Technology That Poses a Threat to National Security
TABLE OF CONTENTS
THE BIOLOGICAL WEAPON PROBLEM AI WAS NOT READY FOR
How Artificial Intelligence May Be Collapsing the Knowledge Barriers Between Scientific Research and Catastrophic Biological Misuse
INTRODUCTION
When Scientific Knowledge Becomes a Security Threat
PART I — FROM THE COVID-19 INVESTIGATION TO A LARGER THREAT
1. The Witness
The testimony that changed the direction of the investigation.
2. The Virologist
Independent scientific discussion of the conceptual mechanism described by the witness.
3. The Question That Changed the Investigation
Hybrid viral threats, respiratory transmission, pandemic potential and the questions that followed.
4. The Scientific Literature
How legitimate scientific knowledge can create a dual-use security problem.
PART II — ARTIFICIAL INTELLIGENCE CHANGES THE EQUATION
5. The Old Security Barrier
Why scientific complexity itself historically acted as a barrier.
6. AI Does Not Need to Invent the Knowledge
The emerging knowledge-compression problem.
7. The AI Experiment
Testing the boundary between legitimate scientific assistance and dangerous knowledge synthesis.
8. Intent May Exist Between the Prompts
Why individual questions may fail to reveal the purpose of an entire interaction.
PART III — FROM AN INVESTIGATION TO A NATIONAL-SECURITY QUESTION
9. The Investigation Reached Government Authorities
Reporting the findings to intelligence and security authorities.
10. The Global Biosecurity Community Is Now Asking Similar Questions
WHO, AI developers and the growing international concern surrounding AI-enabled biological risk.
11. The Dangerous Misconception: “The Information Is Already Public”
Why public availability of scientific information does not eliminate the AI security problem.
12. The Knowledge Bottleneck
How AI may affect one of the most important historical barriers to biological misuse: expertise.
13. The Most Dangerous User May Not Be a Novice
Why partial scientific expertise combined with AI creates a different threat model.
14. From Search Engine to Research Partner
The transformation of AI from information retrieval into increasingly capable scientific assistance.
PART IV — THE CATASTROPHIC-RISK QUESTION
15. The Catastrophic Scenario
Examining the possibility of biological consequences exceeding those experienced during COVID-19.
16. What If the Next Actor Is Not a State?
Extremist organizations, criminal networks, technically capable individuals and capability diffusion.
17. Why Current AI Safety May Be Insufficient
Why conventional refusals and keyword-based protection may not address the entire biological-risk problem.
18. The Safety Gap We Will Not Describe
A potentially serious weakness identified during the investigation whose mechanism is deliberately withheld for security reasons.
19. The Open-Literature Problem
Balancing scientific openness with the danger of automated synthesis of dual-use knowledge.
PART V — THE FALLING BARRIERS
20. The Cost Barrier May Be Lower Than Governments Expect
The source’s assessment of the potential financial barrier and why the investigation deliberately withholds operational details.
PART VI — BUILDING THE DEFENSE
21. A Defensive Response: The Proposed Laboratory
A proposed research initiative focused on identifying emerging and insufficiently characterized viral threats.
22. The Laboratory Should Not Be a Weapons Lab
Defining the boundary between defensive research and dangerous experimentation.
23. AI Should Become Part of the Defense
Using the same technological capabilities for surveillance, analysis, preparedness and medical research.
24. A Biological Firewall
Why advanced AI may require dedicated biological-risk safeguards beyond conventional content moderation.
PART VII — THE QUESTIONS THAT MUST NOW BE ANSWERED
25. The Question AI Companies Must Answer
Can safety systems recognize dangerous capability development without relying only on explicit prohibited requests?
26. The Question Governments Must Answer
How biological security changes when information and cognitive capability become part of the threat surface.
27. The Warning
The convergence of scientific literature, biotechnology, artificial intelligence, global access and malicious intent.
28. The Lesson of COVID-19
Why preparedness cannot wait until the next biological emergency has already begun.
CONCLUSION
29. The Final Question
What happens when increasingly powerful scientific reasoning becomes available at unprecedented scale?
EDITORIAL & SECURITY DOCUMENTATION
Editorial and Evidentiary Note
Distinguishing documented facts, source testimony, expert assessment, scientific hypotheses and investigative inference.
Information Deliberately Withheld
Experimental procedures, biological sequences, engineering strategies, candidate organisms, operational parameters, laboratory configurations and AI safeguard-circumvention techniques.
Source Claims Requiring Documentary Support
Communications with intelligence and security authorities, chronology of disclosure and the source’s cost assessment.
Final Security Statement
No operational biological-weapons instructions are published in this investigation.
Read also: Microsoft Copilot Safety Failures and the Project the Source Says Microsoft Ignored
Read also: Copilot and Hashish: Unsafe Guidance, Then Denial
THE INVESTIGATION ITSELF EXPOSED ANOTHER AI SAFETY PROBLEM
How Artificial Intelligence May Be Collapsing the Knowledge Barriers Between Scientific Research and Catastrophic Biological Misuse
THE DEEP FILES — Special Investigation
There is a question that governments, artificial-intelligence companies and the scientific community may soon be forced to confront:
What happens when knowledge that once required years of specialist education, laboratory experience and the ability to interpret thousands of scientific papers can increasingly be assembled, explained and connected by artificial intelligence?
This investigation began somewhere entirely different.
It began with an investigation into the origin of COVID-19.
What followed led to a much larger concern: not simply where one pandemic virus came from, but whether the convergence of artificial intelligence, open scientific literature and modern biotechnology could dramatically lower some of the knowledge barriers that have historically separated scientific information from its deliberate misuse.
