GRYPHON SCIENTIFIC

Institutional Archetype

THE RUBRIC WRITER — Gryphon Scientific is the firm that, by its executive chair’s own account, was asked by Anthropic in 2023 to find out whether a frontier model could help someone build a biological weapon, then wrote the tasks and grading rubrics for OpenAI’s uplift study, supplied red-teamers to RAND’s attack-planning study and sold analysis to the UK AI Security Institute. Three public answers came out of that one set of hands. Its own red team found that frontier models gave “useful, accurate and detailed information across every step” of the pathway. OpenAI’s study, built on its tasks, found “at most a mild uplift.” RAND’s study, with 18 of its 45 red teamers from Gryphon, found the existing generation of models “did not measurably change the risk” of an attack. The file is open on the position. In April 2024 the firm’s assets and staff moved into Deloitte Consulting, and the biology work that the labs’ cards now credit to “Deloitte” is the same line of business under a different letterhead. This profile scores the position, not the firm’s people.

Mandate & Origin

Gryphon Scientific, LLC is a Maryland company; the UK procurement notice records it as an SME and as the sole tenderer (Find a Tender 2024/S 000-002214). Deloitte’s April 2024 announcement describes it as “a leader in biosafety, biosecurity, and all-hazards preparedness and response, with experience in using artificial intelligence (AI) to enhance security and safety,” and says “Over the past two decades, Gryphon has supported senior decision makers within government and the commercial sector in evaluating emerging technologies” (Deloitte press release, PR Newswire copy). Rocco Casagrande, PhD, is named there as “Gryphon’s founder and executive chairman,” and signs the December 2023 Senate statement as “Executive Chair of Gryphon Scientific” (Casagrande, written statement).

Its earliest work on the record in this file is government: under NIH Contract HHSN263201500002C, “from March 20, 2015 to December 15, 2015,” with Casagrande as principal investigator and Signature Science and Abt Associates as subcontractors, it produced the Risk and Benefit Analysis of Gain of Function Research (NIH OSP, Draft Final Report). NIH’s preface: “The independent assessment of risks and benefits of GOF research (RBA) was conducted by Gryphon Scientific. This assessment is one of several sources of information that are being used by the NSABB to develop its final recommendations.” The AI work starts in February 2023: “Since February of this year, Gryphon Scientific has been working with the developers of leading (and niche) LLMs to reduce the risks that these models can be misused to cause harm with biology” (Casagrande, written statement).

Funding & Backers

Gryphon was a privately held contractor. No investor, grant, endowment or conflicts-of-interest page of its own is in the record read, and its former domain does not resolve. What the record does show is who paid and who bought.

• UK Department for Science, Innovation and Technology. Contract award notice, 23 January 2024, “Analysis and Research to support the UK AISI’s AI Safety Programmes,” value excluding VAT £267,618.41, awarded “without prior publication of a call for competition,” with the stated reason: “The services can only be supplied by Gryphon Scientific LLC, owing to technical reasons.” “Number of tenders received: 1” (Find a Tender 2024/S 000-002214). A variation notice of 13 March 2024: “This is due to a contract extension of both time and value,” bringing the total to £392,486.78 (£267,618.41 plus £124,868.37) and the expiry to 8 April 2024 (Find a Tender 2024/S 000-007980). See UK AI Security Institute.
• NIH. The 2015 contract above; the preface names the NIH contracting officer and her representative (NIH OSP).
• OpenAI. OpenAI’s study reports that the Gryphon IRB process governed the participants and that Gryphon administered training; the study does not state a fee (OpenAI, early warning system).
• The acquirer. Deloitte Consulting LLP “has acquired substantially all of the assets of Gryphon Scientific, LLC”; the announcement states no price (Deloitte press release, PR Newswire copy).

Institutional Voice & Intent

Casagrande’s December 2023 statement to the Senate AI Insight Forum is the firm’s fullest public account of its AI work. On the red team: “The LLM developer Anthropic originally approached us to red-team the models.” “We found that frontier LLMs can provide information that could aid a malicious actor in creating a biological weapon by providing useful, accurate and detailed information across every step in this pathway.” On timing: “Had we performed our study last year, we probably would have concluded that the risk was low because the LLMs do not understand scientific concepts.” On the limits of its own study: “that study alone does not determine if that knowledge is enabling by itself.” On the RAND study done with his team: “groups armed with an LLM could plan the operational aspects of a biological attack significantly better than those who couldn’t access an LLM, but the scientific aspects of the plan were not significantly different.” On its clients: “I personally have been cheered by how much attention the leading AI companies are paying to this issue and am glad they have engaged us to lend our expertise in biosecurity” (Casagrande, written statement).

Stated intent: “to reduce the risks that these models can be misused to cause harm with biology,” through red-teaming, “evaluations for ongoing testing,” “controlled experiments” and “biosecurity policies for LLMs.”

Observed intent: Be the specialist team behind the tasks and rubrics that labs use to measure biological uplift. Anthropic’s 2023 post links its biosecurity experts to Gryphon’s site; OpenAI’s study and its GPT-4o card credit Gryphon for the tasks and rubrics; RAND thanks “18 from Gryphon Scientific” as red teamers; the UK bought work from it without a competition.

