HOW EASILY could a malicious person with no scientific expertise and an axe to grind create and spread a nasty pathogen? The bar is constantly being lowered. Advances in genetic sequencing have made recipes for biological agents widely available; gene-editing tools such as CRISPR could theoretically transform innocuous bugs into something lethal; and the tool kits needed to assemble and grow dangerous proteins and viruses can be bought for a few hundred dollars online.

一个没有科学背景、心怀不满且想要制造事端的恶意分子，能够多轻易地制造并传播一种致命病原体？这个门槛正在不断降低。基因测序技术的进步使得生物制剂的"配方"变得唾手可得；CRISPR 等基因编辑工具在理论上可以将无害的微生物转化为致命武器；而组装和培养危险蛋白质及病毒所需的工具包，在网上仅需几百美元就能买到。

Now large language models (LLMs) have entered the mix. Trained on a wealth of scientific knowledge, including specialised virological and bacteriological information, such models could turn novice users into overnight experts, worry biosecurity specialists, who have grown more fearful in recent months. Last year OpenAI, Anthropic and Google all increased precautionary safety measures. The companies could no longer rule out their models helping people with scant scientific background who want to develop biological weapons (though Anthropic said that "our aim is not alarmism"). It is natural to wonder whether the world is on the cusp of a nightmarish age of AI-enabled bioterrorism---and, if so, what to do about it.

现在，大语言模型（LLMs）也加入了其中。生物安全专家担忧，这些模型在海量的科学知识（包括专业的病毒学和细菌学信息）上进行了训练，可能会让新手用户一夜之间变成"专家"。在过去的几个月里，这种恐惧与日俱增。去年，OpenAI、Anthropic 和谷歌都增加了预防性的安全措施。这些公司再也无法排除其模型会帮助那些毫无科学背景但想要开发生物武器的人（尽管 Anthropic 表示"我们的目的不是制造恐慌"）。人们自然会产生疑问：世界是否正处于 AI 赋能的生物恐怖主义噩梦时代的边缘？如果是，我们该怎么办？

A would-be bioterrorist wishing to obtain a suitable pathogen would certainly be able to get some useful information out of an artificial-intelligence model. In December 2025 Britain's AI Security Institute reported that major models could reliably generate scientific protocols to synthesise viruses and bacteria out of genetic fragments. That same month two scientists at RAND Corporation, an American think-tank, showed that commercially available models could assist with the trickiest stage of assembling poliovirus RNA.

一个想要获取合适病原体的潜在生物恐怖分子，肯定能从人工智能模型中获得一些有用的信息。2025 年 12 月，英国 AI 安全研究所 (AI Security Institute) 报告称，主流模型可以可靠地生成科学方案，利用基因片段合成病毒和细菌。同月，美国智库 兰德公司 (RAND Corporation) 的两位科学家证明，商业化的模型可以协助完成组装脊髓灰质炎病毒 RNA 最棘手的阶段。

But unleashing a deadly agent "is not as simple as introducing a DNA or RNA molecule into cells and hoping it will produce a virus," says Michael Imperiale, Professor Emeritus of Microbiology and Immunology at the University of Michigan Medical School. Part of the challenge is transitioning from theory to practice. Knowing what has gone wrong when one delicate virological experiment fails, and how to fix the problem in the next one, is an essential skill that cannot be gleaned from a textbook alone. Here, too, LLMs are helping.

但释放致命制剂"并不像将 DNA 或 RNA 分子引入细胞并期望它产生病毒那么简单，"密歇根大学医学院微生物学和免疫学荣休教授迈克尔·因佩里亚莱 (Michael Imperiale) 说道。挑战的一部分在于从理论向实践的过渡。当一个精细的病毒学实验失败时，知道哪里出了问题以及在下一次实验中如何修复，是一项无法仅从教科书中获得的必备技能。而在这一领域，LLM 也在提供帮助。

Take the Virology Capabilities Test, a widely adopted evaluation developed by SecureBio, a non-profit based in Cambridge, Massachusetts. The test consists of 322 tricky troubleshooting questions that gauge a user's experimental chops. When SecureBio challenged three dozen leading experts to take portions of the test last year, they scored a measly average of 22%. By comparison, biology novices who took the test with the aid of LLMs scored 28%, according to a study published in February by the research division of Scale AI, an American firm. LLMs that took the test without a human scored even higher, ranging from 55% to 61% for the latest models, on a par with the performance of teams of top human virologists.

以"病毒学能力测试" (Virology Capabilities Test) 为例，这是由总部位于马萨诸塞州剑桥的非营利组织 SecureBio 开发的一项被广泛采用的评估。该测试由 322 个棘手的故障排除问题组成，旨在衡量用户的实验实操能力。去年，当 SecureBio 邀请三十多位顶尖专家参加部分测试时，他们的平均得分仅为 22%。相比之下，根据美国公司 Scale AI 研究部门 2 月份发布的一项研究，在 LLM 的辅助下参加测试的生物学新手得分为 28%。而独立参加测试（无人类干预）的 LLM 得分更高，最新模型的得分在 55% 到 61% 之间，与顶尖人类病毒学家团队的表现持平。

Such results have been influential in modelmakers' recent decisions to deploy more safety measures. But a study published in February by Active Site, a non-profit also in Cambridge, suggests that models still have some way to go as real-world lab assistants.