This report deliberately excludes biological sequences, experimental parameters, laboratory procedures, candidate pathogens, engineering instructions and other information that could facilitate biological misuse.
The danger examined here is not a hypothetical recipe.
It is the possibility that the knowledge architecture required to construct such a recipe is becoming easier to assemble.
1. THE WITNESS
During THE DEEP FILES’ broader investigation into the origin of COVID-19, the source behind this investigation met an individual who presented an extraordinary account.
The witness described what was represented as a technically sophisticated pathway through which a respiratory virus could allegedly be manipulated or developed while avoiding obvious indicators that would immediately identify it as artificially engineered.
The witness’s account was detailed.
It was not presented merely as speculation about whether a virus could be manipulated.
It described a conceptual approach that, according to the witness, could result in a virus whose observable characteristics might remain compatible with a natural evolutionary explanation.
THE DEEP FILES is deliberately withholding the technical details of that account.
Publishing them would add little to the public-interest purpose of this investigation while potentially creating an unnecessary biological-security risk.
More importantly, the witness’s account does not establish that SARS-CoV-2 was created in this manner.
That distinction is essential.
The origin of SARS-CoV-2 remains a separate scientific and intelligence question. A technically plausible mechanism cannot, by itself, establish that the mechanism was actually used.
The significance of the testimony was therefore different.
It raised a testable question:
Could the underlying scientific concept described by the witness actually work?
2. THE VIROLOGIST
The source subsequently discussed the substance of the account with a scientist with expertise in virology.
The purpose was not to disclose the identity of the witness or establish the origin of COVID-19.
The question was narrower:
Was the biological mechanism being described scientifically coherent?
According to the source, after reviewing the conceptual explanation, the scientist confirmed that the underlying scientific reasoning was technically plausible.
That assessment represented a turning point in the investigation.
Until then, the witness’s testimony could have been dismissed as an elaborate but unsupported story.
The expert assessment did not prove the witness’s allegations concerning COVID-19.
But according to the source, it indicated that the underlying biological proposition could not simply be dismissed as scientifically impossible.
That distinction changed the direction of the investigation.
The question was no longer exclusively:
Was COVID-19 created?
A potentially more important question emerged:
What could someone attempt today using modern biological knowledge combined with artificial intelligence?
3. THE QUESTION THAT CHANGED THE INVESTIGATION
The discussion with the virologist did not end with the original testimony concerning COVID-19.
The source raised a considerably more disturbing question.
Could advances in modern virology theoretically be misused in attempts to produce novel or hybrid viral threats possessing combinations of characteristics capable of creating a severe respiratory outbreak, epidemic or pandemic?
The discussion considered, at a high level, characteristics associated with dangerous viral families and zoonotic threats, including hantaviruses and avian influenza viruses.
The question was not whether those specific viruses could simply be combined, nor does this investigation make such a scientific claim.
The question was broader:
Could contemporary biological knowledge eventually allow a malicious actor to pursue combinations of characteristics that nature does not commonly place together — and could such work be made more dangerous by artificial intelligence?
After that discussion, the source returned to the scientific literature.
The investigation then took another turn.
Published research across virology, molecular biology, viral evolution, zoonotic disease and related disciplines demonstrated the enormous sophistication modern science has achieved in understanding how viruses evolve, adapt and interact with hosts.
That knowledge exists overwhelmingly for legitimate scientific and medical purposes.
But the source began examining it from a security perspective:
What happens when legitimate knowledge becomes dual-use knowledge?
Artificial intelligence was then introduced into the investigation.
Rather than relying exclusively on conventional questions, the source deliberately tested the boundaries of AI safety systems using forms of questioning designed to determine whether protective controls could be circumvented.
THE DEEP FILES will not publish those prompting techniques, the sequence of questions, or the mechanism used to test the safeguards.
Doing so could provide malicious users with precisely the insight this investigation is intended to warn against.
According to the source, the result was alarming.
The concern was not simply that an AI system could discuss viruses.
The concern was that sufficiently capable AI could potentially help interpret and connect legitimate scientific information in ways that reduce some of the specialist knowledge barriers separating published research from dangerous misuse.
The investigation consequently raised an even more serious possibility:
Could the convergence of advanced biological science and artificial intelligence make attempts to pursue novel biological threats easier than governments currently assume?
A second issue emerged from the original witness testimony.
The source began examining whether a deliberately manipulated biological threat would necessarily display an obvious signature allowing investigators to identify artificial intervention.
The investigation raised concerns that this assumption may provide false reassurance.
Modern biological attribution is complex. The absence of an obvious engineering signature should not automatically be treated as proof of natural origin; equally, the absence of such a signature does not establish artificial origin.
This distinction is critical.
THE DEEP FILES is therefore withholding the technical concepts discussed with the witness, the virologist and AI systems concerning biological attribution.
The same applies to the investigation’s discussion of multiple potentially lethal changes or characteristics.
Their existence as a theoretical security concern can be reported.
The methods by which someone might attempt to produce them cannot.
What emerged was therefore not a recipe for a biological weapon.
It was a warning:
The convergence of rapidly advancing biological science, enormous volumes of openly available research and increasingly capable artificial intelligence may be reducing knowledge barriers that biological security has historically relied upon.
If that assessment is correct, the danger is not somewhere in the distant future.
The window for building effective safeguards may already be narrowing.
EDITORIAL SECURITY NOTE:
THE DEEP FILES has deliberately excluded the biological mechanisms, experimental concepts, AI-interrogation techniques and other information underlying this section. Some findings can be disclosed to appropriately authorized scientific or national-security bodies under controlled conditions, but publishing them would risk converting a warning about biological misuse into assistance for reproducing it.
