In May 2025, Anthropic released its most capable model under a security standard it had never used before, one built specifically to stop the system being used for chemical, biological, radiological or nuclear work. The document explaining the decision contains a sentence worth sitting with. The company had “not yet determined whether Claude Opus 4 has definitively passed the Capabilities Threshold” that would require those protections. It locked the door without being certain the door needed locking.
A month later OpenAI published its own position on biology, defining a model of “High” capability as one that could give meaningful help to novices with only basic training, enough to create a biological or chemical threat. Its head of safety systems had already said the company expected the successors to its o3 reasoning model to reach that level. Within months all three leading labs had shipped models under heightened biological safeguards, and the International AI Safety Report, chaired by Yoshua Bengio, written by more than a hundred experts, backed by some thirty governments, recorded the reason without embellishment: pre-deployment testing could not rule out that the models would help someone build a weapon.
The same report found that one AI system now outperforms 94% of virology experts at troubleshooting laboratory work, and that of 375 biological AI tools surveyed, only 3% carry any safeguards at all.
Then the question stopped being what these systems might say and became what they can design. In October 2025 a Microsoft-led team published in Science the result of a two-year confidential project. Using freely available protein design tools, they redesigned dangerous proteins so that the new versions slipped past the screening software DNA synthesis companies rely on to catch dangerous orders, 76,080 sequences, generated to test a suspicion. They borrowed a term from computer security and called it a “zero day”: a hole nobody knew was there. Publication was withheld until patches had been written and distributed worldwide.
None of that is a fringe position. It is the hedged, lawyered, publicly filed consensus of the people with the most commercial reason to be relaxed about it.
The wall was never information
The argument for taking AI seriously as a biosecurity problem rests on a single observation about what the barrier has always been.
The barrier is know-how… the accumulated, unwritten, failure-derived judgment that lives in the hands of people who have done a thing many times and cannot fully explain how. Which batch of reagent behaves badly. Why the yield collapsed on Tuesday. What the written protocol leaves out because everyone in the lab already knows it. Information was never the constraint: the genetic sequences of dangerous pathogens have been public for two decades, and having DNA made to order is now a service you can buy. Know-how is expensive, slow, and passed hand to hand, and it has been the load-bearing wall of biological arms control for fifty years.
Large models dissolve that wall. That is close to a description of what they are for. A system trained on the entire published record of methods, failed experiments, appendices and lab-forum troubleshooting can compress a decade of bench apprenticeship into something that answers at three in the morning and never condescends. Every legitimate use of that capability, and there are many, and they are enormous, runs on the same mechanism as the illegitimate one. The frontier labs know this. It is why testing models for biological uplift is the one area where the industry’s safety apparatus carries real weight.
Take that seriously and you arrive somewhere uncomfortable. The number of actors who can attempt something ambitious in biology is going up, the skill required is going down, and the deterrence that governed nuclear weapons: visible facilities, detectable materials, tests that announce themselves, has no equivalent here.
What would they actually build?
So consider what an ambitious actor would actually build, given the choice.
Let’s begin by ruling out the obvious. A respiratory virus is the nightmare everyone has already prepared for, it spreads too indiscriminately to be useful to anyone with a border to defend and the entire post-2020 surveillance system is pointed straight at it.
Consider instead something mosquito-borne. A dengue-equivalent: a virus causing a fever that looks like a hundred other illnesses, that produces no symptoms at all in roughly three out of four people it infects, that kills rarely enough to avoid triggering emergency protocols and often enough to fill hospital beds. Dengue has a further property that matters here: the severe form appears disproportionately on a person’s second infection, with a different strain. The damage arrives years late, in a population that has already declared the first wave survived.
Pair it with a mosquito chosen for one quality: the ability to survive winter where the models say it cannot.
I am not going to sketch how any of that would be done, and the omission is not squeamishness. The engineering is the least interesting part of this and the part with the least policy leverage. What matters is choosing the target, and choosing the target requires no laboratory at all, only a map of warm sheltered places and a list of countries whose doctors have no reason to suspect the disease.
Dryness was never the protection
Target selection here has nothing to do with hostility. The logic selects for absence — for places with no prior exposure to the disease, wherever they happen to fall on anyone’s list of friends and enemies. That is the uncomfortable part. The qualifying characteristics are not weaknesses. Several of them are the marks of a well-run country.
Picture a hot, dry city. Extreme summer heat, almost no standing water in nature, a health system genuinely excellent at the diseases it expects. It has no history of the disease, so its population has no prior immunity and no partial protection from an earlier strain. Its doctors have never seen the illness outside a textbook and will record the first two hundred cases as fever of unknown origin. It has no mosquito control agency, because it never needed one. And it is a city built on water infrastructure: irrigation for landscaping that should not exist, condensation dripping from air conditioners running five months a year, construction water, stored containers, ornamental fountains. The dryness that looks like protection on a climate map is undone by the built environment at the scale of a single apartment block. Cities of this description exist on four continents.
Then pick somewhere cold. Somewhere the phrase “no mosquitoes” appears in the tourist brochures. The same logic runs in reverse: the weather outdoors is hostile and the weather indoors is not. Cellars, barns, geothermal heating pipes, car parks, service tunnels. A city is a lattice of warm, stable hiding places, and no national risk model treats it that way.
The attack, if you can call it that, leaves nothing to trace. No launch, no plume, no seismic signature. A shipping container and a season. The first sign is a cluster of odd fevers in a hospital with no reason to test for what it is looking at. By the time the blood work comes back, the mosquitoes have bred three generations. There is no proportionate response, because there is no identified aggressor and by the time genetic analysis could name one, the population is established and the question is academic.