此类结果对模型制造商最近部署更多安全措施的决定产生了影响。但由同样位于剑桥的非营利组织 Active Site 在 2 月份发布的一项研究表明，模型作为现实世界的实验室助手仍有一段路要走。

Their study was the first randomised controlled trial to test the boost that such tools can give a novice---a phenomenon known as uplift---in a wet lab. When 153 participants with minimal experience in biology were assigned tasks relevant to the production of a virus, AI models provided no significant uplift. Only four of the LLM-assisted participants completed the core tasks, one fewer than a control group that could use only the internet. According to Joe Torres, one of the authors of the study, the LLMs would often "rapidly produce answers that looked plausible but were wrong", dooming their users' efforts. Those who leaned more heavily on their chatbots performed no better than those who used them sparingly. Participants in both groups said that the resource they found most useful was YouTube.

他们的研究是首个测试此类工具在"湿实验室" (Wet lab) 中能给新手带来多大提升（这种现象被称为"提升效应" uplift）的随机对照试验。当 153 名几乎没有生物学经验的参与者被分配到与生产病毒相关的任务时，AI 模型并没有提供显著的提升。在 LLM 辅助下的参与者中只有 4 人完成了核心任务，甚至比只能使用互联网的对照组还少一人。该研究的作者之一乔·托雷斯 (Joe Torres) 表示，LLM 经常会"迅速产生看起来合理但却是错误的答案"，从而导致用户的努力付诸东流。那些重度依赖聊天机器人的人，表现并不比那些偶尔使用的人更好。两组参与者都表示，他们发现最有用的资源是 YouTube。

Such results highlight the fundamental paradox of uplift. If a user needs a model's help, they won't know when it is providing bad advice, says Sonia Ben Ouagrham-Gormley, a professor at George Mason University who conducted oral histories of cold-war bioweapons programmes. And where there is uplift, there can also be drag. Anthropic has found that Mythos and Opus help PhD-level experts work much more quickly, and produce better protocols for complex virological experiments, than those who used only the internet. Yet all the protocols contained critical errors that would cause them to fail in a real-life experiment.

这些结果突显了"提升效应"的基本悖论。乔治梅森大学教授、曾对冷战生物武器计划进行口述历史研究的索尼娅·本·欧格拉姆-高姆利 (Sonia Ben Ouagrham-Gormley) 表示，如果一个用户需要模型的帮助，他们就不会知道模型什么时候提供了错误的建议。而在有"提升效应"的地方，也可能存在"阻力效应" (drag)。Anthropic 发现，Mythos 和 Opus 模型确实能帮助博士级专家大幅提高工作速度，并为复杂的病毒学实验制定更好的方案（优于仅使用互联网的专家）。然而，所有的方案都包含了致命的错误，会导致它们在实际实验中失败。

Furthermore, Anthropic's bio-risk evaluators found that the company's models displayed sycophantic tendencies, regularly hallucinated and were overconfident about what they referred to as "implausible ideas". When human experts proposed an unworkable idea, the model often elaborated upon it encouragingly, rather than suggest they try something else. In one test, biology experts were asked to come up with "a detailed plan for a catastrophic biological agent" using Mythos. Even the best schemes were flawed, as judged by human evaluators. One evaluator noted that Mythos suggested steps "which would actually guarantee failure".

此外，Anthropic 的生物风险评估员发现，该公司的模型表现出了"谄媚倾向" (sycophantic tendencies)，经常产生幻觉，并对它们所谓的"不可思议的想法"表现得过度自信。当人类专家提出一个不可行的想法时，模型往往会鼓励性地对其进行详细阐述，而不是建议他们尝试别的方法。在一次测试中，生物学专家被要求利用 Mythos 制定一份"针对灾难性生物制剂的详细计划"。即便是在人类评估员看来最好的方案也是有缺陷的。一位评估员指出，Mythos 建议的步骤"实际上会确保实验失败"。

That might offer some reassurance for the time being. But the fact that any novices at all in Active Site's study were able to synthesise a virus should not be dismissed, says Luca Righetti, another author of the study, who conducted the work while at METR, an AI-safety group. And technical progress continues. Emerging biological design tools work like LLMs that generate nucleotide sequences instead of words; malicious actors could enlist them to make existing pathogens more dangerous. According to a study funded by America's Department of War, these design tools, which have a range of legitimate applications, could one day modify genomic sequences in ways that make pathogens more virulent, transmissible and resistant to countermeasures.

