In October 1979, a top-secret CIA intelligence report featured the first inklings in the West that something unusual and disturbing had allegedly taken place in the Soviet Union several months earlier.
In April of that year, patients started appearing at hospitals in the industrial city of Sverdlovsk, now known as Yekaterinburg, in the Ural region of the Soviet Union. They were showing symptoms of what doctors first thought to be an unusually virulent and deadly form of pneumonia. It wasn’t.
The outbreak that ultimately killed more than 60 people was in fact caused by anthrax spores that had been accidentally released from a Soviet biological weapons facility. How exactly this happened is still unknown.
Officially, neither the facility nor the Soviet bioweapons program was supposed to exist; a few years earlier, Moscow, along with Washington, had ratified a landmark international treaty prohibiting biowarfare work. When US officials publicly raised questions about the incident at Sverdlovsk, the Soviet government denied any biological weapons research was taking place, blaming the outbreak on contaminated meat. It wasn’t until 1992, after the fall of the Soviet Union, that Russian President Boris Yeltsin acknowledged that the incident was the result of a covert bioweapons program.
How is it possible that a bioweapons accident that killed dozens was kept secret for decades, even in the Soviet Union? As the Washington Post reporter David E. Hoffman writes in The Dead Hand, his history of the Cold War arms race, the answer lay in the nature of the weapons themselves: “Biological weapons were the ultimate challenge for spies, soldiers and scientists.”
Unlike a missile silo, easily distinguishable from the air, a laboratory where bioweapons are being developed doesn’t look that different from a benign medical laboratory. Unlike nuclear warheads, which leave clear radiological traces in their silos and are unmistakable in their use, a weaponized pathogen and the outbreak it would cause could be difficult to discern from a naturally occurring one, giving any attacker plausible deniability.
The mystery surrounding these weapons is just as much a problem today as it was during the Cold War. Putting aside the still politically fraught question of whether Covid-19 escaped from a Chinese lab or, like most outbreaks, jumped from animals to humans naturally, the bigger problem is the simple fact that we may never know for certain.
“What the pandemic tells us is that nobody can do attribution,” said Drew Endy, professor of biological engineering at Stanford. Intelligence agencies have determined that Covid was not a deliberately engineered bioweapon, but the confusion about its origins does suggest that if an even more virulent, intentionally designed pathogen were to be unleashed, it might be very difficult to say for certain who was behind the attack, or even whether it was an attack at all.
This kind of plausible deniability could make using such a weapon more attractive to attackers. Biowarfare is only set to become a bigger threat in the coming years if, as many experts predict, artificial intelligence makes it easier, cheaper, and faster to develop new biological compounds, including weaponized pathogens far more sophisticated and deadly than the anthrax that killed dozens in Sverdlovsk 46 years ago. That’s why Endy, a pioneer in the field of synthetic biology — the construction of new biological systems or deliberate alteration of existing ones through genetic manipulation — argues that new forms of detection are desperately needed for this new threat landscape.
“When the Iron Curtain came down, we found it useful to have geospatial intelligence to see what was happening on the other side regarding nuclear weapons,” he told Vox. “Today, there’s a molecular curtain. The stuff that’s invisible, that we can’t see, is all around us and could be harmful. And we don’t really do that kind of intelligence.”
The technologies that could allow adversaries to create ever more dangerous bioweapons are advancing at a much faster clip than defensive measures. But at the moment when AI might be amplifying the risks of this type of weapon, it may also be emerging as the key for detecting and stopping them.
Germ war is nothing new, but the threat is changing
Biological warfare dates back at least as far as the 14th century BC, far before anyone knew that germs caused disease, when the Hittites sent diseased rams to their enemies to infect them with the dangerous bacterial infection tularemia. Every major combatant in World War II had a biological weapons research program — including the US — and Japan even deliberately unleashed germs in China.
Fear over the use of biological weapons eventually led to the ratification of the Biological Weapons Convention (BWC) in 1975, banning the use and development of bioweapons globally — though the Soviet program continued in secret for years later, despite Moscow having signed onto the treaty. But even more than the treaty, biowarfare has been held back by the fact that biological weapons have been difficult to develop, deploy, and — should they be used — control. But that may be changing.
