Coded Plague: How AI is Rewriting the Rules of Biological Warfare

THE CODE THAT KILLS

“In the past, you needed a nation-state and a fortune to build a bioweapon. Now, you might just need a laptop and the right prompt.”

In March 2022, a group of biosecurity researchers made a quiet but seismic discovery. They had taken an AI model designed for pharmaceutical development—intended to find cures, not killers—and inverted its purpose. In less than six hours, the AI generated 40,000 molecular structures for potential nerve agents. Some were eerily similar to VX, one of the most lethal chemical agents known to man. Others were novel, never-before-seen molecules with catastrophic toxicity profiles. And all of it had been done using off-the-shelf machine learning tools and publicly available datasets. The researchers published their findings in Nature Machine Intelligence, not to incite panic, but to sound the klaxon of a new era: one in which AI is not just a research assistant, but a possible weapon of mass destruction (Urbina et al., 2022).

Welcome to the biotechnological uncanny valley—where machine learning algorithms dream in proteins, and synthetic DNA can be ordered online like groceries.

The raw computational power of modern AI models—especially those trained on genomic and proteomic data—has already upended the life sciences. AlphaFold, a deep learning system developed by DeepMind, cracked the protein-folding problem with stunning accuracy in 2020, solving in months what biology had wrestled with for half a century (Jumper et al., 2021). This isn’t just an academic triumph; it is a functional revolution. Understanding protein structure is a foundational step in engineering biological systems. It is the Rosetta Stone for reprogramming life itself.

By 2023, the next generation of models—such as Meta’s ESMFold—had achieved similar feats with far less computational expense, hinting at a near-future where such capabilities would be accessible not just to Big Science but to small, perhaps unsanctioned, operators (Lin et al., 2023).

What happens when these capabilities are no longer restricted to MIT and Google, but instead reside in the cloud, behind an API, open to anyone with a credit card and a motive?

The answer isn’t speculative—it’s operational. In 2021, researchers demonstrated that GPT-like language models, when fine-tuned on biological datasets (like GenBank or the Viral Pathogen Resource), could produce novel, functional DNA sequences that were indistinguishable from known viral genomes. While the intention was constructive—designing novel vaccines and synthetic immune therapies—the dual-use nature of these tools was unavoidable (Benaich & Hogarth, 2021). The same models that generate life-saving sequences could also be steered to produce biothreats, especially in the hands of rogue states or decentralised biohackers.

And here's the critical problem: many of these tools are released open-source. AlphaFold’s database, for example, includes the structural models of over 200 million proteins—more than any human researcher could ever analyse in a lifetime. Yet, an AI trained on this corpus could, in minutes, generate novel proteins that bind with dangerous affinity to human receptors, evade immune detection, or act as carriers for synthetic viral payloads.

Even OpenAI’s own internal research, leaked in 2024, highlighted concern about GPT models being used to assist in identifying, ordering, and assembling synthetic DNA via mail-order gene synthesis companies. Most of these vendors screen orders—but not all, and oversight varies sharply between jurisdictions (Zhou et al., 2023).

The situation is compounded by the growing normalisation of AI-generated science. In May 2023, a peer-reviewed paper in Science Advances was written almost entirely with the assistance of generative models trained on biomedical literature. The same pipeline that wrote the paper could have, in theory, written the lab protocols to synthesise a novel pathogen. What was once the purview of top-tier virologists can now be mimicked—if not yet perfectly, then increasingly well—by language models trained on PubMed, virology textbooks, and open-access journals.

And while the world obsesses over ChatGPT-generated essays, a quieter transformation is occurring in encrypted forums and semi-private developer communities. There, whisper networks trade fine-tuned models trained on ViPR, PDB, and even real-world lab protocols—tools not for homework, but for genome weaponisation.

The tools are real. The data is public. The risk is compounding.

What once required Cold War-era infrastructure—sealed labs, centrifuges, radioactive isotopes—can now be simulated in silico. AI doesn’t build the virus, but it tells you how. It doesn't release the weapon, but it opens the vault.

The code that kills is not inherently malicious. But it doesn’t have to be. All it takes is a user who is.