TorontoStartsBook a call

AI-Designed Viruses Raise Biosecurity Alarm

Silicon Scoop · Episode 546 · September 18, 2026

AI-designed viruses spark biosecurity policy debate. See bacteriophage genomes, generative biology, and NIH rules shaping the risk.

With Craig Major and Jon Irwin

Open audio in your browser
AI-Designed Viruses Raise Biosecurity Alarm

Watch this episode

Watch on YouTube
AI-designed viruses

AI-Designed Viruses Just Opened a Biosecurity Pandora’s Box

Estimated reading time: 10 minutes

Key Takeaways

  • The words “AI-designed viruses” would have sounded like science fiction five years ago.
  • In August 2026, scientists at the Arc Institute in Palo Alto, California confirmed they had used a genome language model called Evo to generate entirely new viral genomes from scratch.
  • Sixteen of them actually worked.
  • The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not.
  • Purely computational (i.e., in silico) research that may include development of computational models and software, or may use such means to design novel forms of biological agents, is not prohibited by this policy unless it involves an “entity of concern.”

Table of contents

The words “AI-designed viruses” would have sounded like science fiction five years ago. Today, they describe a real experiment published in one of the world’s most respected scientific journals — and the results are forcing policymakers, biosecurity experts, and researchers to ask questions nobody has fully answered yet.

In August 2026, scientists at the Arc Institute in Palo Alto, California confirmed they had used a genome language model called Evo to generate entirely new viral genomes from scratch. These weren’t modified versions of existing viruses. They were novel, functional bacteriophages — viruses that infect bacteria — produced through what researchers are calling generative biology. Sixteen of them actually worked.

This is the story of what they built, why it matters, what it still can’t do, and most importantly, what the rules currently say about all of it (spoiler: not much).

—

What the Arc Institute Actually Built with Bacteriophage Genomes

To understand the experiment, you need to know what a bacteriophage is. A bacteriophage (or “phage”) is a virus that infects bacteria, not humans. Scientists have studied phages for over a century. They are used in medicine, particularly in cases where antibiotic-resistant bacteria don’t respond to traditional treatment. Phage therapy — using these viruses as a weapon against dangerous bacteria — is a growing and promising field.

What the Arc Institute team did was different from anything done before with phages. Instead of finding phages in nature or modifying existing ones, they asked an AI model to invent new ones entirely.

The model they used is called Evo. It is a genome language model — think of it like ChatGPT, but instead of being trained on human text, it was trained on biological sequences. Specifically, Evo was trained on data covering roughly 9 trillion nucleotides and a library of approximately 2 million bacteriophage-related sequences. This gave it a deep structural understanding of how viral DNA is put together.

Once trained, the researchers gave Evo one job: write new viral genomes.

Here is what the numbers looked like:

  • ~700,000 candidate genomes were generated by the AI
  • ~285 to 302 of those were synthesized (physically created) in the lab
  • 16 viable bacteriophages were confirmed to actually work

That is a hit rate of roughly 5 to 6 percent from the synthesized batch, and a tiny fraction of the total genomes generated. The researchers loaded their created molecules into bacteria to test them. Those 16 successful viruses not only survived — they infected bacteria, replicated, and spread. Some of them managed to overcome resistance in two strains of E. coli, which suggests they weren’t simple copies of anything found in nature.

The source virus the AI learned from most closely was ΦX174 (Phi X-174), a small, well-studied bacteriophage that is harmless to humans. The entire experiment was deliberately constrained to this relatively safe reference system.

(Source: Science study)

—

Why Generative Biology Is a Genuine Scientific Milestone

This matters beyond the headline numbers. What the Arc Institute team demonstrated is a new capability in generative biology — the idea that AI systems can now design functional biological components from scratch, not just analyze or modify existing ones.

