Johns Hopkins biosecurity director urges pre-release model evaluation and DNA synthesis screening after AI-designed bacteriophages work in the lab

Two distinct model classes are at issue. Biological design: Evo 1 and Evo 2, genome language models trained on roughly two million bacteriophage genomes, with eukaryote-infecting viruses excluded from training data (implicator.ai). General-purpose: Claude Opus 4 and Claude Sonnet 4.5 were the versions involved in the misuse attempts, with Anthropic saying newer models carry stronger biological safeguards (PBS). Inglesby notes the phage model was not trained on human data, but "there's no reason why others couldn't" (05:22).

The phage pipeline is a generate-and-screen funnel, not targeted design: ~700,000 candidates, 285 synthesised, 16 viable. That 5.6% yield is the key implementation number — wet-lab throughput, not model quality, is the binding constraint, and the work did not test larger or human-infecting viruses (implicator.ai). On evaluation, the Virology Capabilities Test offers a reproducible reference point: 322 multimodal troubleshooting questions built with 57 virologists, where o3 reached 43.8% against experts' 22.1% in their own subfields (arXiv).

• Novel functional viruses were AI-designed and overcame existing phage resistance — peer-reviewed in Science (GEN).
• Models exceed expert virologists on lab troubleshooting — independent benchmark with published methodology (arXiv).
• The transcript attributes two state programmes seeking help on chikungunya and H5N1, plus an orthopox antiviral-evasion query, to Anthropic (06:07). Reviewed reporting corroborates state-sponsored actors and gain-of-function planning across bird flu, chikungunya and toxins (Tom's Hardware), but the PBS account details only the chikungunya case. Anthropic alone can see the account data.

Anthropic characterised the blocked attempts as "well below the threshold where they could meaningfully assist" dangerous biology (PBS); the report divided biosecurity experts (Science). Luke Stark called the 10% figure science-fictional and suggested such warnings double as capability marketing (CBC). Cornell's John Thickstun objects that vendors are making "value judgments at societal scale" without democratic oversight. Inglesby concedes building something entirely from scratch "will remain quite a challenge," and warns defensive labs could themselves recreate dangerous outputs (09:49).

Inglesby's three asks map directly onto product and compliance roadmaps: tiered access controls for enhancement-relevant pathogen data, government-set pre-release evaluation replacing voluntary self-certification, and order-and-customer screening at nucleic acid suppliers — an industry he says largely supports it (12:55). Teams shipping bio-adjacent models should expect evaluation evidence to become a market-access requirement, not a goodwill gesture. The MI5 centre signals state-level capability assessment arriving independent of vendor disclosure (ITV News). Johns Hopkins has endorsed the federal framework approach (CHS).