New gene editing tools like CRISPR have brought down the cost and difficulty of tinkering with DNA. But the same kind of tools also can make it easier for malign actors to create designer diseases for use in warfare or terrorism.
AI is already revolutionizing the field of synthetic biology: The 2024 Nobel Prize in chemistry was awarded to researchers who used AI to predict and design new proteins. This is likely to have positive effects, like dramatically accelerating drug development.
But, says Matt McKnight, head of biosecurity at the synthetic biology company Ginkgo Bioworks, past periods of rapid scientific advancement, from chemicals in the early 1900s (poison gas), to physics in the 1930s (nuclear weapons), to computer science in the later 20th century (cyber offensives), suggest that the new confluence of AI and gene editing is almost certain to be put to violent ends.
“My assumption is that bioweapons will be used by a bad actor in this century because that would be the baseline expectation given all of human actions throughout history,” McKnight said. “And I want to reduce the likelihood that that happens.”
A recent report from the Center for a New American Security (CNAS) suggested several worrying scenarios for how AI could be used to optimize pathogens for warfare. Entirely new viruses could be designed, or modifications could be made to existing viruses to make them more resistant to existing treatments.
Kevin Esvelt, a synthetic biology researcher and director of the Sculpting Evolution group at MIT, said one of his greatest concerns was that large language models could facilitate “not just the replication of an existing natural pathogen, but building something entirely new that doesn’t occur in nature.” This means that both our natural immunological defenses and existing vaccines would be entirely unprepared for it.
How bad could it be? Mustafa Suleyman, the CEO of Microsoft AI, has warned that the combination of AI and synthetic biology could allow the creation of a pathogen with the death rate of Ebola but the transmissibility of seasonal flu, causing “more than a billion deaths in a matter of months.”
This wouldn’t be a very practical weapon for anyone but a doomsday cult. But AI-enhanced engineering could also allow for viruses to be made more controllable by adapting them to only work in particular locations. More disturbingly, viruses could be tailored to attack particular populations. The CNAS report quotes Zhang Shibo, former president of China’s National Defense University and a one-time general in the Chinese military, who has speculated that new technology would allow for the development of diseases for “specific ethnic genetic attacks.”
Beyond these nightmare scenarios, AI may simply make it easier to produce existing dangerous viruses. In a 2023 experiment, a group of students at MIT used commercially available AI chatbots to generate suggestions for assembling several deadly viruses — including smallpox, which currently exists only in ultra-secure labs in the US and Russia — from their genetic material. The chatbots also suggested the supplies needed and listed several companies and labs that might print the genetic material without screening.
Concerns about scenarios like these have prompted some AI companies to incorporate new safeguards into their models — though the intense commercial and geopolitical competition to reach artificial general intelligence may erode those safeguards over time.
These advances don’t mean just anyone can grow their own smallpox today. The technical obstacles to actually constructing a disease are still formidable, even if you have the instruction manual and a very patient AI to walk you through it. But it suggests the barriers to entry are coming down.
In the past, nonstate actors like ISIS or the Japanese cult Aum Shinrikyo, responsible for the 1995 sarin gas attack on the Tokyo subway, have tried to acquire biological weapons, but inevitably hit up against talent and supply limits. But advances in both AI and synthetic biology means actors with limited means will now have more tools at their disposal.
As a method of warfare, synthetic biology “just seems to favor offense,” said Esvelt, who led the MIT experiment on the use of chatbots in virus design. “There’s just a lot of ways you can attack, and it’s much cheaper to build a virus than it is to develop and distribute a vaccine.”
That’s why defense needs to start catching up to offense. When it comes to the risk of this technology being misused, Ginkgo’s McKnight argues, “You can’t regulate your way out of it. You have to be better at it. You have to be as good as the adversaries at making countermeasures.” His company is working to build one.