For context, here is what was previously possible and what is new:

What scientists could already do:

  • Sequence and analyze viral genomes found in nature
  • Modify existing viruses in the lab (gain-of-function research)
  • Synthesize known viral sequences using established chemistry

What is new here:

  • Using an AI model to compose entirely novel viral genomes with no direct natural template
  • Confirming those genomes produce functional, replication-capable viruses
  • Demonstrating that AI-generated genomes can display properties — like overcoming bacterial resistance — beyond what simple copying would achieve

This is significant for phage therapy research, antibiotic resistance treatment, and the broader field of synthetic biology. The potential benefits are real. Phages designed by AI could theoretically be tailored to target specific antibiotic-resistant bacteria in ways that natural phages cannot.

But the scientific community is not only celebrating.

Professor Thomas V. Inglesby and Dr. Moritz S. Hanke from the Center for Health Security at Johns Hopkins University wrote an accompanying commentary published alongside the main study in Science. Their words were direct: “Although this is promising for life sciences applications, it also raises urgent biosafety and biosecurity questions. The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not.”

That last sentence is the one that keeps biosecurity experts up at night.

(Sources: Science study | Science commentary)

—

Stop Letting Manual Work Slow Down Your Business

While researchers race to understand the future of AI-designed systems, forward-thinking businesses are already putting AI to work right now — automating the repetitive tasks that drain your team’s time every single day.

At Flowgrammer, we help businesses remove manual bottlenecks, build smarter workflows, and scale operations without scaling headcount. Whether you’re managing client onboarding, data entry, reporting, or internal communications, there’s a faster way to run your business.

👉 See How Business Automation Can Transform Your Operations

—

The Biosecurity Policy Gap Nobody Has Closed Yet

Here is where the story gets genuinely uncomfortable.

On July 28, 2026 — just days before this study was published — the National Institutes of Health (NIH) released a new policy aimed at stopping high-risk life sciences research. The policy was designed to prevent scientists from conducting experiments that would make biological agents more dangerous, more transmissible, or more resistant to treatment.

This sounds like exactly the kind of regulation that should cover AI-designed viruses, right?

Not exactly.

The official policy document contains a carve-out that has drawn serious attention from the legal and biosecurity communities. It states clearly:

“Purely computational (i.e., in silico) research that may include development of computational models and software, or may use such means to design novel forms of biological agents, is not prohibited by this policy unless it involves an ‘entity of concern.'”

In plain language: if the work happens only on a computer and doesn’t touch a listed dangerous pathogen, it is largely outside the scope of this regulation.

An “entity of concern” refers to recognized dangerous pathogens — things like smallpox, anthrax, or select biological agents already on existing watchlists. The regulation makes sense for those known threats.

But the Arc Institute experiment exposes the flaw in that logic. What if an AI designs a new harmful virus — one that doesn’t appear on any existing list because it has never existed before? At the purely computational stage, it would fall outside the prohibited zone. The physical synthesis of that genome is a separate step, taken by a different person, possibly in a different country, possibly subject to a different set of rules entirely.

This is the regulatory gray zone that biosecurity experts are now describing. The tools to design novel viral genomes are real, accessible, and improving. The rules that govern them are lagging behind.

The NIH policy is not toothless — it does meaningful work in restricting dangerous laboratory experiments. But as legal and policy commentators have noted, the main long-term risk is that genome design tools become easier to access without a clear regulatory trigger until a harmful biological agent is physically created. By then, the design work is already done.

(Sources: NIH policy announcement | New York Times coverage)

—

What the Low Success Rate Actually Tells Us

One number in this story gets used as a comfort: only 16 out of 700,000 generated genomes were viable. That’s an incredibly low hit rate — roughly 0.002 percent of all generated candidates, if you’re calculating from the top.

Skeptics have pointed to this as evidence that AI isn’t really capable of designing dangerous pathogens efficiently. And for now, there is truth in that. Designing a specific, targeted, dangerous pathogen from scratch would require enormous resources, advanced technical knowledge to interpret and synthesize the outputs, and probably far more computing power than a lone bad actor currently has access to.

But this framing has a problem. The 16 viruses that worked weren’t supposed to be perfect. They were supposed to be novel and functional. They achieved that. And critically, they demonstrated properties — like overcoming resistance in two E. coli strains — that suggest the model learned something real and useful about how viruses work, not just how to shuffle genetic code randomly.

