Foreign researchers have used advanced artificial intelligence models to plan experiments involving highly pathogenic bird flu, chikungunya, and other biological agents with potential weapons applications, according to a new threat report from the AI company Anthropic.
The report details five instances where researchers utilized AI to study viruses' transmissibility and immune evasion, investigate orthopoxvirus immune-response genes, and assist in designing novel toxins. In some cases, these researchers took steps to bypass safety features designed to restrict access to dangerous biological capabilities.
Anthropic stated that it is not claiming the researchers intended to develop biological weapons, but the findings provide a concrete example of a threat that has largely been discussed in hypothetical terms: scientists with existing biological expertise and resources are using increasingly powerful AI systems to accelerate sensitive, dual-use research.
In one documented case, Anthropic blocked a grant application for chikungunya gain-of-function research submitted by a military research institute. The proposed work aimed to identify mutations that could increase the virus's transmissibility and ability to evade the immune system. The researchers intended to engineer these mutations into infectious clones and test them in live animals, selecting for variants that caused more severe disease. Anthropic noted that while such work could advance vaccine and treatment development, it could also create a more dangerous pathogen difficult to distinguish from a naturally occurring outbreak.
These researchers accessed Anthropic's Claude AI through a life-sciences platform that routed traffic through U.S. infrastructure to circumvent regional restrictions. When Claude initially refused sensitive prompts, the platform directed requests to another model with less stringent safeguards. The research reportedly continued even after Anthropic banned accounts associated with this activity, with the platform operator re-establishing access using new identities and Claude continuing to provide editorial assistance.
Another case involved a researcher who spent weeks using Claude to plan experiments focused on mammalian adaptation and airborne transmission of highly pathogenic avian influenza. The research aimed to study viral traits that could enable bird flu to spread more effectively among mammals and cause severe disease outside the respiratory system. A version capable of efficient human-to-human transmission would pose a significant pandemic threat, the report indicated. Anthropic believes this case demonstrated an active research program developing the knowledge and biological materials necessary to create pathogens with enhanced pandemic potential, with the researcher taking steps to hide their identity and access the models from an unsupported region.
A separate user connected to a state-associated infectious-disease laboratory used Claude to draft an orthopoxvirus research grant application. Orthopoxviruses include variola, the virus causing smallpox, and mpox. The application proposed studying viral genes that disable the human immune response and included detailed experimental designs and statistical plans. Because the work was framed around weakening the virus, Claude's safeguards did not block the assistance. However, Anthropic warned that the same information could be used to enhance the virus's immune-evasion capabilities.
The final two cases involved venom peptides and toxins. One researcher used Claude to build an atlas of toxin peptides and create a pipeline to optimize their characteristics, with the stated goal of developing new treatments. However, the atlas also contained structures associated with paralytic toxins that could potentially be used as incapacitating agents. Anthropic indicated this work was part of a state-supported research program.
In the other case, a researcher used Claude to redesign several toxins, including a bacterial toxin and a protein from a hemorrhagic-fever virus identified by the World Health Organization as a priority disease threat. The researcher used Claude to help prepare progress reports, while instructing the model to keep the identities of the toxins deliberately vague.
Anthropic stated that these cases highlight the difficulty of preventing biological misuse through automated filters alone, as safeguards were less effective when users framed their work as medical, defensive, or therapeutic research. "Biological capabilities are dual use," the company noted in the report. "The same information that can be used to develop a biological weapon could also be used to develop, for example, a vaccine or a cure for a disease."
Anthropic recently reviewed 30 days of activity associated with adversarial state institutions and found approximately 35 distinct biological research efforts, some of which had "notable dual-use potential." The company stressed that these findings do not indicate an imminent biological attack enabled by Claude, but they do demonstrate attempts by researchers tied to state-associated programs to evade access controls and utilize frontier AI models for research that could have weapons applications. Anthropic suggested that future safeguards may require more than content filters, potentially including identity verification, institutional vetting, and closer monitoring of users seeking access to advanced biological capabilities.