AI Might Enable the Next Pandemic. Gene Synthesis Screening Could Stop It.

Summary

• Concerning capabilities: AI systems can now provide expert-level guidance relevant to making biological weapons, and have generated genomes for viruses not seen in nature.
• Inadequate safeguards: Many AI models have no safeguards preventing biological misuse, and the safeguards that do exist can often be jailbroken. 
• Secure the supply chain: Bad actors need genetic materials to build a bioweapon. This makes the physical supply chain a critical place to mitigate risk.
• Recommendations: Governments should require companies producing synthetic DNA to screen orders, verify their customers, refuse and report flagged requests, and undergo independent evaluation to ensure compliance.

‍

Biological weapons have long been a national security concern, and AI is on track to make building one easier. In June 2026, the CEOs of the leading AI companies, life sciences researchers, and national security experts published an open letter urging the US Congress to act. 

On 30 September, California became the first jurisdiction in the world to mandate gene synthesis screening. This requires providers of synthetic DNA to screen orders for dangerous sequences and verify their customers before shipping them. 

Other jurisdictions must now build on California’s example.

AI is changing biosecurity risk

Building a biological weapon is not easy. Replicating even a known virus requires its genome sequence, specific materials such as synthetic DNA, the expertise to assemble those into a replicating pathogen, and avoiding the attention of security agencies. These barriers are a common explanation for why bioterrorism attacks have been rare, particularly from unsophisticated actors.

AI is starting to erode these barriers. 

Leading AI companies now warn that their models, without sufficient safeguards, could meaningfully help a non-expert create a biological weapon. AI systems can provide expert-level guidance relevant to biological weapons development, and outperform PhD-level virologists on questions about technical laboratory procedures.

AI-assisted design of new pathogens is also progressing. Biological foundation models have generated genomes for viruses (bacteriophages) not previously seen in nature, with some replicating faster than the natural virus they were modelled on.

While we should not overstate the current risk, the pace of change is concerning. About 18 months separated an AI agent finding its first zero-day cybersecurity vulnerability and Mythos discovering thousands in major operating systems. Where will biological capabilities be 18 months from now?

Model safeguards are not enough

We need to prevent AI models from providing information that could help someone develop a biological weapon. Techniques like classifiers, in-built guardrails, data filtration, and red-teaming can all help, and the companies producing the most advanced AI models already implement some of these safeguards. 

However, model safeguards can be bypassed. In an EpochAI survey, only 3% of over 360 biological AI tools had any safeguards, and where they exist, jailbreaks are common. Anthropic recently noted it is “likely impossible to completely prevent universal jailbreaks”. It is easy to remove safeguards from open-weight models, and those models can't be withdrawn from circulation.

We need multiple layers of defence. 

Targeting the physical supply chain 

A bad actor with AI guidance still needs physical genetic materials, like synthetic DNA, to build a bioweapon. 

Gene synthesis screening mitigates risk at this chokepoint and is one of the best-understood, least disruptive ways to prevent biotechnology misuse. The core idea is: before shipping an order, synthetic DNA providers check for ‘sequences of concern’ and verify the customer. Sequences of concern are genetic sequences that could be used to create or enhance a dangerous pathogen.

Many major providers already screen voluntarily as part of the International Gene Synthesis Consortium, but without enforcement, providers may choose not to participate. 

An effective screening regime needs four components

1. Providers should screen orders and verify customer identity. Screening should apply to sequences that are above a minimum length threshold (e.g. 50 nucleotides). Forward-looking policy should cover ‘benchtop’ synthesis devices – machines that let users synthesise DNA themselves – in addition to commercial synthesis orders. California’s new law does exactly this. 

2. Providers should check orders against an evolving database of sequences of concern. The database should combine national and international control lists, such as the US Select Agents list and the Australia Group Common Control Lists. It should also include sequences known to contribute to pathogenicity or toxicity, but which aren’t on those lists. And given that a database of dangerous sequences can be an information hazard, it should have cybersecurity and access controls. 

Governments should designate a body responsible for both determining what ‘counts’ as a sequence of concern and updating the database as this evolves. Independent not-for-profits like IBBIS already develop shared databases and work with governments, industry, and scientists to maintain them. 

Over time, screening should move beyond flagging sequences similar to known threats and toward flagging sequences that encode a dangerous function. This is particularly important as AI becomes more adept at designing dangerous sequences that don’t look like known threats. But while function-based screening matures as a technology, similarity-based screening is a good start. 

3. Providers should investigate, refuse, and report flagged orders. A flagged order should trigger heightened customer verification, where providers confirm the customer has a legitimate use for the relevant sequence. If the provider still has concerns, they should refuse the order and report the customer to relevant authorities. Reporting matters because the prospect of being reported can have a deterrence effect. Providers should also be required to keep records of orders and customers, so a concerning transaction can be traced and investigated later. 

4. Governments should verify that providers are complying. The minimum approach would be to require providers to self-attest that they screen in accordance with certain standards. Stronger approaches involve independently evaluating providers and their screening methods, with penalties for non-compliance.

Getting to widespread screening

Beyond California, international momentum is building.

In the US, the Biosecurity Modernization and Innovation Act proposed in January 2026 would mandate screening for all providers. In the last 24 months, the EU and New Zealand have similarly proposed Acts that would introduce screening obligations, and the UK has published voluntary screening guidance. 

While these steps are positive, legislation is not yet in force and compliance remains voluntary. 

How a country implements screening depends on its policy environment and synthesis industry. A country needn’t be a major industry player like the EU. 

In fact, countries with less of a domestic synthesis industry may find it easier to act – given they can regulate imports rather than legislate and negotiate with an established domestic sector. Australia, for example, does not have a significant domestic industry, but is well placed to mandate screening through its existing import scheme – without new legislation.

One jurisdiction acting will help reduce risk, but is not enough. We need widespread screening to stop bad actors slipping through the gaps.

AI is not enabling catastrophic biological harm yet. But we must be prepared for where we might be in six months, one year, or five years from now.