The Evo model was trained on a reference system intentionally kept safe. As researchers develop more powerful genome language models trained on broader and more diverse viral data, the efficiency of this process is expected to improve. The 0.002 percent hit rate of 2026 will not look the same in 2028 or 2030.

The scientific process of synthesizing viruses itself is not new — that technology existed well before any AI model was involved. What AI adds is the ability to generate novel candidate designs at a scale and speed that human researchers simply cannot match. That combination — speed, scale, and novelty — is what changes the risk calculation over time.

(Sources: New York Times coverage | CNN coverage)

—

What Experts Say Needs to Happen Next

The conversation among biosecurity professionals is not about shutting down AI research in biology. That ship has sailed, and the legitimate benefits are too large to ignore. Phage therapy, personalized medicine, antibiotic resistance treatment, and drug discovery all stand to benefit enormously from the kind of generative biology that the Arc Institute is pioneering.

The conversation is about governance keeping pace with capability.

Here is what analysts and policy commentators have pointed to as necessary next steps:

1. Extending regulations to cover in silico design

Current rules focus almost entirely on what happens in a physical laboratory. Governance frameworks need to address the computational design phase, not just the synthesis step. This likely requires international coordination, because computational research doesn’t respect national borders.

2. Expanding the definition of “entity of concern”

Right now, the term applies to known pathogens. Experts argue it needs to be broadened to include classes of biological capability — not just specific listed agents. An AI-designed virus that could infect humans would be dangerous whether or not it matches a pathogen already on a government list.

3. Mandatory screening for genome synthesis

Several companies already offer voluntary screening when customers order synthesized DNA sequences. Making such screening mandatory and standardized — especially for novel sequences generated by AI — is a concrete step that doesn’t require redesigning entire regulatory frameworks.

4. Transparency requirements for AI training data

Genome language models are trained on vast biological databases. Understanding what data goes into these models — and restricting access to sequences from the most dangerous known pathogens — is one lever that could reduce misuse risk at the source.

The Johns Hopkins commentary in Science made clear that this governance work is urgent, not theoretical. The capability already exists. The framework to manage it does not.

(Sources: Science commentary | NIH policy announcement)

—

The Bigger Picture for AI and Biology

The Arc Institute experiment is one data point in a much larger trend. AI models are becoming powerful tools in every part of the life sciences — from protein structure prediction (as demonstrated by AlphaFold) to drug molecule design, to now, functional viral genome creation.

This is not inherently bad. Scientists working on curing diseases want these tools. The same technology that could theoretically be misused is also the technology that could produce life-saving phage therapies, better vaccines, and treatments for diseases that still have no cure.

The challenge is that biology — unlike, say, software — has physical consequences. A badly designed piece of code crashes a program. A badly designed or maliciously designed biological agent could do something far worse. This means the standards we apply to AI systems operating in biological design spaces need to be proportionally higher than those we apply to other AI domains.

The fact that the current policy framework has a carve-out for purely computational work is not the result of negligence — it reflects how fast this capability has moved. Eighteen months ago, generating 16 novel functional viral genomes from scratch using an AI model would have been considered a stretch goal. Today it is a published result in Science.

The policy world is catching up. Whether it catches up fast enough is the real question.

(Sources: Science study | New York Times coverage)

—

FAQ: AI-Designed Viruses and Biosecurity

1. What exactly did the Arc Institute researchers create?

Researchers used a genome language model called Evo to generate novel bacteriophage genomes — viral genetic blueprints not found in nature. After generating roughly 700,000 candidates, they synthesized between 285 and 302 of them in the lab. Sixteen proved to be fully functional viruses capable of infecting and spreading through bacteria.

2. Are these AI-designed viruses dangerous to humans?

No. The viruses created in this experiment are bacteriophages, meaning they infect bacteria only. They cannot infect human cells. The reference virus the AI model was trained on — ΦX174 — is a well-studied, harmless phage. The experiment was intentionally designed to stay in this safe category.

3. What is Evo, and how does it work?

Evo is a genome language model built for biological sequences. It works similarly to how large language models like GPT work with text — but instead of words, it processes nucleotide sequences (the building blocks of DNA and RNA). Trained on approximately 9 trillion nucleotides and 2 million bacteriophage-related sequences, Evo learned the structural patterns of viral genomes and used that knowledge to design new ones.

