Research: AI and Bioweapons Uplift — From 'No Meaningful Help' (2024) to 'We Can No Longer Rule It Out' (2025-26)
In January 2024 RAND found no statistically significant uplift from language models in planning a biological attack. Sixteen months later the same institution found frontier models beating experts on lab-protocol benchmarks, and Anthropic locked down its own model because it could no longer rule out uplift. By 2026 the labs' early-warning tests are saturated. The record, with the counterweight.
Contents
Companion pages: MIRI and the Off-Switch Problem and Watching the Watchers (the evaluators).
The question is whether AI models give meaningful “uplift” to someone trying to build a biological weapon. The record has a shape: a reassuring study that was right when it was run, and then a curve that kept moving. Laboratory self-evaluations are labelled as what they are: a lab grading its own model, though in this case the grade is an admission against interest.
2024: no meaningful uplift
RAND put three-person teams through a red-team exercise of drafting operational plans for a biological attack, some with language-model access and some with the internet alone. Its finding: “biological weapon attack planning currently lies beyond the capability frontier of LLMs as assistive tools. The authors found no statistically significant difference in the viability of plans generated with or without LLM assistance” (RAND, The Operational Risks of AI in Large-Scale Biological Attacks, January 2024).
2025: the threshold crossed
RAND’s follow-on tested the most capable models against eight biology knowledge benchmarks: “Frontier large language models (LLMs), led by reasoning models, are exceeding expert human performance on biology laboratory protocol and graduate-level question-answering benchmarks. All but three models that the authors tested surpassed nonexperts on a graduate-level biology benchmark,” and many public benchmarks are “at or approaching saturation” (RAND, Toward Comprehensive Benchmarking of the Biological Knowledge of Frontier LLMs; RAND perspective, Contemporary Foundation AI Models Increase Biological Weapons Risk).
The same month, a lab said so about its own product. On May 22, 2025 Anthropic activated its AI Safety Level 3 protections “in conjunction with launching Claude Opus 4” (Anthropic), because “improving model performance on our evaluations meant we could no longer confidently rule out the ability of our most advanced model to uplift people with basic STEM backgrounds if they were to try to develop such weapons” (Anthropic, biorisk). Its system card gives the trial: “Participants scored an average of 25% ± 13% in the control group. Participants who had access to Claude Opus 4 scored 63% ± 13% … Altogether, the uplift for Claude Opus 4 and Claude Sonnet 4 was 2.53× and 1.70×, respectively” (Claude Opus 4 & Sonnet 4 system card, May 2025). OpenAI and Google DeepMind run similar preparedness frameworks.
2026: the early-warning tests saturate
Anthropic’s February 2026 system card for Claude Opus 4.6 says the model “does not cross either the AI R&D-4 or the CBRN-4 capability threshold,” but repeats that “confidently ruling out these thresholds is becoming increasingly difficult.” Its automated tests for the next level are “now largely saturated and no longer provide meaningful signal for rule-out,” so it relied on human trials: “In a creative biology uplift trial, participants with model access showed approximately 2× performance compared to controls” (Claude Opus 4.6 system card, Feb 2026). The independent synthesis is the International AI Safety Report 2026.
The counterweight
- Knowing is not making. Beating experts on a knowledge benchmark is not the tacit lab skill, materials and operational competence a real program needs. Epoch AI asks whether lab biorisk evaluations measure the risk of building a weapon at all (Epoch AI).
- The trials failed too. In the 2025 trial behind the 2.53× figure, “all participants hit critical failures.” In 2026, “no single plan was broadly judged by experts as highly creative or likely to succeed,” and red-teamers found the model “a capable force multiplier for literature synthesis and brainstorming, but not consistently useful for creative or novel biology problem-solving” (the system cards above).
- Self-grading. The uplift multiples are labs grading their own models.
- The 2024 result was real. At that capability level, the uplift was not there.
The point
The claim is not that a model will build a plague tomorrow. It is that the interval between “no measurable danger” and “we can’t rule it out, so we’ve restricted the model” was about sixteen months, that the restriction is the builders’ own admission that the earlier reassurance had expired, and that by 2026 the tests designed to give early warning of the next step had stopped being able to.