Peeking behind the molecular curtain
One vision of what the future of biowarfare defense might look like can be found in a tucked-away corner of a busy, sprawling lab overlooking Boston Harbor. That’s where Ginkgo Bioworks is based, and where the company, founded by former MIT scientists in 2008, designs custom microorganisms for industrial use.
Through that work, Ginkgo has developed advanced testing capability to determine whether the microscopic organisms they built work as intended. During Covid, Ginkgo’s “foundry,” as it refers to its main lab, was pressed into service processing nasal swabs and surveilling wastewater to help governments monitor community-level spread of the coronavirus and the emergence of new variants.
That work has evolved into an ongoing monitoring operation at eight international airports in the US, as well as airports in the Middle East and Africa, for evidence of potentially dangerous pathogens crossing international borders. Nasal swabs from arriving passenger volunteers as well as wastewater samples are collected from planes and sent to Ginkgo for analysis. That means the next time you use the airplane lavatory, you may be contributing to a vast database of the genetic material moving around the world
During a recent visit to Ginkgo’s foundry, I was shown a rack of thermocyclers — each resembling oversized George Foreman grills — where these wastewater samples were being subjected to a process known as polymerase chain reaction. (That’s the “PCR” that was in PCR tests during the pandemic.) The process involves heating and cooling DNA samples in order to replicate them for analysis, allowing scientists to identify genetic abnormalities that would otherwise be difficult to detect. This process can track how certain pathogens — Covid or the flu, for instance — are migrating around the world, and how they are evolving, which can help guide any public health response.
Such work would be important enough given the documented rise in naturally emerging new pathogens. But Ginkgo is no longer only looking at biological threats that emerge from nature. With the support of the Intelligence Advanced Research Projects Activity (IARPA), the US intelligence community’s research arm, Ginkgo has developed a tool known as ENDAR, or engineered nucleotide detection and ranking, which is specifically designed to detect artificially engineered genetic material.
This is where AI comes in. Through its cell engineering business, Ginkgo has accumulated a vast library of engineered genomes. “We engineer microbes all day, every day. And we actually use [tools] to validate that our engineering worked,” said Casandra Philipson, director of bioinformatics at Ginkgo. Just as AI tools like ChatGPT train on vast amounts of written material or images to be able to answer user prompts with uncanny accuracy, ENDAR was trained on a vast library of engineered genomes. This enables ENDAR to detect when something doesn’t look quite right.
“You can get really specific and start looking at what’s called the base pair, like very specifically every ATCG,” said Philipson, referring to the basic nucleotides that bond together to form DNA. These structures tend to evolve in predictable patterns, and the system can detect anomalies. “You can actually calculate a molecular clock and say, ‘Does its ancestry match what we would expect, given the evolutionary history?’” If it doesn’t, this could be a sign that genetic engineering has taken place.
If so, this could go a long way toward addressing the attribution problem Endy referred to. If a new virus as bad or even worse than Covid emerges, we should have a pretty good idea if it was designed that way. That can help policymakers plan a public health response, and if necessary, a political or military one.
Why we need a better bioradar
Given that its purpose is making synthetic biology easier and cheaper at scale, one could argue that Ginkgo is itself part of the problem, simply by producing the kind of tools that could, say, make designer smallpox more feasible. Still, that dichotomy is one Ginkgo appears to embrace — the foundry is decorated with Jurassic Park memorabilia, a reminder of the potential, and perhaps also the risks, of the kind of DNA tinkering the company is engaged in. (One wonders what Professor Ian Malcolm would make of the company’s confidence.)
The government has tried to reduce those risks — former President Joe Biden’s executive order on artificial intelligence in 2023 included restrictions on the purchases of synthetic DNA. But Ginkgo’s McKnight argues that given the speed of biotech innovation in multiple countries, and the benefits it can bring, “there’s no choice you can make to clamp down on all the technology.”
When it comes to the risk of this technology being misused, he says, “You can’t regulate your way out of it. You have to be better at it. You have to be as good as the adversaries at making countermeasures.”