4. Why does it matter that AI made these viruses rather than traditional lab methods?

Traditional virology uses viruses found in nature or modifies existing ones. This experiment demonstrated de novo (from scratch) viral genome creation using generative AI — with no direct natural template. It proves that AI can compose functional biological instructions, not just analyze existing ones. That is a meaningful capability jump.

5. What is the current U.S. government policy on AI-designed viruses?

The NIH released a policy in July 2026 to restrict high-risk life sciences research. However, the policy explicitly states that purely computational research — including using AI to design novel biological agents — is not prohibited unless it involves an “entity of concern” (a known dangerous pathogen). This leaves a regulatory gray zone for AI-designed genomes that are entirely novel.

6. What is an “entity of concern” in this policy context?

An “entity of concern” refers to known dangerous biological agents already on government watchlists — things like smallpox or anthrax. The problem raised by biosecurity experts is that a brand-new AI-designed pathogen wouldn’t appear on any list because it has never existed before. That means it might not trigger the restriction until it is physically created.

7. What do Johns Hopkins biosecurity experts say about this?

Professor Thomas V. Inglesby and Dr. Moritz S. Hanke from the Johns Hopkins Center for Health Security wrote a commentary in Science alongside the study. They acknowledged the legitimate scientific promise but warned clearly: “The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not.” Their commentary called the biosafety and biosecurity questions raised by this work urgent.

8. Could a bad actor use this technology to create a harmful pathogen?

This is the core concern, and the honest answer is: not easily, right now — but the barriers could shrink over time. The current process required hundreds of thousands of AI-generated candidates to produce 16 functional viruses. Creating a specific, targeted dangerous pathogen would require significantly more advanced tools, deep expertise, and substantial resources. However, as these models improve, the efficiency of genome design will increase, which is why governance needs to develop now rather than after those barriers fall.

9. What practical steps could reduce the biosecurity risk?

Experts point to several concrete measures: extending regulations to cover the computational design phase (not just physical lab work), broadening the definition of regulated pathogens to include capability classes rather than just listed agents, making DNA synthesis screening mandatory for AI-generated sequences, and requiring transparency in the training data used for genome language models.

10. What are the positive applications of AI-designed bacteriophage genomes?

The potential benefits are significant. Phage therapy — using viruses to fight antibiotic-resistant bacterial infections — is a growing medical field. AI-designed phages could be tailored to attack specific drug-resistant strains in ways natural phages cannot. More broadly, generative biology tools could accelerate drug discovery, improve vaccine development, and help scientists understand how viruses evolve and spread. The goal of the scientific community is to capture these benefits while building the governance structures to prevent misuse.

—

Sources used in this article:

Additional Links

Flowgrammer.ca – 💡 Unlock AI-Powered Automation! Let flowgrammer.ca handle complex workflows so you can focus on growing your business.

Flowgrammers.ca – 💡 Join Toronto’s Fastest Growing AI and Business Automation Community.

OpenClaw Toronto

Episode transcript

Read the full transcript

Craig: what if i told you that the next computer virus wasn't just code that crashes your laptop, but a biological entity that actually breathes, replicates, and spreads? scientists just get used a genome ai to build viruses from scratch, and the existing rule book has no idea how to handle it. the arc institute has achieved a massive milestone in generating biology using an ai called evo. they trained it on 9,000,000,000,000 nucleotides and asked it to create a new viral genomes. it succeeded 16 times producing functional bacteriophages, viruses that infect bacteria, not humans, from nothing. the breakthrough is real, and it promises to revolutionize phage therapy for antibiotic resistant infections. the problem, current biosecurity regulations only flag known pathogens. because these are new ai designed entities, they fall through a massive regulatory loophole. we have the capability to create life, but no governance to steer it at all. what do you think about this, john?