Gap: The same firm’s staff produced the red-team result that models help at every step, designed the OpenAI uplift tasks that found a mild effect, and made up 18 of the 45 red teamers in the RAND study that found no measurable change, and the three outputs carry different headlines. The statement itself explains the spread: different designs, “preliminary” numbers, and a note that “since many of the researchers were unfamiliar with LLMs, they may not have been prompting the LLMs most effectively.” The record does not show whether the spread tracks the clients. For the supplier of the instrument, it does not need to.

Interest: Gryphon argued for practices in Casagrande’s signed statement. What adoption would pay it is set out from its own record.

• Larger empirical uplift experiments. Position: “A major shortcoming of our work so far is that, to date, no sufficiently large, empirical comparisons have been done to rigorously identify how much LLMs could aid a malicious actor in the misuse of biology” (Casagrande, written statement). What it pays: controlled uplift experiments are the product Gryphon had delivered, to OpenAI (tasks, rubrics, graders, training, IRB) and to RAND (18 red teamers and design collaborators), and the UK notice records a sole-source award for “Analysis and Research” for the institute’s safety programmes. Best case, Casagrande’s: such experiments “would definitively determine if these AI tools lower barriers to the misuse of biology more than conventional information technologies.” Convergence: OpenAI published the design as a “blueprint,” and RAND ran the other study.
• Standing evaluations for developers. Position: evaluations to “continually test the ability of LLMs to provide information that could aid an adversary,” as “a tool set that LLM developers can use to ensure that safer models are developed and that unsafe models do not reach the public.” What it pays: a standing evaluation is a recurring service; Deloitte’s announcement says the acquired team will be “catalyzing the growth of Deloitte’s biosecurity, lab safety, data science, and global and domestic emergency preparedness and response capabilities,” Anthropic’s Claude Opus 4.6 card says “The trial and rubric were designed by Deloitte Consulting,” and its Opus 4 card has Deloitte staff running red-team and knowledge sets (Anthropic, Claude Opus 4.6; Anthropic, Claude Opus 4 and Sonnet 4). Best case, Casagrande’s: “concerted action now could ensure that safety is built into the most capable systems in the future, before they can truly aid an adversary to create great harm with biology.” Convergence: SecureBio and Signature Science are named beside Deloitte on the same cards.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

• For Anthropic, 2023. Anthropic’s 26 July 2023 post: “Over the past six months, we spent more than 150 hours with top biosecurity experts red teaming and evaluating our model’s ability to output harmful biological information, such as designing and acquiring biological weapons.” The phrase “top biosecurity experts” is a link to gryphonscientific.com, and the post’s other link on the subject (“experts”) goes to the same address (Anthropic, Frontier threats red teaming for AI safety). Casagrande’s statement says Anthropic approached the firm and that Gryphon later convened “a series of workshops with more than 20 experts in biosecurity” to map misuse scenarios for it. See Anthropic.
• For OpenAI, 2024. OpenAI’s 31 January 2024 study: “Biosecurity specialists at Gryphon Scientific developed five research tasks corresponding to the five stages of biological threat creation.” Grading: “Gryphon Scientific designed objective grading rubrics based on gold-standard performance of the tasks.” Participants: “All participants provided informed consent as part of the Gryphon Scientific IRB process.” Result: “GPT-4 provides at most a mild uplift in biological threat creation accuracy” (OpenAI, early warning system). The GPT-4o system card carries the same arrangement into a release document: “We designed the questions and detailed rubrics with Gryphon Scientific due to their expertise working with dangerous biological agents in a national security setting,” and rates the model Low for biological threats (OpenAI, GPT-4o system card). The card’s footnote for Gryphon is Deloitte’s acquisition announcement. See OpenAI.
• For RAND, January 2024. RAND’s red-team study of AI in biological attack planning: “The findings indicate that using the existing generation of large language models did not measurably change the risk of such an attack” (RAND, RR-A2977-2). Its acknowledgments: “We extend our gratitude to the 45 researchers who served as expert red teamers for this study, including 27 researchers from RAND and 18 from Gryphon Scientific,” and “Individuals at Gryphon Scientific were also invaluable collaborators in the design and execution of this research” (RAND, report PDF); two of the eight adjudicators are listed as “affiliated with Gryphon Scientific.” See RAND.
• For the UK, January to April 2024. The sole-source award and its extension, above. The same January 2024 batch of institute purchases includes Trail of Bits, Pattern Labs (now Irregular) and Gray Swan; see Who funds the evaluators.
• After April 2024, under Deloitte’s name. Anthropic’s Claude Opus 4 card (May 2025): “Staff from Deloitte with extensive biosecurity experience engaged in extended conversations with Claude,” and “This dataset comprises 33 questions developed by staff at Deloitte with experience in biosecurity” (Anthropic, Claude Opus 4 and Sonnet 4). Its Opus 4.6 card: “The trial and rubric were designed by Deloitte Consulting” (Anthropic, Claude Opus 4.6). Its Opus 5 card (24 July 2026): “task-based agentic evaluations developed with SecureBio, Deloitte, and Signature Science” (Anthropic, Claude Opus 5). Casagrande is listed in 2026 as “Managing Director for Deloitte Consulting” (Georgetown JNSLP, symposium speakers).
• The 2015 NIH assessment. The gain-of-function risk and benefit analysis described under Mandate & Origin, one input to the NSABB’s recommendations on federal funding of such studies (NIH OSP).

