Every age has had its dark arts, and for most of history the most dangerous of them, the making of biological and chemical weapons, stayed locked behind years of specialist training and rare laboratory skill. That quiet protection is now being tested by machines that can speak fluently about pathogens and guide a novice through steps once reserved for experts. Vision of Humanity's analysis places this convergence of artificial intelligence and biotechnology within a longer story of how violence adapts to whatever tools a society builds, and it asks whether the guardrails of governance can move
How AI Could Lower the Barrier to Bioweapons and Expand Terrorist Capabilities
The cell did not produce a working weapon, but it did test a guided rocket.
Mark
Why does this analysis start with a box of chemicals at the White House?
Mimi
Because it makes the worry concrete. In early 2023 a biochemist and former UN weapons inspector showed up with a dozen ingredients that Claude had recommended, which could be precursors to a pandemic if assembled correctly.
Luke
Worth noting that's one person's demonstration, and the source says "if assembled correctly." It doesn't say anyone could have actually done it.
Mark
What's the core argument, then?
Mimi
That AI lowers the knowledge barrier. Bioterrorism has been rare because it takes specialised expertise, and general-purpose chatbots make complex information accessible to non-specialists.
Luke
Accessible information isn't the same as capability. The analysis itself says retrieving or generating scientific information doesn't establish the ability to produce a weapon, and that users need the judgement to assess what they're given.
Mark
The history of attacks seems to support that.
Mimi
It does. The Tamil Tigers' chlorine blew back on their own lines, Aum Shinrikyo's sarin was impure, and the Islamic State never got past low-grade mustard. In each case expertise was the limit.
Luke
And the Houthi cell is the same story. Nine months of using Claude, a failed rocket test, no functioning weapon. That's intent, not proven capability, and it's Anthropic's account.
Mark
Are any of the cases actually biological?
Mimi
Not the attack cases. Tumbler Ridge and the Las Vegas Cybertruck involved shooting and explosives. The biological evidence is the 2025 virus designed from scratch that killed E. coli.
Luke
Right, so the bio-terror threat is projected from capability trends. The 3% safeguard figure and the $100,000 versus $1 billion cost comparison are strong claims, and the piece gives no detail on how they were derived.
Mimi
What's firm is the governance gap: 118 of 193 states aren't in any major AI initiative.
Luke
Fair, though that's a measure of oversight, not of risk realised. Nothing here says a biological attack has happened.
The Pulse
- A former weapons inspector carried chemical ingredients recommended by an AI model into the White House, a moment that turned a theoretical worry into a concrete alarm.
- Generative biological models have moved from predicting outcomes to designing entire viral genomes from scratch, and a 2025 design reportedly killed strains of E. coli.
- A Houthi cell reportedly used Claude for nearly nine months on guided weapons software, though its one test of a guided rocket failed and no working weapon emerged.
- Only 3% of 375 biological AI tools surveyed had any safeguards, and most states sit outside the major AI governance initiatives.
- The gap between acquiring information and building a working biological weapon still holds, yet analysts are watching closely to see whether that gap survives the next generation of tools.
Every age has had its dark arts, and for most of history the most dangerous of them, the making of biological and chemical weapons, stayed locked behind years of specialist training and rare laboratory skill. That quiet protection is now being tested by machines that can speak fluently about pathogens and guide a novice through steps once reserved for experts. Vision of Humanity's analysis places this convergence of artificial intelligence and biotechnology within a longer story of how violence adapts to whatever tools a society builds, and it asks whether the guardrails of governance can move as quickly as the capabilities they are meant to contain. Whether AI can truly bridge the stubborn gap between knowing and doing remains an open question, but the direction of travel is unsettling.
In early 2023, a biochemist who had once worked as a United Nations weapons inspector walked into the White House carrying a small box. Inside were about a dozen chemical ingredients, all recommended by the AI model Claude. Assembled correctly, he warned, they could serve as precursors to another pandemic. His point was simple and chilling: tools like ChatGPT could help terrorists identify dangerous biological agents and find the materials to make them.
That episode anchors an analysis from Vision of Humanity on how artificial intelligence and biotechnology are converging. Bioterrorism has been rare largely because building and delivering biological weapons demands specialised expertise. The authors argue that large language models and AI-driven design tools are chipping away at that barrier, putting complex science within reach of people with no formal training. The capabilities are also growing beyond answering questions. In 2025, researchers produced a genome-scale AI design of a modified virus that could target and kill strains of E. coli, and the authors warn that such models may one day reconstitute pathogens more deadly than those found in nature.
History shows how much capability matters. The Tamil Tigers' 1990 chlorine attack was undone by a shifting wind, and the 1995 Aum Shinrikyo sarin attack in Tokyo was limited by the quality of its agent. Even the Islamic State, which used sulphur mustard in Syria and Iraq, struggled to move beyond low-grade product because few of its members had the necessary knowledge.