The State Department has assessed that Russia and North Korea both maintain active offensive biological weapons programs, even though both countries have signed on to the Biological Weapons Convention. But the bigger concern, given its increasingly dominant position in global biotech innovation, heavy investments in frontier AI, and its scientists’ often controversial approach to genetic research, is China.
When it comes to China, the State Department assesses more vaguely that the country has “continued to engage in biological activities with potential [bioweapon] applications” and has failed to supply sufficient information on a “diverse families of potent toxins with dual-use applications.” The writings of a number of prominent defense scholars in China, including a textbook published by the People’s Liberation Army, have identified biotechnology as a “new domain of warfare.”
Fighting an infopandemic amid a real one
McKnight believes the main takeaway from the experience of the Covid pandemic was that “America is not a biosecure nation today.” And as bad as Covid was, what’s coming could be far worse.
Covid, he said, cost the US economy trillions of dollars and “was probably the biggest factor in creating the chaos we’re seeing in our political system. [But] it wasn’t really even that bad compared to some of the potential things that are out there.”
Esvelt believes that the pandemic showed the importance of stockpiling preventive equipment like respirators, likely to be a far more effective first line of defense than vaccines — and that it should be viewed as a military priority as well as a public health one. “We’re going to lose a hot war in which our civilian support personnel are taken out by a pandemic and the adversaries are not,” he said.
AI could come into play here in a different way. We’re already seeing generative AI’s potential as a tool for creating and spreading misinformation as effectively as a virus. Epidemiologist Jay Varma recently warned of the risk of “a rogue actor using existing AI tools to simulate a bioterrorism attack that would destabilize a region or the world.” For example, Varma imagines a scenario in which an extremist group uses faked evidence of a biological attack, spread on social media, to foment a security crisis between nuclear rivals China and India.
Even without AI, rumors and misinformation ran rampant in the pandemic, eroding public trust in vaccines. And despite the intelligence community’s assessment that Covid was not a deliberate bioweapon, some politicians have continued to insinuate that it was. (The uncertainty around this is probably not helped by the ongoing confusion over whether Covid was inadvertently released from a lab doing benign research, which several intelligence agencies consider a real possibility.)
Likewise, the Russian government has spread unsubstantiated rumors that Ukraine is running labs where bioweapons are being developed with the support of the US government, a campaign that was picked up and spread by prominent US media figures, including Tucker Carlson.
All this suggests that determining a bioweapons attack is not taking place during an outbreak may be just as important an application for Gingko’s ENDAR technology as determining one is.
Despite the increasing attention being devoted to biosecurity at the government level, there’s also reason to be concerned about whether the US is moving toward becoming a more biosecure nation. The Trump administration recently canceled a $12 million grant to Harvard University for biosecurity research, despite the warnings of Pentagon officials that this would pose national security risks.
Data as disinfectant
As Hoffman writes in The Dead Hand, many of the leading Soviet biologists who worked on the country’s bioweapons program did so under the sincere impression that their counterparts in the US were doing exactly the same thing. Once the Cold War ended, they were stunned to learn that the Americans had halted their offensive program decades before. But that only shows how the distrust and competition of an arms race can obscure reality.
With the rapid pace of advances of both synthetic biology and AI today, Endy worries about a new arms race mentality taking hold. Whereas nuclear competition has, since the dawn of the Cold War, been governed by the logic of mutually assured destruction (MAD), he worries that the dynamic of biosecurity will be governed by what he calls SAD — stupidly assured destruction.
“It’s really important to be thoughtful and cautious about accusations,” he says. “If we’re not careful about how we are framing and talking about weapons programs, we get this type of geopolitical autoimmune response that leads to some really bad policy outcomes. We don’t want to go down the deterrence path” — in other words, deterring an enemy from unleashing bioweapons by having more powerful ones of our own. Instead, Endy said, “we want to go down the resilience path” — building societal defenses from biological threats, natural or artificial.
The first step of building those defenses is knowing exactly what threats are out there.
The post Will we know if the next plague is human-made? appeared first on Vox.