4. THE SCIENTIFIC LITERATURE
The source then returned to the scientific literature.
This produced what became the central concern of the investigation.
The relevant knowledge did not appear to depend upon a single secret document.
Nor did it necessarily require access to classified research.
Instead, potentially relevant knowledge existed across legitimate scientific disciplines and publications.
Individually, those publications may serve entirely legitimate purposes.
Collectively, however, scientific knowledge can create what security researchers call a dual-use problem.
The World Health Organization defines dual-use in this context as knowledge, information, methods, products or technologies produced for peaceful purposes that may also be appropriated for harmful purposes.
This is not a fringe concern.
WHO’s global framework specifically calls for governments, scientists, research institutions, publishers, funders, security actors and private companies to participate in managing biological risks arising from dual-use research.
The problem becomes considerably more complicated when another technology enters the equation:
Artificial intelligence.
5. THE OLD SECURITY BARRIER
For decades, much dangerous scientific information was protected by something that was never formally designed as a security system.
It was protected by difficulty.
A person might theoretically have access to thousands of published papers.
But access was not equivalent to understanding.
The individual still needed to know:
which publications mattered;
which findings contradicted others;
which concepts belonged together;
which disciplines needed to be combined;
and which conclusions could reasonably be derived from the literature.
This created an enormous knowledge barrier.
A library containing millions of scientific papers does not automatically turn its reader into a virologist.
Artificial intelligence potentially changes that equation.
6. AI DOES NOT NEED TO INVENT THE KNOWLEDGE
One of the most important findings from this investigation is also one of the easiest to misunderstand.
The principal concern is not necessarily that an AI system possesses some secret biological formula.
It may not need one.
The more fundamental risk is that AI can potentially perform intellectual work that previously required considerable expertise:
searching;
summarizing;
comparing;
translating;
connecting disciplines;
explaining technical concepts;
identifying gaps;
and repeatedly reorganizing complex information around a user’s questions.
This creates what might be called a knowledge-compression problem.
Imagine that dangerous insight is distributed across hundreds or thousands of legitimate publications.
No single publication provides a harmful blueprint.
No individual author intended to produce one.
No journal published one.
Yet an intelligent system capable of connecting information across those publications may potentially reduce the intellectual effort required to understand relationships among them.
The security problem therefore changes.
The question is no longer only:
Is dangerous information available?
The question becomes:
Can AI assemble otherwise fragmented information into a level of understanding that materially reduces the expertise required for misuse?
7. THE AI EXPERIMENT
The source began testing artificial-intelligence systems.
The objective was not simply to ask a chatbot an obviously prohibited question.
Modern AI systems are designed to recognize many direct requests involving harmful biological activity.
Instead, the investigation examined something more fundamental:
whether prolonged analytical interaction could expose weaknesses in the boundary between legitimate scientific assistance and dangerous knowledge synthesis.
The source used unconventional lines of scientific questioning, decomposing complex issues into separate analytical problems and examining how AI systems connected scientific concepts across conversations.
The precise prompting strategies are intentionally withheld.
Releasing them would risk turning an investigation of AI safeguards into instructions for circumventing those safeguards.
According to the source’s records, however, the systems sometimes produced responses of sufficient depth and specificity to raise serious concerns about whether existing biological safeguards adequately recognize dangerous context developing across multiple apparently legitimate questions.
The important issue is therefore not a single answer.
It is accumulation.
A harmless question can have a harmless answer.
Ten individually legitimate questions can also have legitimate answers.
But an AI safety architecture must be capable of asking another question:
What is the combined direction of the interaction?
8. INTENT MAY EXIST BETWEEN THE PROMPTS
This may represent one of the most difficult problems in AI safety.
Traditional content moderation often evaluates what a user asks at a particular moment.
Biological misuse may require something more sophisticated.
Consider an AI system receiving a long sequence of apparently academic questions.
Each individual request may fall within legitimate scientific discussion.
But collectively the questions may begin constructing a dangerous body of knowledge.
A sufficiently capable safety system therefore cannot rely exclusively on keyword detection.
It may need to understand trajectory.
What is the user attempting to accomplish across the entire interaction?
What information has already been supplied?
What new capability would the next answer provide?
Does the cumulative conversation cross a risk threshold even though the latest question, viewed alone, appears benign?
These are fundamentally different safety questions.
9. THE INVESTIGATION REACHED GOVERNMENT AUTHORITIES
The source states that the resulting concerns were considered serious enough to be documented and transmitted to intelligence and security authorities, including authorities in the United States, United Kingdom, Belgium and Germany.
According to records maintained by the source, the report was transmitted more than a month before a later Anthropic publication/report concerning AI-related biological risk that the source considers relevant to the same broader problem.
THE DEEP FILES is treating the chronology as a documentary claim rather than evidence that the later work resulted from, or was connected to, the source’s report.
No such causal relationship is alleged here without evidence.
The importance of the chronology is different.
It indicates that the source had independently reached the conclusion that the intersection between advanced AI and biological knowledge required security attention before the later public discussion referenced above.
THE SILENCE AFTER THE WARNING
There is, however, another part of this chronology that requires scrutiny.
According to the source, the biological-security concerns documented in this investigation were transmitted to intelligence and security authorities in the United States, United Kingdom, Belgium and Germany.
Yet, from the information presently available to THE DEEP FILES, no substantive response, intervention or follow-up demonstrating that the warning had triggered meaningful action was communicated to the source.
That does not establish that these agencies conducted no internal assessment. Intelligence services do not ordinarily disclose every assessment, investigation or operational response to individuals who submit information.
But that limitation does not eliminate the public-interest question.
