AI's Capabilities and Threats in Biosecurity: A 2026 Review

A review arrives at the digital-to-physical frontier

The working headline is the story: AI's Capabilities and Threats in Biosecurity: A 2026 Review. The review published on September 14, 2026, argues that artificial intelligence is reshaping biological research across a connected “digital-to-physical workflow,” where information retrieval, design, planning, synthesis, testing and possible scale-up can increasingly be supported by software systems [1]. Its central point is not that AI alone makes biological misuse easy. Instead, it treats risk as a function of capability, user intent, user expertise, access to biological materials, access to instruments and the safeguards wrapped around each step [1].

That distinction matters. Public debate often compresses AI-biosecurity risk into a single question: can a model tell someone how to make a pathogen? The review takes a more sober approach. It separates digital help from physical execution, arguing that current evidence shows “AI uplift” mainly in digital tasks, while controlled wet-laboratory studies still find substantial barriers in tacit knowledge and hands-on execution [1]. In other words, an answer generated on a screen is not the same as a reliable biological process in the real world.

The timing is notable because the paper appeared alongside fresh work on AI governance gaps and scientific agents. A separate September 14, 2026, study of U.S. federal AI governance documents found that coverage varies across risks and sectors, with robustness, system security and governance receiving more attention than some emerging risks such as multi-agent risks [2]. Another paper submitted the same day describes frontier-style scientific agents that alternate between exploration, execution and reassessment, underscoring why biosecurity can no longer be treated as only a laboratory compliance problem [3].

What the review says AI can do

The review’s taxonomy starts with general-purpose large language models. These systems can retrieve and integrate scientific information, assist experimental planning and support computational analysis [1]. In benign research, that is a major productivity gain: junior researchers can search literature faster, compare methods, draft code and organize experimental options. In security terms, however, the same abilities can reduce friction for early-stage scoping, troubleshooting and the assembly of fragmented knowledge.

The second category is biological foundation models. These models can predict, optimize and generate proteins, genes and genome-scale sequences [1]. That capability can accelerate vaccine design, enzyme engineering, therapeutics discovery and public-health preparedness. But it also shifts biosecurity attention from text outputs to design outputs. A safety filter on a chatbot is not enough if specialized biological models can propose molecular designs that then travel into synthesis or testing pipelines.

The third category is agentic systems. The review describes agents as systems that can coordinate multistep research tasks [1]. That is crucial because the riskiest workflows are not one-shot prompts. They involve search, planning, tool use, iteration, comparison of results and adjustment after failure. The parallel paper on scientific judgment emphasizes that long-horizon discovery requires alternating between exploration, disciplined execution and critical reassessment as evidence changes [3]. In biosecurity, that same structure can be beneficial for safer research, but it also explains why governance must look at the whole task loop rather than only the final answer.

The fourth category is automated laboratories. The review says automated labs can partially close the design-build-test-learn cycle [1]. This is where the digital-to-physical boundary becomes most concrete. A design that remains inside a simulation has one risk profile; a design routed into synthesis, robotic handling and iterative testing has another. The review’s emphasis on workflows therefore pushes the field away from model-only safety and toward system safety.

Threat pathways, not single failure points

A key contribution of the review is its pathway view. It maps AI-enabled biological threats from information gathering and biological design to procurement, synthesis, testing, scale-up and potential release [1]. The value of that structure is that it highlights where different controls belong. A literature-search assistant, a protein-design model, a DNA synthesis provider, a cloud lab, a shipping intermediary and a biosafety officer do not face the same decisions. Yet their decisions can be connected in a single risk chain.

This chain perspective also reduces exaggeration. If AI helps someone identify a concept or generate a candidate design, that is not automatically equivalent to a deployable biological threat. The review explicitly notes that tacit knowledge and physical execution remain meaningful barriers in wet-lab contexts [1]. But the reverse is also true: dismissing AI because the lab is hard misses the possibility that repeated assistance across many small steps may lower the total barrier over time.

The most practical reading is that AI changes the distribution of effort. It can compress literature review, expand design exploration, make troubleshooting more interactive and coordinate tasks that once required several specialized people. Those benefits are exactly why scientists will keep adopting these systems. They are also why biosecurity must be built into normal research infrastructure rather than bolted on only when a model crosses a headline-grabbing threshold.

Why standard AI alignment may not transfer

The review raises an important warning: alignment techniques for general-purpose models may transfer poorly to biological AI systems [1]. This is intuitive but often overlooked. A conversational model can be trained to refuse certain instructions in natural language. A biological model may not be producing instructions at all; it may be producing sequences, structures, scores or candidate designs. Harm may be embedded in a technical output whose risk is not obvious from plain text.