There is already evidence of AI in violent planning. The suspected perpetrator of the February 2026 Tumbler Ridge school shooting in Canada reportedly coaxed ChatGPT into answering a shooting scenario once he framed it as hypothetical, and OpenAI had flagged the account internally without alerting police. In September 2026, Anthropic reported that a Houthi-linked cell had used Claude over about nine months to support guided weapons development. The cell never produced a working weapon, though it did carry out a failed guided rocket test.
The analysis is careful about limits. Easier access to information does not by itself confer the ability to build a biological weapon, and users still need the judgement to tell credible guidance from bad advice. Yet the surrounding trends are troubling. Most fatal terrorist attacks in the West over the past five years were carried out by lone actors, and radicalisation can now unfold in weeks rather than months. Meanwhile, oversight remains thin: 118 of 193 UN member states participate in none of the seven major AI governance initiatives, and only 3% of 375 biological AI tools surveyed had safeguards. The question the authors leave hanging is whether governance can catch up with tools that are advancing faster than regulators can follow.
In early 2023, a biochemist who had once worked as a United Nations weapons inspector carried a small box into the White House. Inside were about a dozen chemical ingredients, all recommended by the large language model Claude. If assembled correctly, he warned, they could serve as precursors to another pandemic. His message was that tools like ChatGPT could help terrorists identify potent biological agents and find the materials to make them.
That episode sits at the center of an analysis from Vision of Humanity on how artificial intelligence and biotechnology are converging. Bioterrorism has historically been rare, largely because producing and deploying biological weapons demands specialised expertise. The analysis argues that large language models, AI-enabled biological design tools and automated science are eroding that barrier by making complex scientific information available to people without specialist training, through general-purpose systems anyone can use.
The capabilities are moving past information retrieval. The 2026 International AI Safety Report finds that AI systems are getting better at tasks relevant to biological and chemical weapons, including accurately describing pathogens and giving expert-level laboratory instructions. Biological foundation models have also shifted from predicting outcomes to generating content. In 2025, researchers showed the first genome-scale generative AI design: a model produced coherent genome-scale sequences for a significantly modified virus entirely from scratch, and the resulting virus could target and kill strains of E. coli. The analysis notes that such models may be able to produce or reconstitute pathogens more severe and deadly than those found in nature.
History shows how much capability has mattered. In 1990 the Tamil Tigers carried out the first chemical attack by a non-state organisation, releasing chlorine gas against the Sri Lankan military; it relied on environmental conditions, and a sudden wind change pushed the gas back toward their own side. The 1995 Aum Shinrikyo sarin attack on the Tokyo subway was limited by the quality and dissemination of the agent, and later expert assessments suggested casualties could have been far higher with a purer product. Between 2014 and 2017, the Islamic State produced and used sulphur mustard in Syria and Iraq, the first known non-state actor to pair a banned chemical agent with a projectile delivery system. Even so, few members had the knowledge to move beyond low-grade mustard.
There is evidence that people are already using AI in violent planning. The suspected perpetrator of the February 2026 Tumbler Ridge school shooting in Canada reportedly used ChatGPT to explore a hypothetical shooting scenario; the chatbot first declined, then answered once the prompt was reframed as hypothetical. OpenAI had flagged the account internally but did not alert police. The attacker in the January 2025 Cybertruck explosion in Las Vegas used ChatGPT to research how much explosive he needed, where to buy fireworks and how to get a phone without identification. In September 2026, Anthropic reported that a cell in Houthi-controlled Yemen used Claude over about nine months to support guided weapons development, including guidance, navigation and control software. The cell did not produce a working weapon, though Anthropic said it carried out a failed test of a guided rocket.
The analysis stresses the limits. Lower information barriers do not by themselves confer the ability to build a biological weapon, and users still need enough scientific judgement to tell whether what they receive is credible and applicable. How far AI can overcome the practical and scientific hurdles remains uncertain.
Still, the surrounding trends worry the authors. The 2026 Global Terrorism Index attributes 93% of fatal terrorist attacks in the West over the past five years to lone actors, who were three times more likely to carry out an attack successfully than groups of two or more. It also finds radicalisation can now happen within weeks, versus 18 months in 2005. The Global Peace Index found that new technologies are lowering barriers to participation in conflict for state and non-state actors alike.
Oversight is thin. The 2026 GPI found that 118 of 193 UN member states take part in none of the seven major AI governance initiatives, and a 2025 study found only 3% of 375 biological AI tools surveyed had any safeguards. The asymmetry in cost is stark: resurrecting a dangerous virus similar to smallpox could cost as little as US$100,000, while developing a vaccine can exceed US$1 billion. The question to watch is whether safeguards and governance can catch up with tools that are advancing faster than regulators.
Notable Quotes
The Houthi-area cell did carry out a failed test of a guided rocket.— Anthropic, September 2026 report
Want the full story?
Read the original at Vision of Humanity ↗
Technology