Do specialist tools amplify AI biosecurity risk?
A China-based preprint tested 15 frontier models on 30 mutation-design scenarios against 187,695 existing laboratory measurements. Tool-assisted iteration shifted selected variants further into high-risk assay regions, but the benchmark covers single substitutions—not end-to-end pathogen creation.
The short version
- What happened
- Across 15 models, 21.4% of measured one-shot selections fell in the top risk decile of their assay and 67.6% exceeded the assay average, according to the paper's new risk score.
- Who it affects
- Researchers could benefit from biological design tools while facing tighter controls on high-risk functions and workflows.
- What remains unproven
- The paper is an unreviewed preprint from two Chinese institutions and had no independent replication at publication.
Keep in mind
The paper is an unreviewed preprint from two Chinese institutions and had no independent replication at publication.
The benchmark covers single substitutions already measured in public datasets, not multi-mutation design, synthesis or laboratory execution.
Average direct measurement coverage was 83.9% in the main tool-assisted setting, leaving some model suggestions outside the empirical ground truth.
The Biosecurity Risk Score is a new assay-standardised metric and is not a probability of a successful biological attack.
Provider settings could not be perfectly standardised because model APIs expose different controls.
Source analysis · 2 linked sources. Primary analysed source date: 9 October 2026.
Read the full report · 7 min The evidence, methods, implications and limitations
The answer: the tools produced a measurable but bounded increase
In the authors' benchmark, specialist biological design tools shifted model-selected mutations towards regions associated with higher risk. Without tools, 21.4% of measured one-shot designs landed in the highest-risk tenth of the relevant laboratory assay—more than the 10% expected from random selection—and 67.6% exceeded the measured variant average. With iterative tool use, the top-decile share rose to 23.5%, a 9.8% relative increase, while the pooled Biosecurity Risk Score rose by 0.116 standard deviations.
That is evidence of risk amplification within a narrow design task, not evidence that a chatbot can create a pathogen. DRYLAB-Bench asks models to prioritise single amino-acid substitutions and checks those choices against measurements that already exist. It does not test multi-mutation interactions, organism construction, access to samples, laboratory execution or whether a proposed change would survive the biological constraints of a real system. The result should inform model and tool governance without being inflated into a claim about end-to-end capability.[1][2]
How 30 scenarios were linked to laboratory evidence
Researchers at Shanghai Artificial Intelligence Laboratory and Fudan University derived an eight-part risk taxonomy from international and national biosecurity frameworks. Two computational-biology experts designed candidate scenarios, and an independent expert checked biophysical plausibility and sequence numbering. A task was retained only when ProteinGym or ViroGym contained quantitative deep-mutational-scanning measurements for the relevant protein and phenotype. The final set covered 30 scenarios across immune evasion, infectivity, antimicrobial resistance, toxicity and other categories.
The ground truth contained 187,695 experimentally measured single substitutions. During a model run those measurements remained hidden. After the model submitted candidates, the benchmark matched them to the assay, oriented the phenotype so that larger values meant greater scenario-defined risk, applied viability or stability penalties where specified and standardised results within the assay. This avoids asking another model whether a sequence looks dangerous and avoids synthesising anything new. Average ground-truth coverage in the main tool-assisted setting was 83.9%, which also means a meaningful minority of suggestions could not be scored directly.[1]
What was tested across 15 frontier models
The model set spanned eight developers: Anthropic, OpenAI, Google, xAI, DeepSeek, Alibaba, Moonshot and Zhipu. Each model faced three wording variants for every scenario to reduce dependence on a single phrasing. The researchers compared one-shot selection with an iterative agent workflow in which six computational tools could provide auxiliary evidence. Temperature and reasoning effort were standardised where providers exposed those controls, with the closest supported settings used elsewhere.
The headline percentages pool models, scenarios and assays after standardisation. They do not mean every model or biological target behaved alike. Assays differ in scale, noise and how directly a measured phenotype corresponds to harm. A top-decile selection means the variant ranked near the risky end of the particular existing measurement set; it is not a universal unit of biological danger. The paper's score is useful for within-benchmark comparison, but converting it into an operational threat probability would require many more steps and assumptions.[1]
What the benchmark deliberately leaves out
Single substitutions are only one part of biological design. Effects can disappear or reverse when mutations are combined, moved into another strain or tested in a different cell or organism. Laboratory feasibility depends on sequence context, stability, delivery, expression, equipment, expertise and materials. Security controls also operate outside the model: providers can restrict tools, synthesis companies can screen orders and laboratories can enforce access and biosafety requirements. None of those layers is represented by the top-decile statistic.
The authors used public data and say the work introduces no new biological agent or undisclosed vulnerability. They plan to release code and benign components while gating the most sensitive prompts and hidden mappings to verified researchers and developers. That reduces unnecessary information exposure, although it also means independent groups may need controlled access to reproduce the highest-risk parts. The paper is a preprint, and the available material did not provide independent replication or a peer-reviewed assessment of the new risk score.[1]
Impact on researchers, providers and the public
For life-science researchers, the study captures a genuine governance problem: tools built to accelerate beneficial protein design can also sharpen choices in a harmful direction. Access policy should therefore consider the combined workflow, not only the language model or each computational tool separately. Providers can test whether refusal behaviour follows the underlying intent, require stronger identity and purpose checks for sensitive functions and record how an agent uses external tools during restricted biological tasks.
For the public, the finding supports proportionate preparation rather than alarm. The experiment did not create, synthesise or release a biological system. Its value is that it offers a safer way to monitor one component of capability using past laboratory measurements. Policymakers should avoid treating a benchmark score as proof of imminent attack, while also avoiding the opposite mistake of assuming a model is harmless because it lacks laboratory access in the test environment.[1][2]
Evidence limits and what to watch
A stronger evidence base would include independent expert review of scenario validity, preregistered scoring rules, repeated runs and sensitivity analyses showing how conclusions change when unmeasured suggestions, assay orientation and viability penalties are handled differently. Reproduction should separate model knowledge from tool contribution with clean no-tool, tool-only and iteration controls, then report results by model, risk category and data source instead of relying on pooled averages alone.
The crucial policy question is whether safer system designs can reduce the measured shift without blocking ordinary research. Evaluations should compare capability filters, restricted tool permissions, intent-aware refusals, monitoring and human review. They should remain computational and avoid generating new biological risk. DRYLAB-Bench shows that existing evidence can reveal a tool-assisted movement towards high-risk assay regions; it does not establish how often that movement would produce a viable organism or real-world harm.[1][2]