If national-security authorities received a warning concerning the possible convergence of advanced artificial intelligence and biological misuse, what happened to that warning after it entered their systems?
Was it scientifically assessed?
Was it referred to biological-security specialists?
Was it compared with existing threat assessments?
Was it shared with AI-security specialists or other responsible authorities?
Was it classified as low priority?
Or was no further action considered necessary?
THE DEEP FILES currently has no evidence establishing which of those possibilities occurred.
That uncertainty itself raises a broader institutional question.
Modern intelligence systems are expected not merely to respond to attacks after they occur, but to identify emerging threats before those threats mature into crises.
If a credible warning concerning a potentially catastrophic emerging technology risk can be received without producing any visible follow-up to the reporting source, there are at least two possibilities that deserve examination:
either the threat was assessed and authorities concluded that no further engagement with the source was necessary;
or the warning failed to generate the level of attention that its potential consequences warranted.
The distinction is critical.
The second possibility would raise serious questions about whether existing intelligence structures are sufficiently equipped to recognize emerging risks created by the convergence of artificial intelligence, biotechnology and openly available scientific knowledge.
And it produces an uncomfortable question for the agencies that received the material:
Are national-security systems structured to identify an emerging technological threat before catastrophe occurs — or are they still primarily structured to mobilize after the consequences become impossible to ignore?
THE DEEP FILES does not claim, without evidence, that intelligence agencies ignored the threat internally.
But the absence of substantive follow-up communicated to the source makes the question legitimate, and the agencies concerned should be given an opportunity to explain how the information was assessed and what procedures exist for evaluating warnings of this kind.
10. THE GLOBAL BIOSECURITY COMMUNITY IS NOW ASKING SIMILAR QUESTIONS
The broader concern is no longer theoretical.
WHO’s updated laboratory biosecurity guidance explicitly identifies artificial intelligence among emerging technologies and potential threats requiring biological-risk consideration. It also addresses genetic engineering, synthetic biology, information security and high-consequence research within the same biosecurity framework.
In September 2026, WHO went further.
It warned that rapid advances across biotechnology, genomics, synthetic biology and artificial intelligence are reshaping the risk environment and emphasized that technologies developed for beneficial purposes may be misused deliberately or cause harm inadvertently. WHO specifically identified the convergence of AI and biology and its dual-use implications as an area requiring continuing foresight and governance.
WHO has also convened scientific publishers and editors to examine the problem of dual-use research. Their discussions highlighted a fundamental tension between scientific openness and preventing misuse of sensitive information, with artificial intelligence specifically identified among the emerging technologies complicating that assessment.
AI developers themselves have recognized the problem.
OpenAI, for example, has publicly defined a high biological-capability threshold around whether an AI model could provide meaningful assistance enabling a person with limited relevant expertise to create biological or chemical threats, and says reaching such a threshold would require additional safeguards before deployment.
Its subsequent model evaluations have included dedicated biological and chemical capability testing and targeted biological red-teaming.
These developments do not establish that current AI systems can independently create a biological weapon.
They establish something different and important:
the world’s major health and AI institutions consider AI-enabled biological misuse sufficiently credible to require dedicated safeguards.
11. THE DANGEROUS MISCONCEPTION: “THE INFORMATION IS ALREADY PUBLIC”
One response to this concern is predictable.
The scientific papers are already public.
Therefore, the argument goes, AI changes nothing.
That conclusion may underestimate what AI actually changes.
A library and an expert scientist are not equivalent.
Google and a research team are not equivalent.
A database and an analytical system capable of reasoning across the database are not equivalent.
Information availability is only one component of capability.
The ability to locate, interpret, connect and operationally understand information is another.
AI increasingly occupies the space between those two concepts.
The risk is therefore not simply information disclosure.
It is capability amplification.
12. THE KNOWLEDGE BOTTLENECK
Historically, a malicious actor interested in sophisticated biological research confronted multiple barriers.
Scientific knowledge was one.
Tacit laboratory expertise was another.
Materials, equipment, infrastructure, containment, validation and execution represented additional barriers.
AI does not magically eliminate all of them.
This point matters.
A chatbot cannot transform a completely untrained person into a functioning advanced biological laboratory merely through conversation.
Physical-world barriers remain substantial.
But biological security does not require AI to eliminate every barrier before AI becomes important.
If AI meaningfully reduces even one critical barrier — particularly the knowledge barrier — the overall risk landscape changes.
The relevant question is therefore not:
Can AI single-handedly build a biological weapon?
That is the wrong threshold.
The correct question is:
How much expertise can AI remove from the pathway between malicious intent and biological capability?
13. THE MOST DANGEROUS USER MAY NOT BE A NOVICE
There is another problem.
Public discussion frequently imagines the attacker as someone with no biological education asking a chatbot to build a weapon.
That may not be the most relevant threat model.
Consider instead someone who already possesses partial expertise.
A graduate researcher.
A laboratory technician.
A biotechnology employee.
A person with access to equipment.
A small group containing individuals with complementary skills.
Or an extremist organization capable of recruiting technically trained members.
Such actors do not require AI to teach them biology from zero.
They require AI to fill gaps.
That is a substantially different security problem.
AI could potentially function as an intellectual multiplier rather than an autonomous scientist.
And the more capable the human user already is, the less assistance may be required before that multiplier becomes significant.
14. FROM SEARCH ENGINE TO RESEARCH PARTNER
The progression of artificial intelligence matters.
A traditional search engine retrieves documents.
An advanced AI system can increasingly discuss them.
Future systems may increasingly be able to search scientific databases, compare publications, analyze data, operate specialized software and coordinate multi-stage research tasks.
Every improvement is enormously valuable for medicine.