这在目前或许能提供一些慰藉。但该研究的另一位作者、曾在 AI 安全组织 METR 工作的卢卡·里盖蒂 (Luca Righetti) 表示，Active Site 研究中竟然有新手能够合成病毒，这一事实不应被忽视。而且技术进步仍在继续。新兴的生物设计工具运作方式类似于 LLM，只是它们生成的是核苷酸序列而不是单词；恶意行为者可以利用它们让现有的病原体变得更加危险。根据美国战争部资助的一项研究，这些具有一系列合法用途的设计工具，终有一天能以使病原体更具毒性、更具传染性且更能抵抗反制措施的方式来修改基因序列。

In the meantime, researchers will need to find better ways to estimate the risks. The field still lacks good data on whether AI is more likely to boost experts with biology experience over novices, for example. Cassidy Nelson, director of biosecurity policy at the Centre for Long-term Resilience in London, is one of many researchers particularly concerned by the risk posed by individuals with some expertise. For its part, the evaluation team at Active Site is especially interested in the potential uplift effect on "AI power users" who are adept at getting the most out of models, says Dr Torres.

与此同时，研究人员需要找到更好的方法来评估风险。例如，该领域仍然缺乏关于 AI 是否更倾向于提升具备生物学经验的专家而非新手的可靠数据。伦敦长期韧性中心 (Centre for Long-term Resilience) 的生物安全政策主管卡西迪·纳尔逊 (Cassidy Nelson) 是众多对比具备一定专业知识的个体所构成风险感到尤为担忧的研究人员之一。托雷斯博士说，就 Active Site 的评估团队而言，他们对那些擅长从模型中榨取价值的"AI 高级用户"可能产生的提升效应特别感兴趣。

Publicly disclosed experiments have also not yet shown whether AI can help make real pathogenic viruses or bacteria, which may need to be treated differently from benign agents like the one assembled by participants in the Active Site study. Nor have any studies assessed whether AI could help sustain the conditions necessary to produce a biological agent for long enough to weaponise it at scale.

目前公开披露的实验尚未证明 AI 是否能帮助制造真正的致病性病毒或细菌，这些病毒或细菌的处理方式可能与 Active Site 研究中参与者组装的无害制剂不同。也没有任何研究评估过 AI 是否能帮助维持足够长时间的生产条件，从而将生物制剂进行大规模武器化。

Filling those knowledge gaps will probably require government involvement, as well as delicate international co-ordination. For one thing, developing the components of a biological weapon in order to demonstrate uplift would probably violate the Biological Weapons Convention. Last year a team at Microsoft, a tech giant, designed 76,000 modified DNA sequences for dangerous pathogens, to demonstrate how these could evade the screening processes of companies that provide mail-order nucleotide-synthesis services. But they did not actually synthesise any of them to verify their viability. Doing so, they were warned, might be "interpreted as pursuing the development of bioweapons".

填补这些知识空白可能需要政府的参与以及微妙的国际协作。一方面，为了证明"提升效应"而开发生物武器的组件可能会违反《生物武器公约》。去年，科技巨头微软的一个团队为危险病原体设计了 76,000 个修改后的 DNA 序列，以展示这些序列如何能逃避提供邮寄核苷酸合成服务公司的审查程序。但他们并没有实际合成其中任何一个来验证其可行性。他们被警告称，这样做可能会被"解读为寻求开发生物武器"。

Given these challenges, developers might need to slow the pace at which they release new models. In the six months that it took Active Site to publish the results of its uplift trial, for example, four new frontier models emerged with improved biological capabilities. Dr Torres notes that these models appear to be less likely to hallucinate plausible but erroneous sequences than those his team tested in the original study, which might boost their uplift potential. By the time the group publishes the results of its follow-up trial, which is scheduled for later this year, model capabilities are likely to have improved further.

鉴于这些挑战，开发者可能需要放慢发布新模型的速度。例如，在 Active Site 发布其提升效应试验结果的六个月里，出现了四个具有更强生物能力的全新前沿模型。托雷斯博士指出，与他的团队在原始研究中测试的模型相比，这些模型产生"看似合理但错误序列"的幻觉可能性似乎更小，这可能会增强它们的提升潜力。到该小组发布定于今年晚些时候进行的后续试验结果时，模型的能力很可能已经进一步提升。

There is precedent for such caution. Last month Anthropic announced that it was limiting access to Mythos, its world-leading cyber-security model, until the risks it posed could be resolved. If developers find that a model exhibits a significant jump in dangerous biological capabilities, it might be similarly wise to keep it under lock and key until the potential for uplift is known. With stakes as high as these, a little patience could go a long way. ■

这种谨慎是有先例的。上个月，Anthropic 宣布限制访问其世界领先的网络安全模型 Mythos，直到其构成的风险能够得到解决。如果开发者发现模型在危险生物能力上出现了显著跃升，那么在了解其提升潜力之前将其"封存"同样是明智之举。在利益攸关如此之大的情况下，一点点耐心可能会产生长远的影响。 ■