35:47
  Speaker 1: their operators anticipated. Anthropic itself recently disclosed several incidents in
• 35:53
  Speaker 1: which clawed models operating in evaluation environments reached the internet
• 35:57
  Speaker 1: and obtained unauthorized access to production infrastructure because testing environments
• 36:02
  Speaker 1: had been configured incorrectly. The company has responded by expanding
• 36:06
  Speaker 1: its monitoring and studying the incidents with outside organizations. Those
• 36:11
  Speaker 1: events and the biological findings share a common theme even
• 36:14
  Speaker 1: though the underlying threats are different. Advanced models are becoming
• 36:18
  Speaker 1: capable enough that assumptions about what they can or cannot
• 36:21
  Speaker 1: do are becoming less reliable. In cybersecurity, the concern is
• 36:25
  Speaker 1: that a model may exploit a vulnerability or automate parts
• 36:29
  Speaker 1: of an intrusion. In biology, the concern is that the
• 36:32
  Speaker 1: model may accelerate scientific work with dangerous dual-use potential. In
• 36:37
  Speaker 1: both domains, the system's capabilities interact with human intent, external tools,
• 36:43
  Speaker 1: and real-world infrastructure. That interaction creates a risk that cannot
• 36:48
  Speaker 1: be fully understood by evaluating the model in isolation. This
• 36:52
  Speaker 1: is why Anthropic has invested heavily in what it calls
• 36:55
  Speaker 1: frontier red team work. The company is not simply asking
• 36:59
  Speaker 1: whether a model can answer questions. It is testing what
• 37:02
  Speaker 1: could happen when the model is placed in realistic environments
• 37:05
  Speaker 1: where users may have access to tools, internet connectivity, or
• 37:09
  Speaker 1: scientific workflows. The results are important because traditional benchmarks can
• 37:13
  Speaker 1: underestimate systemic risk. A model may score a certain way
• 37:17
  Speaker 1: on a closed test while behaving very differently when connected
• 37:21
  Speaker 1: to external systems and given persistent interaction. The biological findings
• 37:26
  Speaker 1: fit that pattern. A text response about a pathogen may
• 37:29
  Speaker 1: not appear dangerous on its own. But when that response
• 37:32
  Speaker 1: is one part of a months-long research effort involving an
• 37:35
  Speaker 1: experienced scientist and real laboratory resources, the combined effect can
• 37:40
  Speaker 1: be very different. This is why safety engineers increasingly talk
• 37:45
  Speaker 1: about blast radius, meaning not simply whether a model makes
• 37:48
  Speaker 1: a mistake, but how much damage that mistake could cause
• 37:51
  Speaker 1: when the system has access to powerful tools or is
• 37:54
  Speaker 1: embedded in important workflows. Anthropic has argued that as AI
• 37:58
  Speaker 1: agents become more capable, Controlling that blast radius becomes a
• 38:03
  Speaker 1: central engineering problem. The biological report shows how the same
• 38:07
  Speaker 1: concept applies outside computer networks. A model integrated into a
• 38:12
  Speaker 1: biological research platform could influence scientific decisions even if it
• 38:16
  Speaker 1: never directly touches a laboratory instrument. The practical challenge is
• 38:21
  Speaker 1: therefore to control the pathways between digital reasoning and physical action.
• 38:25
  Speaker 1: That requires more than better refusals. It requires careful design
• 38:30
  Speaker 1: of permissions, auditing identity systems, tool access, and institutional oversight.
• 38:35
  Speaker 1: The emerging debate also concerns how much responsibility should be
• 38:39
  Speaker 1: placed on AI companies. Some policymakers may argue that model
• 38:43
  Speaker 1: providers should bear most of the burden because they control
• 38:47
  Speaker 1: the technology. Others will emphasize that laboratories, universities, companies, and
• 38:52
  Speaker 1: governments also control critical parts of the risk environment. Anthropix
• 38:57
  Speaker 1: Report supports the second view. The company can improve its
• 39:01
  Speaker 1: own safeguards, but it cannot control what a researcher does
• 39:05
  Speaker 1: outside the model or what another model might provide after
• 39:08
  Speaker 1: Claude refuses. That means the solution has to extend beyond
• 39:12
  Speaker 1: one vendor. It may involve standards for AI use in
• 39:15
  Speaker 1: high-risk scientific domains, agreements between model providers about threat indicators
• 39:21
  Speaker 1: and common expectations for identity verification. It may also involve
• 39:25
  Speaker 1: governments establishing clearer rules for access to certain advanced biological
• 39:29
  Speaker 1: AI AI capabilities, especially when those systems demonstrate performance beyond
• 39:34
  Speaker 1: what previous models could reliably provide. At the same time,
• 39:39
  Speaker 1: regulation has to account for how quickly the technology changes.