Actions & Leadership Choices

CONDUCT: PRIVATE BIORISK RED TEAM. No wrongdoing is alleged. The structural point is that a firm small enough for one executive chair to sign its Senate statement held the instrument-making role in three public measurements of the same question, by three different institutions, and the numbers diverge. The firm says why in its own statement, and the statement is the record to read.

• March to December 2015. Wrote the NIH gain-of-function Risk and Benefit Analysis (NIH OSP).
• February to July 2023. Red-teamed Anthropic’s model for biological risk; Anthropic’s post of 26 July 2023 reports the work (Anthropic; Casagrande, written statement).
• 6 December 2023. Casagrande’s written statement to the Senate AI Insight Forum on risk, alignment and “Guarding Against Doomsday Scenarios” (Casagrande, written statement).
• 23 January 2024. Sole-source UK award, £267,618.41; varied on 13 March 2024 to £392,486.78 (Find a Tender; variation).
• 25 and 31 January 2024. RAND’s red-team study and OpenAI’s early-warning study, both built with Gryphon staff (RAND; OpenAI).
• April 2024. Deloitte Consulting acquires substantially all of the firm’s assets; its team joins Deloitte, whose federal health practice leader is quoted in the release, and the release names the “Federal Health AI Accelerator at Deloitte” (Deloitte press release, PR Newswire copy).

Alliance Map

Where ties on different axes run at the same time, the overlap is the finding. In January 2024 the same firm was a UK government supplier by sole-source award, the task and rubric designer for OpenAI’s uplift study, a source of red teamers for RAND’s study and, per its executive chair, an Anthropic red-team contractor, and three months later it was a Deloitte practice. The labs’ later cards name the acquirer. The documents show a small specialist firm whose measurements sit under several institutions’ conclusions at once, not coordination.

Reach Assessment

Institutional: Its measurements are cited inside three institutions’ conclusions: OpenAI’s GPT-4o card, RAND’s study and NIH’s gain-of-function review, and the UK institute bought its work. Memetic: “At most a mild uplift” is the line that travelled from the OpenAI study, and it was built on Gryphon’s tasks; RAND’s “did not measurably change the risk” carries 18 Gryphon red teamers in its acknowledgments. Civilizational: Anthropic’s 2023 post says such risks “may be actualized in the next two to three years, rather than five or more,” on work its post attributes to “top biosecurity experts,” whom it links to Gryphon’s site. Gryphon held a measurement position inside lab and government processes with no statute behind it and has since been absorbed by a consulting practice.

Score basis. Atk 5 is reach: OpenAI’s GPT-4o card says its biological questions and rubrics were designed with Gryphon, the OpenAI study ran on Gryphon’s tasks, Anthropic’s 2023 post links its experts to Gryphon’s site, and the UK bought its work (OpenAI, GPT-4o system card; OpenAI, early warning system; Anthropic; Find a Tender). The points under a higher number are that none of the Anthropic cards read from 2025 and 2026 names Gryphon and that no statute obliges anyone to ask. Peers: Dreadnode (atk 5) is named by no lab release document either, and SecureBio holds 7 because four labs name it today. Def 4 is funding insulation: income from a sole-source UK award, an NIH contract and the labs it tested, no published investors or conflicts policy, and an owner that is a consulting firm; peers are Dreadnode (5), which names its investors, and Irregular and Gray Swan (6 each), which disclose investors and customers (Find a Tender; Deloitte press release, PR Newswire copy). Hp 3 is entrenchment: the NIH analysis and OpenAI’s published design persist, but the firm sold substantially all of its assets and no program of record depends on it (NIH OSP). Peer: Dreadnode (hp 4). Hazard 40 is close to (5+4+3) x 10/3.

Sources: Find a Tender 2024/S 000-002214; Find a Tender 2024/S 000-007980; Casagrande — written statement, AI Insight Forum, 6 December 2023; OpenAI — Building an early warning system for LLM-aided biological threat creation; OpenAI — GPT-4o System Card; Anthropic — Frontier threats red teaming for AI safety; Anthropic — Claude Opus 4 and Claude Sonnet 4 system card; Anthropic — Claude Opus 4.6 system card; Anthropic — Claude Opus 5 system card; RAND — The Operational Risks of AI in Large-Scale Biological Attacks; RAND — report PDF; NIH OSP — Risk and Benefit Analysis of Gain of Function Research, Draft Final Report; Deloitte — acquisition announcement, PR Newswire copy; Georgetown JNSLP symposium.