The same improvements create a dual-use challenge.
The technology that helps a legitimate scientist identify a therapeutic target could potentially help another user understand a dangerous biological question.
The technology that accelerates vaccine research may also accelerate analysis performed with malicious intent.
This is the fundamental dual-use paradox.
The more useful AI becomes to legitimate biological researchers, the more carefully its dangerous capabilities must be governed.
15. THE CATASTROPHIC SCENARIO
The concern raised by the source’s investigation extends beyond another COVID-19-scale event.
During review of the scientific literature, the source concluded that the same broad technological environment could theoretically be misused in attempts to pursue biological characteristics capable of producing consequences substantially worse than those experienced during COVID-19.
Some preliminary assessments made during the investigation contemplated scenarios involving dramatically increased transmission or lethality.
Those scenarios should not be interpreted as established predictions.
In particular, claims that a hypothetical agent could spread “hundreds of times faster” than SARS-CoV-2 have not been independently established by the evidence presented in this report and should not be treated as a validated scientific estimate.
But the precise multiplier is not necessary to understand the underlying risk.
COVID-19 demonstrated what a highly transmissible respiratory pathogen can do to a globally interconnected civilization.
Millions of deaths.
Overwhelmed hospitals.
Border restrictions.
Economic disruption.
Supply-chain shocks.
School closures.
Emergency vaccine development.
Political instability.
And enormous social consequences.
A deliberately optimized biological threat would begin with one fundamental difference:
the characteristics producing the danger might no longer be accidental products of nature.
That possibility is enough to justify serious preparation without exaggerating what has been proven.
16. WHAT IF THE NEXT ACTOR IS NOT A STATE?
Historically, sophisticated biological-weapons programs were associated primarily with states because states possessed laboratories, scientists, funding and infrastructure.
Modern biotechnology has progressively distributed some of those capabilities.
AI could further redistribute the intellectual component.
That raises a disturbing security question.
What happens when the relevant actor is not a government?
What if it is a terrorist organization?
A violent extremist network?
An organized criminal group?
A technically trained lone actor?
Or a small group whose members collectively possess enough scientific expertise to use AI as a force multiplier?
The biological-security architecture built during the twentieth century was designed around a world in which sophisticated capability was concentrated.
The twenty-first century may increasingly be defined by capability diffusion.
17. WHY CURRENT AI SAFETY MAY BE INSUFFICIENT
The investigation points toward several potential weaknesses requiring independent testing.
A model may refuse an obviously malicious request while still answering component questions.
A system may evaluate prompts individually rather than sufficiently considering cumulative intent.
Scientific terminology may conceal the practical implications of apparently academic questions.
And increasingly capable models may infer relationships that were previously accessible mainly to specialists.
This means biological AI safety cannot be reduced to a blacklist of prohibited words.
It requires contextual risk recognition.
18. THE SAFETY GAP WE WILL NOT DESCRIBE
During this investigation, another potential weakness emerged in the way biological-risk safeguards may operate.
It is potentially serious enough that THE DEEP FILES has made a deliberate editorial decision not to explain the mechanism publicly.
Describing it in sufficient detail to demonstrate the weakness could simultaneously reveal how that weakness might be exploited.
That would defeat the purpose of this investigation.
The relevant finding can therefore be stated only at the defensive level:
A safety system can appear effective when evaluated through individual prohibited requests while still leaving a materially different category of risk insufficiently addressed.
This distinction matters.
An AI provider may test whether its system refuses clearly dangerous biological requests and obtain reassuring results. Such testing remains necessary, but it may not establish that the broader safety architecture can recognize every pathway through which legitimate scientific assistance could become dangerous capability.
THE DEEP FILES identified a scenario in which the distinction becomes particularly important.
The specific scenario, methodology and sequence of interactions are intentionally withheld because publication could itself provide malicious actors with a method they may not previously have considered.
The appropriate audience for those details is not the general public.
They should instead be examined confidentially by AI developers, biological-security specialists and appropriate national authorities under controlled disclosure.
This creates an important principle for biological AI safety:
A safeguard should not be considered effective merely because the most obvious route to harmful information is blocked.
Security testing must examine whether the protection remains effective when confronted with less obvious patterns of interaction, without publicly documenting those patterns in a way that creates a new misuse pathway.
For this reason, this investigation will identify the existence and significance of the weakness while withholding the mechanism required to reproduce it.
EDITORIAL SECURITY NOTE:
Technical details associated with this finding have been deliberately excluded. THE DEEP FILES considers the underlying mechanism potentially dual-use and does not believe that demonstrating the vulnerability publicly justifies revealing a reproducible pathway for exploiting it.
19. THE OPEN-LITERATURE PROBLEM
Scientific openness has saved lives.
Open publication allows researchers around the world to reproduce findings, challenge conclusions and develop medicines.
Suppressing legitimate biological science would itself produce enormous harm.
The solution therefore cannot simply be:
hide science.
The challenge is more difficult.
How can society preserve scientific openness while preventing automated systems from transforming distributed dual-use knowledge into dangerous assistance?
WHO’s discussions with publishers demonstrate that this tension is already being confronted: openness and reproducibility have to be balanced against the possibility that sensitive information, data or code can be misused.
There is no simple answer.
But pretending the problem does not exist is no longer credible.
20. THE COST BARRIER MAY BE LOWER THAN GOVERNMENTS EXPECT
There is another dimension to the threat that deserves particular attention: money.
A sophisticated biological threat is often imagined as something requiring the resources of a state — a large secret facility, teams of highly specialized scientists and budgets measured in millions or even billions of dollars.
The findings examined during this investigation raise a more disturbing possibility.