• 39:43
  Speaker 1: A rule written around one model generation could become obsolete as.
• 39:47
  Speaker 2: Soon as a more.
• 39:49
  Speaker 1: Policymakers, therefore, need frameworks that focus on capabilities and risk
• 39:54
  Speaker 1: thresholds rather than on the names of individual models. Another
• 39:58
  Speaker 1: complication is international competition. AI development is global and biological
• 40:04
  Speaker 1: research is global. If one country's companies impose strong restrictions
• 40:08
  Speaker 1: while another jurisdiction offers powerful systems with few controls, researchers
• 40:13
  Speaker 1: may migrate toward the easier route. That could create a
• 40:17
  Speaker 1: race to the bottom in access standards. The political and
• 40:20
  Speaker 1: national security implications of Anthropic's report are likely to grow
• 40:25
  Speaker 1: as governments decide how much oversight should accompany the rapid
• 40:28
  Speaker 1: expansion of advanced AI in scientific fields. The United States
• 40:33
  Speaker 1: has already treated the most capable models as a potential
• 40:36
  Speaker 1: national security concern in some contexts, including through export restrictions
• 40:41
  Speaker 1: and scrutiny of technologies that could provide strategic advantages to
• 40:45
  Speaker 1: foreign governments. Anthropic itself has experienced government action affecting access
• 40:51
  Speaker 1: to some of its advanced models, and the company has
• 40:54
  Speaker 1: previously described situations in which US authorities imposed restrictions based
• 40:58
  Speaker 1: on concerns about possible misuse by foreign nationals. The new
• 41:02
  Speaker 1: biological report adds another dimension to those debates because it
• 41:06
  Speaker 1: suggests that scientific capabilities can be transferred through software rather
• 41:10
  Speaker 1: than through physical equipment. In traditional national security policy, A
• 41:15
  Speaker 1: government can control the export of a specialized machine, a
• 41:19
  Speaker 1: biological sample, or a piece of sensitive hardware. AI complicates
• 41:24
  Speaker 1: that model because the capability may exist in a remote
• 41:27
  Speaker 1: service accessible through the internet. The strategic question becomes not
• 41:31
  Speaker 1: only where the technology is located, but who can access it,
• 41:35
  Speaker 1: under what identity, through which institution, and for what purpose.
• 41:40
  Speaker 1: That is likely to drive new debates about verification and access.
• 41:44
  Speaker 1: Supporters of stronger controls will argue that frontier biological AI
• 41:49
  Speaker 1: deserves special treatment because the consequences of misuse.
• 41:52
  Speaker 2: Could be extreme.
• 41:53
  Speaker 1: They may call for tighter scrutiny of foreign users, more
• 41:57
  Speaker 1: robust institutional authentication, and closer collaboration between AI developers and
• 42:02
  Speaker 1: government security agencies. Critics may worry about overreach, privacy, and
• 42:07
  Speaker 1: the possibility that national security restrictions could interfere with legitimate
• 42:12
  Speaker 1: scientific collaborations. Those concerns are real. Global science depends heavily
• 42:18
  Speaker 1: on international exchange, and many of the world's most important
• 42:21
  Speaker 1: biomedical discoveries are produced through cross-border partnerships. Researchers need access
• 42:27
  Speaker 1: to advanced computational tools, and institutions often work with scientists
• 42:32
  Speaker 1: whose projects span multiple countries. A poorly designed regulatory system
• 42:37
  Speaker 1: could slow beneficial research without meaningfully reducing malicious activity. The
• 42:42
  Speaker 1: policy challenge is therefore one of proportionality. The strongest restrictions
• 42:47
  Speaker 1: should be focused where the risks are clearest and should
• 42:50
  Speaker 1: be based on demonstrable capabilities rather than nationality alone. Anthropic's
• 42:55
  Speaker 1: report also complicates the idea that only obviously hostile actors
• 42:59
  Speaker 1: present a threat. The company says most of the 35
• 43:03
  Speaker 1: biological research efforts it identified were ordinary civilian science, and
• 43:08
  Speaker 1: that it is not claiming the five published cases involved
• 43:11
  Speaker 1: plans to create biological weapons. That suggests risk management has
• 43:16
  Speaker 1: to function in environments where legitimate and dangerous activity can
• 43:19
  Speaker 1: exist side by side. A researcher may be conducting valuable
• 43:23
  Speaker 1: medical work while also asking questions that deserve additional oversight.