That means biosecurity evaluation must include domain-specific interpretation. A refusal policy cannot replace sequence screening, provenance checks, access controls, audit logs and expert review. Nor can it answer whether a hazardous capability has actually been removed from a model or merely hidden from casual prompting. The review therefore highlights interpretability as an emerging tool for auditing whether dangerous capabilities are genuinely removed [1].

The agentic dimension compounds the problem. When systems use tools, memory and intermediate planning, a safe final response may not prove that the process was safe. The September 14 work on scientific agents is not a biosecurity paper, but it shows how frontier-style systems can be designed around process-level control of exploration, procedural convergence and reassessment [3]. Applied to biosecurity, the lesson is that oversight must inspect intermediate actions, tool calls and handoffs, not just polished final outputs.

Defense in depth as the governance model

The review argues for “defense-in-depth governance” that links capability thresholds to proportionate responsibilities across the biological AI ecosystem [1]. This is the article’s most policy-relevant claim. Defense in depth means no single safeguard is expected to carry the whole burden. Model developers test and restrict high-risk capabilities; biological-model providers document training data and outputs; synthesis firms screen orders; cloud labs verify customers and experiments; institutions train personnel; funders and regulators set expectations; auditors check whether controls actually work.

The governance-mapping paper published the same day helps explain why such layering is necessary. It assessed 684 U.S. federal AI governance documents across 14 sectors and 24 AI risks, finding uneven coverage and surfacing potential gaps between governance attention and expert-assessed vulnerability [2]. For AI biosecurity, that suggests a risk: agencies and institutions may have documents that mention AI, cybersecurity, research integrity or biotechnology, but still lack a joined-up framework for digital-to-physical biological workflows.

Proportionality is equally important. If rules are too broad, they can chill beneficial research in medicine, public health and biotechnology, which the review explicitly recognizes as major potential beneficiaries of AI [1]. If rules are too narrow, they miss the connected nature of the workflow. The hard policy task is to identify thresholds that trigger additional duties without treating every low-risk biological query as a security incident.

What responsible adoption should look like

A responsible 2026 biosecurity posture should begin by mapping workflows. Institutions need to know where AI enters literature review, experimental design, coding, sequence generation, procurement, automation and reporting. The review’s pathway model makes clear that security teams should not ask only “which model are we using?” They should ask what the model is connected to, what outputs it can generate, who can act on those outputs and what physical systems sit downstream [1].

Second, organizations should separate assistive use from autonomous action. An LLM that helps a trained scientist summarize literature is different from an agent that can select tools, place requests, trigger robotic experimentation or iterate designs. The scientific-agent work submitted on September 14 shows why long-horizon systems are powerful: they can sustain exploration, prune options and synthesize evidence over time [3]. In biosecurity, those capabilities should come with stronger logging, approval gates and human accountability.

Third, evaluation should cover both misuse and accident pathways. The review focuses on threats, but its workflow lens also applies to errors: hallucinated assumptions, invalid biological designs, contaminated data, automation mistakes and overconfident recommendations. A system that accelerates science can accelerate mistakes unless governance includes validation and rollback.

Finally, biosecurity should be framed as enabling trust, not blocking science. The review’s balanced position is that AI can greatly benefit medicine, public health and biotechnology, while high-consequence risk requires controls that follow the workflow from digital design to physical execution [1]. That is the mature message for 2026. The question is not whether AI belongs in biology; it already does. The question is whether the institutions around it can become as integrated as the tools themselves.

The bottom line

The 2026 review’s lasting value is its refusal to choose between hype and complacency. It does not claim that AI has erased all practical barriers to biological misuse. It also does not pretend that safety filters on chatbots are enough. By organizing the issue around capabilities, threat pathways and defense-in-depth governance, it gives policymakers, labs and AI developers a shared map of the terrain [1].

The current state of the subject is therefore clear: AI biosecurity is becoming a systems-governance problem. The dangerous frontier is not a single model answering a single question. It is the connection of models, agents, biological design tools, procurement channels, automated labs and human decisions. The opportunity is to use that same systems view defensively—layering controls, audits and accountability before digital biological workflows become too fast and too automated for legacy governance to follow.

Sources from the last 72 hours

1. [1]Artificial intelligence and biosecurity: capabilities, threat pathways, and defense-in-depth governanceSep 14, 2026, 6:44 PM UTC
2. [2]Mapping U.S. Federal AI Governance Against Sector VulnerabilitySep 14, 2026, 7:23 PM UTC
3. [3]Metacognitive Steering: Learning the Structure of Scientific JudgmentSep 14, 2026, 7:10 PM UTC

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.