Anthropic’s bioweapon report exposes an infrastructure blind spot

The warning that keeps repeating

On 10 September, Anthropic published a report describing something specific rather than speculative. Over a 30-day monitoring window, the company said it had identified 35 distinct research efforts showing signs of trying to get around its safeguards, including apparent attempts at gain-of-function work involving infectious diseases such as bird flu, plus novel toxins and venoms.

The company called biological misuse one of the most serious risks facing its models, and noted that bad actors sometimes lean on the legitimate scientific uses of AI to maintain what it described as “a kind of ‘plausible deniability’” about the real purpose of their research.

It’s a striking data point, but it’s also the latest entry in a warning that has been repeating, almost word for word, since 2023.

That’s when Dario Amodei told a Senate Judiciary subcommittee that certain steps in bioweapons production involve expertise that “can’t be found on Google or in textbooks,” and that today’s models could already fill in some of those gaps, if only incompletely.

Two years on, Anthropic’s own red-teaming has confirmed the trajectory it warned about: an internal assessment across four model generations found Claude’s biology knowledge had moved from roughly high-school level to something close to expert baseline in several domains, alongside similar gains in cybersecurity.

RAND weighed in with more structure last month, publishing a defence-in-depth strategy that maps nine layered interventions against a potential AI-enabled biological attack. Steph Guerra, who leads RAND’s AI x Bio work and authored the report, put the underlying problem plainly: AI is “lowering the technical, operational and motivational barriers” that have historically kept bioweapons attacks rare. Her colleague Sella Nevo added that nobody knows exactly how fast the relevant capabilities will advance, which is precisely why the safeguards need building now rather than once the risk becomes undeniable.

None of this is wrong, and none of it is new in substance. What’s missing from nearly every version of this story, from the Senate testimony onward, is a serious look at what the actual evidence says about how much uplift AI is providing today, as opposed to how much it might provide eventually.

Measured risk versus imagined risk

Here’s the part almost nobody is putting side by side. Expert elicitation surveys, including one run by the Forecasting Research Institute, have suggested that AI capability could raise the annual probability of a catastrophic biological attack roughly fivefold if models reach expert-virologist level. That’s the number that tends to get quoted in policy debates and conference panels.

But the empirical testing tells a more cautious story. RAND’s own uplift trials found no statistically significant difference between attackers using frontier models and attackers using standard internet research.

Anthropic’s internal evaluations reportedly found something closer to the opposite of the feared outcome: guided use of a model produced substantially fewer critical errors than unguided attempts, which is not the same as producing more dangerous outcomes overall. Even the biosecurity sceptics acknowledge the caveat that matters most here: capability testing is inherently a snapshot, and today’s “cannot reliably guide” finding is not a permanent one.

David Relman, the Stanford microbiologist frequently cited on this topic, has pushed back on the comforting version of that argument. He warns that assuming a low historical rate of bioweapons attacks will simply continue requires what he calls “hopelessly flawed assumptions,” given how quickly the underlying technology is moving. That’s a fair challenge to complacency. But it’s a different claim to the specific, testable question of what today’s models can and cannot do, and conflating the two is exactly why the current coverage reads as either alarmist or dismissive, rarely as calibrated.

For readers making capital allocation decisions around AI infrastructure, that distinction has practical weight. A five-times increase in tail risk estimated by survey versus a measured null result in controlled testing are not the same input to a risk model, and coverage that treats them interchangeably isn’t giving executives anything they can actually use.

The infrastructure layer nobody’s mapping

This is where the story becomes genuinely relevant to a data centre and digital infrastructure audience, and where almost no outlet has gone. Anthropic’s description of how it caught those 35 research efforts- geographic access restrictions, usage-pattern flagging, dual-use masking detection- is functionally a compliance and screening stack. It sits in the same family as export control screening, sanctions checks and KYC processes that infrastructure providers already run for entirely separate regulatory reasons.

Nobody covering the biosecurity angle has drawn that line, and it’s a fairly direct one: biological risk screening at the model layer is an access-control problem, and access control is infrastructure.

RAND’s report makes the fragmentation point explicitly. Guerra’s team found today’s safeguards are scattered across companies, governments and countries with no shared technical standard connecting them, from the DNA synthesis screening that catches roughly 97% of flagged orders through to the input and output filtering individual labs run on their own models.

Nobody has mapped where the responsibility actually sits along that chain, and whose job it becomes when a request touches cloud hosting, inference access and physical synthesis all at once. That’s an infrastructure governance question as much as it is a biosecurity one, and it’s currently nobody’s beat.

There’s also a live sovereignty angle sitting inside this story that’s being reported as a footnote rather than its own piece. When the US suspended export access to Anthropic’s Mythos and Fable models in June, cutting off allied users in the UK and EU before reversing the decision weeks later, it did more than disrupt a product line.

Analysts writing in Foreign Affairs have argued the episode is likely to accelerate interest among allied governments in building domestic AI-bio capability, precisely so they’re not exposed to a repeat cutoff. That’s a direct sovereign compute story, and it belongs in the same conversation as biosecurity risk, not a separate one about export policy in the abstract.

What to watch next

The RAND report is explicit that some of its recommended safeguards will take years to build and test, which means the fragmentation it describes isn’t closing anytime soon.

Expect three things to matter over the coming months: whether any of the frontier labs move toward a shared technical standard for biological risk screening rather than proprietary systems; whether DNA synthesis providers and cloud infrastructure operators start being named in the same governance conversations as the model developers themselves; and whether the Mythos and Fable episode becomes a template other governments actively plan around, rather than a one-off disruption. Each of those would turn this from an executive-warning story into an infrastructure-build story, and that’s the version of it actually worth reporting on next.

Related stories

The Government who cried Fable: How the US/Anthropic saga could be felt worldwide

Anthropic Mythos test finds flaws in classified US government systems within hours, reports say

OpenAI AI model “lies and cheats” during test to exploit Hugging Face