The strategic payoff is not measured in deaths. It is the permanent conversion of a health system into a chronic-cost system, the repricing of its tourism and its insurance, and the quiet discovery that a country with no mosquito control apparatus needs years and a new agency to build one.
Who do you retaliate against?
Here is the part that should actually worry you.
Every element of that scenario except the intent is already in the record.
Dengue virus has been found in Aedes aegypti mosquitoes in Dubai — a species that, along with locally acquired dengue, had not been reported in the UAE in recent decades, in a Gulf region the mosquito had largely never colonised until urbanisation changed the arithmetic. Local cases followed the heavy rains of April 2024. The UAE’s own Ministry of Climate Change and Environment has named this exact risk, identifying rising temperatures and shifting rainfall as drivers of mosquito-borne disease including dengue. The warning was correct, specific and published. It did not produce a mosquito control agency.
Los Angeles County sustained a seven-week chain of locally acquired dengue in the autumn of 2024, in a state where the mosquito arrived in 2013 and reached more than half of all counties within a decade.
Modelling published in The Lancet Regional Health now projects dengue risk expanding across California as the climate and the landscape change. This July, Aedes aegypti turned up in Vacaville, forty minutes from my desk. The US has passed five hundred dengue cases this year.
Europe’s disease agency has stopped calling this unusual and now describes record chikungunya and West Nile seasons as “the new normal”, with the Asian tiger mosquito established in 369 European regions, up from 114 a decade ago.
And in October 2025, Iceland, one of exactly two places on earth without mosquitoes, recorded its first: a cold-tolerant species that survives winter in sheltered buildings and which entomologists expect to stay.
That same autumn, Britain’s health agency published the first-ever detection of Aedes aegypti eggs in the UK, found in a freight storage facility near Heathrow, alongside tiger mosquito eggs at a motorway service station in Kent. The list of mosquito-free regions on this planet now has one entry, and it is Antarctica.
Nobody engineered any of this. The mosquitoes rode freight, as they have for four centuries. The climate decided whether they stayed.
Which is to say: the adversary in section III is doing, at enormous cost and enormous legal risk, a slightly accelerated version of what the atmosphere is doing for free, continuously, to every country at once, with no attribution problem because there is nobody to attribute it to.
A threat with no department
The engineered-disease scenario deserves to be taken seriously on its own terms. It is also the most useful device available for a much larger argument, because it is the version of the problem national security institutions are structurally capable of hearing. Give a defence ministry a hostile actor and it will find budget. Give it a trend line and it will find a working group.
Climate is the trend line that behaves like a hostile actor.
It is energy security. Whether the grid holds through back-to-back heatwaves, the geopolitics of refined lithium and rare earths, the exposure of any country whose energy transition depends on a single supplier.
It is biosecurity. Mosquitoes moving into new territory, ancient pathogens surfacing from thawing permafrost, livestock disease shifting geography, and more contact between people and wildlife as habitat shrinks, a continuous, unattributable, non-negotiable expansion of the disease surface.
It is financial and insurance security. Insurers withdrawing from California and Florida, mortgage markets that cannot price thirty-year risk on twenty-year assets, government borrowing costs that have already begun to reflect physical exposure, and city budgets resting on actuarial tables that assume the climate stands still.
It is food, water and migration security, and each of those has its own agency, its own budget cycle, and its own reason to believe someone else is handling it.
The failure is architectural. Every one of those propositions is already well documented inside the relevant department; the analysis is not what is missing. Climate is a whole-system input broken up across a dozen institutions that share no clock, no budget line, and no common risk register. Each treats it as someone else’s problem on someone else’s balance sheet, which is a precise description of how a system full of individually competent parts produces collectively stupid behaviour.
A multi-sector climate security strategy is the recognition that a threat arriving simultaneously through energy, disease, capital, food and population cannot be defended against by any institution organized around one of them.
I made a version of this argument in last year, August 2025, in a piece called In Defense of Defense, two months before Iceland recorded its first mosquito. The line I keep returning to:
Imagine the collapse of pollinators, or the hijacking of mosquitoes by deadly disease vectors, not as biodiversity issues, but as catastrophic defense failures.
I wrote that as a provocation then, the record has now made it a description of what is happening.
Four cities, one summer
I have spent this summer across four cities: Toronto, London, Sacramento & Madrid. I have been bitten by mosquitos in all four.
I mention it because I went looking afterwards, and every one of those cities has either mosquito-borne disease circulating this season or an invasive mosquito that was absent a generation ago.
Toronto confirmed its first human West Nile case of the year on 30 July.
Sacramento County confirmed its first in early July, alongside thirty-one dead birds and twenty mosquito samples testing positive.
Madrid, inland, continental, on a plateau 650 metres up, first picked up the tiger mosquito in the late 2010s and has watched it settle in, municipality by municipality, ever since.
And southeast England, Heathrow included, is now a place where the eggs of both invasive Aedes species have turned up in traps.
Four cities, two continents, one indifferent summer and every one of them outside the latitude where any of this was supposed to be my problem. None of these places required an adversary or AI to create this growing health threat.
Author’s note/remark: funnily the biosecurity safeguards in these AI systems triggered when I asked them to review my first draft write-up as they deemed the research & writing warranted a trigger & blocked output!
We love to assign agency and intent, but often the worst events happen when a constellation of human-induced factors comes together at the right moment, the "perfect storm." This essay does a great job of showing how our fears of an AI-written bioweapon are already coming true -- but not because of AI.