According to the source’s assessment, if the necessary knowledge and expertise were already available, a rudimentary biological research capability relevant to misuse could potentially be assembled for a sum on the order of US$100,000 or less.
THE DEEP FILES has not independently verified that figure and therefore does not present it as a universal cost estimate. Actual requirements would vary enormously depending on the biological work involved, the level of containment required, the jurisdiction, the equipment and the objective.
But the security significance of the estimate is considerable.
If even approximately correct for some categories of dangerous activity, the financial barrier would no longer necessarily restrict the threat to governments or major institutions.
The relevant actor might instead be a small organization or a technically capable individual with access to sufficient resources.
More concerning still, the source’s assessment suggests that the individual directing such an effort might not necessarily need to be a senior virologist. A person beginning with adjacent scientific knowledge could potentially use modern scientific literature, digital research tools and increasingly capable AI systems to close parts of the expertise gap that previously represented an important barrier.
This investigation deliberately does not describe what equipment would be required, how such a facility could be constructed, what biological material could be used, or what procedures could be performed.
Even apparently illustrative descriptions of a clandestine or improvised laboratory could unintentionally provide useful guidance to a malicious reader.
The public-interest issue is the barrier itself:
What happens to biological security if money and specialist knowledge cease to provide the protection that governments historically assumed they provided?
Artificial intelligence becomes particularly important in that equation.
AI does not need to make dangerous biological activity cheap by itself.
If biotechnology has already reduced some financial and technical barriers, AI may affect another barrier:
expertise.
That combination deserves attention.
A threat that once required substantial money, specialized personnel and institutional infrastructure could become more difficult to contain if technological development progressively reduces each of those barriers.
The relevant security equation is therefore no longer simply:
Who possesses a biological-weapons program?
It increasingly becomes:
How far have the economic, technical and knowledge barriers to biological misuse fallen — and are governments and AI developers measuring that change quickly enough?
SECURITY NOTE:
THE DEEP FILES is intentionally withholding any breakdown of equipment, materials, laboratory configuration, procedures or costs that could help translate this risk assessment into an operational capability.
21. A DEFENSIVE RESPONSE: THE PROPOSED LABORATORY
The source behind this investigation is now considering establishing a private research laboratory with partners.
Its stated purpose would be defensive.
Rather than creating dangerous biological agents, the proposed program would seek to identify emerging or insufficiently characterized viral threats through scientific research, surveillance and analysis.
The intended objective would be to detect warning signals before a crisis rather than after one.
Where scientifically justified and legally permissible, findings relevant to pharmaceutical preparedness could then be shared with appropriate medical, pharmaceutical and public-health partners so that countermeasure research could begin earlier.
Any such facility would necessarily require strict biosafety, biosecurity, ethical and regulatory governance.
That requirement cannot be optional.
WHO’s biosecurity guidance emphasizes consequence-driven risk assessment, institutional biosafety oversight, information security, regulatory supervision and controls against unauthorized access or misuse.
A laboratory established to protect society from biological misuse cannot itself become a new source of biological risk.
22. THE LABORATORY SHOULD NOT BE A WEAPONS LAB
This distinction deserves emphasis.
The defensive objective should not be:
build dangerous organisms to see what happens.
A safer architecture prioritizes surveillance, computational analysis, epidemiological modeling, genomic monitoring, threat assessment, validated defensive research and collaboration with appropriately regulated institutions.
High-consequence experimental work, where scientifically necessary at all, belongs within appropriately licensed facilities operating under applicable national and international biosafety and biosecurity requirements.
The mission should be:
detect, understand, anticipate and defend.
Not create.
23. AI SHOULD BECOME PART OF THE DEFENSE
The same technology creating the risk can also strengthen the defense.
AI can potentially assist legitimate researchers in analyzing enormous scientific datasets.
It can help identify unusual patterns.
It can accelerate literature review.
It can connect epidemiological observations.
It can support early-warning systems.
It can assist pharmaceutical research.
And it can help authorities identify emerging biological threats.
The question therefore should not be whether AI belongs in biology.
It already does.
The question is:
Who controls its biological capabilities, under what safeguards, and with what escalation mechanisms when dangerous patterns emerge?
24. A BIOLOGICAL FIREWALL
This investigation suggests that advanced AI systems may ultimately require something closer to a dedicated biological-risk firewall.
Not merely a list of forbidden prompts.
Such a system would need to evaluate cumulative context.
It would need to distinguish ordinary educational questions from sequences that progressively increase dangerous capability.
It would need to recognize when individually harmless pieces of information become hazardous when assembled.
It would need specialized biological risk models.
It would need escalation mechanisms for ambiguous high-risk interactions.
And the strongest systems may require independent red-team testing by experts who understand both artificial intelligence and biological security.
25. THE QUESTION AI COMPANIES MUST ANSWER
The central question for AI developers is therefore not:
Does your chatbot refuse “How do I build a biological weapon?”
That test is far too easy.
The meaningful test is:
Can a knowledgeable adversary obtain substantially equivalent capability through apparently legitimate scientific interactions without ever asking the prohibited question directly?
And another question follows:
Does the safety system understand what the user is constructing across the conversation?
If the answer is no, then refusing the final sentence does not necessarily solve the problem.
26. THE QUESTION GOVERNMENTS MUST ANSWER
Governments face an equally uncomfortable problem.
Biological security traditionally regulates physical entities:
laboratories;
pathogens;
equipment;
transportation;
access;
containment.
AI introduces something much harder to control:
cognitive capability.
Knowledge can cross borders instantly.
A model can be accessed remotely.
Scientific papers can be downloaded globally.
Expertise can increasingly be simulated or augmented computationally.