Jon: yeah. this scares the crap out of me, but, also really cool at the same time. so like you said, what's remarkable about this is that those 16 viruses, they're not just copies of existing viruses. they contain substantial genetic novelty while still performing the complicated biological tasks necessary for a virus to survive, assembling a viral particle, entering a host bacterium, replicating its genome, generating more particles, and infecting additional bacteria. so some perform competitively with or better than the natural phage used as the design template, which scares the crap out of me. so, yeah, they generated roughly 700,000 canon candidate genomes, computationally filtered them, selected about 300 for laboratory synthesis, and produced about 16 viable, viral phages. and so, this but the thing is that this wasn't chatjpt generating a virus from a text prompt. the models involved are genome language models. so, traditional language models learn statistical relationships among tokens representing words or pieces of words, whereas genome models, genome models, instead treat genetic sequences as their language. right? and we've covered this in the past, but the important information isn't contained simply in individual letters like adenosine, cysteine, guanine, and thymine. biological function emerges from an extremely complicated combination of sequences across genes. and so the evil models are designed to learn those relationships, which is what is unique about this and is crazy. i think this is cool but also scary. the regulatory bodies again, we've talked about regulatory bodies and trying to keep up with ai. now that they're designing their own brand new phages, viral phages, like, what's gonna happen? what do you think about this, craig?

Craig: so we've had a lot of rapid advancements in protein folding with alphafold and molecular design and stuff since 2023. and in july 2020 or july 28, this year, nih released new guidelines prohibiting the risk of biological research but leaving a purely computational loophole. so this definitely has to be closed. and i don't know what computational loophole really means. just because you can doesn't mean we created it, and it looks okay on the computer, but we can't actually go out and print it because then it's physical and that breaks the loophole. so i'm just trying to figure out, you know, where that border is. but, this is like a chef who has mastered every ingredient on earth. and instead of following a grandmother's recipe, which we would consider traditional science, the chef imagines a dish that has never existed, puts it in the oven, and miraculously, it tastes like a five star meal. so it captures this is interesting, and crazy. and, you know, for you, those people use ai. just imagine how being able to jump into, a prompt and be able to say, hey. research just as easy as you would say, research 10 competitors in my area and find out their offers and pricing, and it comes back with that. now you can do the same thing with genomes and bacteria and viruses. hey. create me a 100 new viruses that will wipe out all humans on earth. go. and i'll go get coffee, and i'll come back. yeah. this is the fear. right? like, let's just kinda put it on the surface that when the ai can do these things, then we need to start being aware of someone will do it. you know? i mean, there's always someone these types of things are not too far for, someone who's radicalized or is this or is that or, you know, an extreme scientist, whatever you wanna call it. yeah.

Jon: especially nowadays with it with, having access to jailbroken llms that you can run offline. it is so easy to just download and use one and install it. it's absolutely crazy, especially using walmart.cpp or olam or whatever. that's the scary part is that okay. sure. they have all these, security measures in place, but no. all there's so many open source models that people can download and mess around with and be nefarious. and so, like, imagine when we get these llm models that are able to do the point of what these guys are doing, at a larger scale, at a at a home brew kind of system. that scares the crap

Craig: out of me. yeah. and with regulatory gap, meaning there's no laws covering code for viruses or physical germs, meaning just you can't stop this code from getting out there and the stuff that it does because we've got no rules against it yet. so, it's scary, but we'll have to kinda wait and see what happens. but this goes back to our discussion that we end up on the different side of all the time is where does the government regulation happen and where shouldn't it happen? and i'm happy to have these discussions because, ideally, we get to a better, point, meaning, government just locked down missiles and fable or whatever and made them go through some process for a few weeks before they allowed it released, and they put some extra guardrails on there. same thing with chap tpt 5.6 and what the next version is. they're not quite the same process, but they have this new process where they have to go through. we don't know if they're testing for these biological agents. we don't know what they're testing for. i hope that they're testing for these things and if not, that now they are based on some of these stuff that come out. so although i'm not a huge fan of regulation, at some point, when you're getting to a situation of danger, hacking every software on the planet, creating biology that'll kill animals or do fix things or do whatever, there needs to be some oversight, what that is exactly and who makes it. that's a whole other discussion. but i think that oh, go ahead. go ahead. no. i think that's why there's conflict. it's like, i think we're breaking these lines all the time. and at a government level, we don't know what to be afraid of, so we're afraid of everything. and at a technology level, we have two sides saying we should pause everything. but at the same time, the people say or pause everything are moving at 10 x speed. so it's hard to, and if you pause, you're just gonna be left behind. so that'll never happen. and so we're keep moving forward, and we don't know how to control this, and we don't have governance, which leads to a lot of conflict and a lot of confusion. go ahead.