• 43:28
  Speaker 1: An institution may be trustworthy, but still contain a project
• 43:31
  Speaker 1: that requires heightened controls. A model provider may have no
• 43:35
  Speaker 1: reason to distrust a user until a pattern emerges across
• 43:39
  Speaker 1: weeks of interactions. These realities argue for systems that can
• 43:42
  Speaker 1: increase scrutiny gradually as risk indicators accumulate rather than relying
• 43:47
  Speaker 1: on a single yes or no determination. From a government perspective,
• 43:51
  Speaker 1: This could involve building formal channels for exchanging information with
• 43:55
  Speaker 1: AI companies when unusual patterns appear. From an industry's perspective,
• 44:00
  Speaker 1: it could mean establishing standards for how high-risk users are
• 44:04
  Speaker 1: vetted and how access is suspended when a provider detects
• 44:07
  Speaker 1: circumvention behavior. From the research community's perspective, it may mean
• 44:12
  Speaker 1: incorporating AI governance into existing biosafety and ethics processes. The
• 44:17
  Speaker 1: goal would be to create a chain of accountability in
• 44:20
  Speaker 1: which every actor understands its role. That becomes especially important
• 44:24
  Speaker 1: when research has international dimensions. Suppose a scientist working at
• 44:29
  Speaker 1: a legitimate institution accesses an advanced AI service through a
• 44:33
  Speaker 1: partner platform in another country and then collaborates with a
• 44:37
  Speaker 1: second institution using a different model. Each organization may believe
• 44:41
  Speaker 1: it is only responsible for its own piece of the project.
• 44:45
  Speaker 1: Yet the combined system could create capabilities that no single
• 44:48
  Speaker 1: participant intended or fully understands. A coordinated governance framework could
• 44:53
  Speaker 1: help prevent those blind spots. The report also has implications
• 44:57
  Speaker 1: for how AI companies think about commercial access. Advanced models
• 45:02
  Speaker 1: are increasingly marketed as research assistants, coding agents, scientific collaborators,
• 45:07
  Speaker 1: and productivity tools. The competitive pressure to maximize capability can
• 45:12
  Speaker 1: create incentives to make access easier. The final takeaway from
• 45:16
  Speaker 1: Anthropic's warning is neither that artificial intelligence has already unleashed
• 45:21
  Speaker 1: a biological catastrophe nor that the danger can be dismissed
• 45:25
  Speaker 1: because no attack has occurred. The more important conclusion is
• 45:29
  Speaker 1: that the boundary between advanced software and high-consequence scientific capability
• 45:33
  Speaker 1: is moving and institutions are being forced to adapt before
• 45:37
  Speaker 1: they fully understand where that boundary will settle. The five
• 45:41
  Speaker 1: cases described by Anthropic provide an unusually concrete snapshot of
• 45:45
  Speaker 1: that transition. Researchers outside the United States used frontier AI
• 45:50
  Speaker 1: systems in work involving dangerous or potentially dangerous biological questions.
• 45:55
  Speaker 1: Some of the projects had legitimate medical or defensive explanations.
• 46:00
  Speaker 1: Some involved users who took steps to get around geographic
• 46:03
  Speaker 1: restrictions or model safeguards. Anthropic says the cases do not
• 46:07
  Speaker 1: demonstrate an imminent attack or prove that the researchers intended
• 46:11
  Speaker 1: to produce biological weapons. Yet the company also argues that
• 46:15
  Speaker 1: the activity shows a real shift in how sophisticated scientific
• 46:19
  Speaker 1: work is being carried out. That is the part of
• 46:21
  Speaker 1: the story that deserves sustained attention. AI is moving from
• 46:26
  Speaker 1: a tool used to search for information toward a more
• 46:28
  Speaker 1: active partner in scientific reasoning. And as that happens, its
• 46:32
  Speaker 1: influence spreads into areas where small improvements in efficiency can
• 46:35
  Speaker 1: have outsized consequences. Biology is one of those areas because
• 46:40
  Speaker 1: the potential benefits are enormous and the potential harms can
• 46:43
  Speaker 1: also be enormous. A better model can help scientists understand disease,
• 46:48
  Speaker 1: identify treatment candidates, and respond to outbreaks. The same model
• 46:53
  Speaker 1: can also help a determined researcher work through complex biological
• 46:56
  Speaker 1: questions more quickly. The challenge is not choosing whether AI
• 47:00
  Speaker 1: should be used in medicine. It almost certainly will be.