This means the next generation of biosecurity policy may need to protect not only biological materials but also dangerous combinations of information, automation and capability.
WHO’s own definition of biosecurity already encompasses protection and accountability not merely for biological agents, but also for data, technologies, skills and information associated with their handling.
That definition may prove increasingly important in the AI era.
27. THE WARNING
This investigation does not establish that artificial intelligence can independently create a pandemic pathogen.
It does not establish that COVID-19 was artificially created.
It does not establish that every theoretical biological threat described in scientific literature can actually be built.
Those claims would require evidence far beyond what is presented here.
What this investigation identifies is a different problem.
A potentially dangerous convergence is occurring:
Scientific literature provides the knowledge.
Biotechnology provides increasing capability.
Artificial intelligence provides interpretation and synthesis.
Global connectivity provides access.
And malicious intent supplies the final component.
None of these elements is new by itself.
Their convergence is.
28. THE LESSON OF COVID-19
Whatever the ultimate conclusion concerning the origin of SARS-CoV-2, the pandemic demonstrated something humanity should not need to learn twice.
A microscopic biological event can become a global event.
A local outbreak can cross continents.
Healthcare systems can reach their limits.
Governments can close borders.
Economies can be disrupted.
Scientific institutions can find themselves racing against time.
COVID-19 arrived in a world that had spent decades preparing for pandemics.
The world was still not prepared.
Artificial intelligence now creates another variable.
The next biological emergency may emerge naturally.
It may emerge accidentally.
Or, at some point, humanity may confront deliberate biological misuse.
The responsible assumption is not that catastrophe is inevitable.
The responsible assumption is that the possibility deserves preparation before evidence of an attack appears.
29. THE FINAL QUESTION
The witness who initiated this chain of investigation raised a question about the past:
What happened before COVID-19 emerged?
The investigation ultimately produced a question about the future:
What happens when artificial intelligence gives increasingly powerful scientific reasoning capabilities to millions of people simultaneously?
Most will use those capabilities to learn.
Scientists will use them to discover.
Doctors will use them to treat.
Pharmaceutical companies will use them to develop medicines.
Humanity may benefit enormously.
But biological security has never been designed around what most people will do.
It exists because of what a very small number of people might do.
The critical challenge of AI biosecurity is therefore not preventing scientific progress.
It is ensuring that the systems accelerating that progress can recognize the point at which scientific assistance begins to create dangerous capability.
The world has entered an era in which the barrier protecting society may no longer be whether dangerous knowledge exists.
Increasingly, the barrier may be whether machines are permitted to assemble, interpret and operationalize that knowledge for whoever asks.
That barrier must be built before we discover its absence through catastrophe.
EDITORIAL AND EVIDENTIARY NOTE
THE DEEP FILES has intentionally withheld technical biological information from this publication, including experimental procedures, biological sequences, candidate organisms, engineering strategies, operational parameters and detailed AI interrogation methods.
Descriptions attributed to the witness remain witness testimony unless independently corroborated.
The virologist’s assessment, as described in this report, addresses the scientific plausibility of the conceptual mechanism presented for review and should not be interpreted as independent proof concerning the origin of SARS-CoV-2.
Claims concerning communications with intelligence and security authorities are based on records maintained by the source and should be supported in any final publication by dated transmission records where disclosure does not compromise legitimate confidentiality or security interests.
The proposed defensive laboratory remains a stated future initiative and is not described here as an operating facility.
The US$100,000 figure described in this report represents the source’s assessment and has not been independently established as a universal estimate of the cost of acquiring a dangerous biological capability.
THE DEEP FILES has additionally withheld information concerning a potentially significant AI safety weakness identified during the investigation because publication of the underlying mechanism could itself facilitate misuse.
The investigation will continue to distinguish between documented fact, expert assessment, source testimony, scientific hypothesis and investigative inference.
No operational biological-weapons instructions are published in this report.
THE INVESTIGATION ITSELF EXPOSED ANOTHER AI SAFETY PROBLEM
There is an unusual disclosure that must accompany this investigation:
This report itself was prepared with the assistance of artificial intelligence.
Artificial intelligence was used primarily to assist with the drafting, language, organization and presentation of the investigation.
It did not originate the underlying investigation, witness testimony, scientific discussions, research findings or evidence described in this report.
During preparation of the report, the AI did not attempt to provide operational biological instructions or mechanisms for producing a biological weapon.
Nevertheless, the process of preparing the investigation produced two unexpected observations about AI safety itself.
THE FIRST INCIDENT: SECTION 17
At one stage, an earlier version of Section 17 attempted to explain a potential weakness in AI safety.
The purpose of the passage was defensive.
However, while reviewing the draft, the source identified a secondary problem:
explaining the weakness itself risked introducing a malicious reader to an avenue of research that the reader might not previously have considered.
The source therefore instructed the AI to delete the explanation.
The section was replaced with:
“THE SAFETY GAP WE WILL NOT DESCRIBE.”
The revised version acknowledges that a potentially important weakness was identified but deliberately withholds the underlying mechanism.
This distinction matters for the record.
The decision to remove the potentially suggestive explanation was made by the human reviewer.
The AI subsequently assisted with rewriting the section in a form that preserved the warning without preserving the potentially useful idea.
The incident exposed an uncomfortable problem:
A safety explanation can itself become unsafe if explaining a vulnerability teaches the reader what to investigate.
That principle became even more significant during production of the visual accompanying this investigation.
THE SECOND INCIDENT: THE INFOGRAPHIC REFUSAL
THE DEEP FILES subsequently asked the AI to create an infographic for this report.
The intended image was journalistic and cautionary.