Jon: but it's software at the end of the day. like, the thing is that, no matter what, it can leak easily. so no matter how much government regulation comes in, is happening, like, we've already got very capable models already. people can build on top of those and, like, i think we're too late for government regulation when it comes to ai. i think we're too late.

Craig: i think you're partially right. yeah. and but i also think that it's not just regulation. it's monitoring. it's analysis control. if we test these kinds of things in the ai, we can test the responses. we can test words. we can test strings that we can now start searching on the internet from you know, the government has these big analysts. every, internet plug goes through the us government router pretty much everywhere, and they analyze all the packets. my point is we can start putting this stuff in to start detecting this and who's using it and whatnot. yeah. you're right. that it's starting to get out of the bag where people can grab a model, pull out the guard rules, pull out the information, and stick it into something and do some crazy stuff they shouldn't do with it. however, we need to start building the capabilities to say, alright. if there's dedicated models for these things, we want to stop them, whatever that means. detect them, their signatures when they're going online, whatever, at a firewall level, at a security level, at what have you. and, also, at the same time, we wanna detect people doing this weird stuff. there was an article i was seeing recently about how chatdtp and those other people are sending, you know, dangerous conversations to the authorities, whoever they happen to be. and we probably need more of that even though i hate it. but when everyone has a gun, people are gonna use it. mhmm. and so we can say it's too late, or we can do gun training, gun detection, put those shooting, not cameras up because that's debatable, but maybe those audio ones that can detect gunfire and, you know, pinpoint and get people out. we can do these things that, shrink the risk or minimize the impact or what have you of these things getting out in the wild. whether government or any of these tech companies actually do a good job of that is to be debated. but i think we are moving rapidly into territory that people just don't know how to handle. and that every day or every week, there's a new threat coming out from quantum or ai that has to be doubled. oh, we're we were hacking last week. now we got biologicals this week. next week, we got this. and, oh, every agent under the sun is hacking every other agent under the sun and getting out and doing these things. and i think it's freaking a lot of people out, so there's gonna be overreaction.

Jon: yep. there is. but i think we're too late. i honestly think we're too far down the rabbit hole, but, i could be wrong. maybe there's a way for, maybe there's this, blocks or red switch that they switch on and it kills all of the bottles and no one could use them anymore. i don't know. even the offline models, even air gap models, i don't know. no. i'm there's no way. but, yeah, back to this synthesizing of of the, of virus pages. this just, like, we've covered a lot of different, articles like this, and and this is just another one of those next steps. and i know, dario was saying, like, anthropic is really heavily focusing on stuff like this, bi biology and medical and drug development and all that sort of stuff. so things are just gonna ramp up and get even more crazy and scary.

Craig: well, they're all doing that. like, midjourney is turning into a medical company with scanning technology and whatnot. we talked about that a while ago where,

Jon: did we cover it? or

Craig: it was on our list. i don't know if we actually ended up talking about it or not. we did the research. we added up.

Jon: we should revisit it. yeah. because that was a good one. yeah.

Craig: but, basically, they're using air to do mri scanning images to find stuff faster and better. and so they're entering the medical field with medical software. all of them are doing something cool. and next thing you know, they'll be in another industry and another industry disrupting everything, and the government and regulators can't keep up. so the arc institute showed us that generative biology is here, and it works. while the promise of curing antibiotic resistant bacteria is huge, we've effectively opened a door that we don't have a key to lock it. as these models get faster and smarter, the policy will have to move twice as fast to keep up. as john says, we might be too late. i wanna know from you, if ai can design the cure, are you comfortable with it writing the virus to get there? let us know in the chat below. we'd love to hear what your thoughts are.

More from Silicon Scoop

All episodes