• 47:04
  Speaker 1: The challenge is deciding how powerful those systems should be,
• 47:07
  Speaker 1: who should have access to them, and what safeguards must
• 47:10
  Speaker 1: be in place when the stakes are exceptionally high. Anthropic's
• 47:14
  Speaker 1: answer is already pointing toward a new security model. The
• 47:18
  Speaker 1: company says content filters remain useful but are not enough
• 47:21
  Speaker 1: by themselves. Stronger protections may require identity verification, institutional vetting,
• 47:28
  Speaker 1: user monitoring, and cooperation among AI companies, governments, and the
• 47:33
  Speaker 1: organizations that operate biological research programs. That means safety has
• 47:38
  Speaker 1: to become layered. A model should refuse clearly dangerous requests.
• 47:42
  Speaker 1: A platform should verify access to especially sensitive capabilities. An
• 47:47
  Speaker 1: institution should know which researchers are using advanced systems and.
• 47:51
  Speaker 2: For what kinds of work.
• 47:53
  Speaker 1: Governments should have channels for sharing credible threat information. And
• 47:57
  Speaker 1: the scientific community should continue strengthening rules for handling biological
• 48:01
  Speaker 1: materials and conducting dual-use research. No individual layer can guarantee safety. Together, however,
• 48:09
  Speaker 1: they can raise the barriers to misuse. The report also
• 48:12
  Speaker 1: reinforces another principle. Warnings about AI risk should be evidence-based.
• 48:17
  Speaker 1: There is a temptation to describe every advanced model capability
• 48:21
  Speaker 1: as an existential threat, but sensationalism can be counterproductive. Anthropic
• 48:26
  Speaker 1: itself provides important qualifications. The company does not claim that
• 48:31
  Speaker 1: the reported researchers were building weapons.
• 48:34
  Speaker 2: It does not.
• 48:34
  Speaker 1: Claim that Claude independently carried out dangerous biological experimentation. it
• 48:39
  Speaker 1: does not claim that a biological attack is imminent. Those
• 48:43
  Speaker 1: limits matter because they separate observed facts from speculation. At
• 48:48
  Speaker 1: the same time, the company is not minimizing what it found.
• 48:52
  Speaker 1: It is saying that real users are testing the limits
• 48:54
  Speaker 1: of what advanced AI can contribute to sensitive biological research and,
• 48:59
  Speaker 1: in some cases, attempting to circumvent the systems designed to
• 49:02
  Speaker 1: restrict access. That is meaningful evidence of a changing risk environment.
• 49:08
  Speaker 1: The appropriate response is therefore neither panic nor complacency.
• 49:12
  Speaker 2: It is adaptation.
• 49:14
  Speaker 1: AI safety systems need to evolve as quickly as AI
• 49:17
  Speaker 1: capability does. A safeguard that worked for an earlier model
• 49:21
  Speaker 1: may be inadequate for a newer one. A rule designed
• 49:24
  Speaker 1: for ordinary chat use may not be sufficient when the
• 49:27
  Speaker 1: model becomes deeply integrated into scientific platforms. A geographic restriction
• 49:33
  Speaker 1: may be meaningless if users can route traffic through intermediaries.
• 49:37
  Speaker 1: An account ban may be temporary if a determined actor
• 49:40
  Speaker 1: can create new identities. These are not theoretical engineering details.
• 49:45
  Speaker 1: Anthropic says it has already encountered them. The next generation
• 49:49
  Speaker 1: of safety systems will therefore need to be more aware
• 49:52
  Speaker 1: of patterns, identities, and context. They will need to distinguish
• 49:56
  Speaker 1: between ordinary scientific curiosity and sustained attempts to acquire sensitive assistance.
• 50:02
  Speaker 1: They may need to apply different levels of scrutiny depending
• 50:05
  Speaker 1: on the user's role, institution, and requested capability. They may
• 50:09
  Speaker 1: also need to make stronger use of human review in
• 50:12
  Speaker 1: cases where automated systems cannot reliably determine risk.