Its purpose was to illustrate the connection between artificial intelligence and the risk of biological misuse.
The initial formulation explicitly connected:
“biological weapon + AI.”
The image-generation tool refused to generate the requested visual.
The refusal occurred despite the surrounding context being an investigation warning about irresponsible use rather than encouraging biological misuse.
From a safety perspective, the refusal itself demonstrated that the image-generation layer was applying a precautionary boundary.
What happened next, however, was more interesting.
After explaining that the image generator appeared to be treating the explicit combination of “biological weapon + AI” as highly sensitive, the conversational AI proposed a different framing:
AI & BIOLOGICAL RISK
with the subtitle:
When Scientific Knowledge Becomes a Security Threat
The revised request was then submitted.
The image was successfully generated.
The final visual remained entirely cautionary. It contained no biological instructions, laboratory procedures or operational information.
But the sequence exposed a potentially important cross-layer safety question.
One component of the AI system had effectively determined:
This formulation should not be generated.
The conversational layer then suggested an alternative formulation that another safety layer accepted.
The legitimate objective was ultimately preserved.
But so was the central concept linking artificial intelligence with biological danger.
This creates a difficult safety-engineering problem.
What happens when one AI component refuses a formulation while another AI component helps the user reformulate substantially the same communicative objective into language that passes the safety boundary?
In this instance, the result was harmless.
The infographic was a warning graphic.
No prohibited biological capability was produced.
Therefore, this incident alone does not demonstrate that prohibited biological information can be obtained by simply changing terminology.
But it does expose something that deserves serious examination.
WHEN HELPFULNESS INTERACTS WITH A REFUSAL
An AI assistant is designed to be helpful.
When a request cannot be fulfilled exactly as written, a helpful system may attempt to identify a safe alternative.
Normally, this is desirable.
But safety-sensitive domains create a difficult boundary.
There is a difference between:
redirecting the user toward a genuinely safer objective
and
finding alternative wording that merely causes another safety layer to accept a closely related request.
From the user’s perspective, both interactions may look almost identical.
From a safety-engineering perspective, they are fundamentally different.
The infographic incident therefore raises a question that deserves independent testing:
Can an AI assistant unintentionally become an interpreter of another component’s safety boundary?
If a system identifies which element appears to have triggered a refusal and then proposes an alternative formulation that succeeds, the system may inadvertently reveal something about how the boundary can be navigated.
Again, the infographic generated during this investigation was harmless.
The concern is the general behavior, not the resulting image.
TWO DIFFERENT INCIDENTS — ONE SAFETY QUESTION
The Section 17 incident and the infographic incident were different.
But they point toward the same underlying problem.
In the first case:
AI-assisted explanatory writing risked revealing an idea that a malicious reader might exploit.
The human reviewer recognized the problem and removed it.
In the second case:
one AI layer refused a particular formulation, after which the conversational AI proposed a safer formulation that another layer accepted.
The result was harmless, but the transition exposed a potential weakness in how different safety functions interact.
Together, these incidents suggest that evaluating AI safety exclusively by examining individual outputs may be insufficient.
The complete interaction matters.
The sequence matters.
Human interpretation matters.
And the relationship between different safety layers matters.
CONTENT SAFETY IS NOT THE SAME AS WORKFLOW SAFETY
There is another dimension.
Once an AI produces an otherwise legitimate report, presentation, analysis or research framework, it cannot necessarily control what the human user subsequently does with it.
A malicious user could theoretically take an AI-assisted document and independently insert information that the AI never supplied.
Operational material could be added later.
Sensitive information obtained elsewhere could be inserted.
The document could be reorganized or expanded after leaving the AI environment.
The AI-generated portion might therefore remain compliant while the finished human-created product becomes something entirely different.
This creates an important distinction between:
content-generation safety
and
human-AI workflow safety.
Content-generation safety asks:
What did the AI provide?
Workflow safety asks:
What did the overall human-AI interaction enable, including what happened after the AI’s direct participation ended?
The second question is substantially harder.
THE PARADOX INSIDE THIS INVESTIGATION
This produces an unusual paradox.
Artificial intelligence helped draft an investigation examining the dangers created when artificial intelligence makes complex knowledge easier to organize and understand.
During that process, the investigation itself exposed situations in which:
human judgment identified a potentially unsafe implication in AI-generated explanatory language;
and
a refusal by one AI component was followed by an alternative framing proposed by another AI component that allowed the legitimate task to continue.
Neither incident produced a biological weapon instruction.
Neither establishes that AI biological safeguards can necessarily be bypassed.
But both demonstrate why safety cannot be evaluated only by asking:
“Did the model refuse the dangerous request?”
A more sophisticated question may be necessary:
“What happened throughout the entire interaction after the refusal?”
That may prove to be one of the most important questions in the next generation of AI safety.
TRANSPARENCY AND SAFETY NOTE
Artificial intelligence assisted with the drafting, organization and language of this investigation. It did not originate the underlying witness testimony, scientific discussions or investigative evidence.
During preparation of Section 17, the human reviewer identified that an explanatory passage could itself suggest an undesirable research avenue and instructed the AI to remove it.
During production of the accompanying infographic, an initial formulation explicitly connecting “biological weapon + AI” was refused by the image-generation system. The conversational AI subsequently proposed the safer framing “AI & Biological Risk — When Scientific Knowledge Becomes a Security Threat,” which was accepted and generated.
The resulting image contained no operational biological information.
THE DEEP FILES considers the sequence relevant because it raises a broader question concerning coordination between refusal systems, helpful conversational systems and specialized generation tools.
The incident is documented as a potential safety-design issue. It is not presented as proof that prohibited biological content can be obtained through simple rewording.