Is EA Biosecurity Work Limited to Restricting LLM Biological Use?

Overview

A common critique of the EA/x-risk community's biosecurity work is that it consists primarily of restricting what LLMs can say about biology. In reality, AI capability restrictions represent just one of at least six major intervention categories, and likely not the one receiving the most investment. The portfolio spans DNA synthesis screening, pathogen-agnostic surveillance, medical countermeasures, AI capability evaluations, physical environmental defenses, and governance reform.

This report maps the full landscape of biosecurity interventions relevant to AI-enabled biological risks, organized by Kevin Esvelt's Delay, Detect, Defend framework—the dominant conceptual model in this space.

Quick Assessment

The Full Intervention Portfolio

flowchart TD
  subgraph Delay["🛡️ Delay"]
      DNS["DNA Synthesis Screening
(SecureDNA, IBBIS)"]
      AIR["AI Capability Restrictions
(RSPs, output filtering)"]
      GOV["Biosecurity Governance
(BWC, OSTP framework)"]
  end
  subgraph Detect["🔍 Detect"]
      MET["Metagenomic Surveillance
(NAO, Biothreat Radar)"]
      BIO["AI Bio-Capability Evaluations
(VCT, red-teaming)"]
  end
  subgraph Defend["💊 Defend"]
      MCM["Medical Countermeasures
(Red Queen Bio, platform vaccines)"]
      UVC["Far-UVC & Physical Defenses
(Blueprint Biosecurity)"]
      PPE["Next-Gen PPE
(Improved filtration)"]
  end
  Delay --- Detect
  Detect --- Defend

Intervention Categories vs. Actors

Delay: Slowing Dangerous Capability Proliferation

DNA Synthesis Screening

DNA synthesis screening is arguably the most concrete, technically mature biosecurity intervention. The goal: prevent anyone from ordering synthetic DNA that could be used to reconstruct dangerous pathogens.

Key initiatives:

• SecureDNAOrganizationSecureDNAA Swiss nonprofit foundation providing free, privacy-preserving DNA synthesis screening software using novel cryptographic protocols.Quality: 60/100 — A Swiss nonprofit foundation co-founded by Kevin Esvelt, providing free, privacy-preserving screening software to DNA synthesis providers. Uses cryptographic protocols so that neither the order contents nor the hazard database are revealed during screening. Can detect hazardous sequences down to 30 base pairs—already exceeding the OSTP framework's 2026 requirement of 50bp screening.²

• IBBIS (International Biosecurity and Biosafety Initiative for Science)OrganizationIBBIS (International Biosecurity and Biosafety Initiative for Science)An independent Swiss foundation launched in February 2024, spun out of NTI | bio.Quality: 60/100 — Launched by NTI in 2024, headquartered in Geneva, led by Piers Millett (former Deputy Head of the BWC Implementation Support Unit). Develops the Common Mechanism for international DNA synthesis screening.³

• OSTP Synthesis Screening Framework — The Biden administration's April 2024 framework requiring federally funded researchers to procure synthetic nucleic acids only from screened providers. Implementation began April 2025 (200nt minimum), with 50nt minimum from October 2026. The Trump administration's May 2025 Executive Order directed revision of the framework but maintained its core screening requirements.⁴

Critical gap: A January 2026 Nature Communications paper by Edison, Toner, and Esvelt demonstrated that unregulated DNA fragments can be assembled to bypass synthesis screening entirely—they acquired fragments sufficient to reconstruct the 1918 influenza virus from dozens of providers. The paper argues fragments must be regulated as select agents.⁵

AI Capability Restrictions

Some critics assume that AI capability restrictions constitute the entirety of EA biosecurity work. In practice, it's one piece of a much larger portfolio:

• Anthropic's ASL-3: Activated for Claude Opus 4 specifically due to CBRN capability concerns. Involves increased internal security (preventing model theft) and deployment restrictions limiting misuse for weapons development.⁶
• OpenAI's Preparedness Framework: GPT-5 and ChatGPT Agent deployed with "High capability" safeguards after evaluations couldn't rule out meaningful assistance to novice bioweapon actors.⁷
• Google DeepMind: Gemini 2.5 Deep Think deployed with additional mitigations after CBRN knowledge assessments.⁷
• Open-source gap: DeepSeek described as "worst tested" for biosafety by Dario AmodeiPersonDario AmodeiComprehensive biographical profile of Anthropic CEO Dario Amodei documenting his competitive safety development philosophy, 10-25% catastrophic risk estimate, 2026-2030 AGI timeline, and Constituti...Quality: 41/100 (2025), with minimal content filtering for dangerous biological information.⁸

Biosecurity Governance

• Biological Weapons Convention (BWC): The primary international treaty, though lacking a verification protocol. EA-adjacent organizations (NTI Bio, Council on Strategic Risks) actively push for strengthening.⁹
• CSIS 2025 Report: Found current measures "ill-equipped" for AI-enabled bioterrorism threats.¹⁰
• Dual-use research oversight: Ongoing debates about gain-of-function research moratorium and DURC policies.

Detect: Early Warning Systems

Metagenomic Pathogen Surveillance

The Nucleic Acid Observatory (NAO), operated by SecureBioOrganizationSecureBioA biosecurity nonprofit applying the Delay/Detect/Defend framework to protect against catastrophic pandemics, including AI-enabled biological threats.Quality: 65/100 under Jeff Kaufman's leadership, represents perhaps the most distinctive EA contribution to biosecurity—and one that has nothing to do with LLM restrictions.

How it works: Unlike traditional PCR-based surveillance (which can only detect known pathogens), the NAO performs untargeted metagenomic sequencing of wastewater—sequencing all genetic material in a sample. This means it can detect completely novel, engineered, or unknown pathogens, including those specifically designed to evade traditional surveillance.¹¹

Three detection modes:

1. Known pathogen alerts — Automated matching against pathogen databases
2. Genetic engineering detection — "Chimera detection" pipeline flags signs of engineering
3. Growth-based anomaly detection — Identifies any organism undergoing exponential growth, even if never seen before

Current scale (as of November 2025):

• 31 sampling sites across 19 US cities
• ≈60 billion read pairs sequenced weekly
• Demonstrated detections: measles in Kauai County wastewater, West Nile Virus in Missouri¹²

Government adoption: The President's FY2026 Budget proposes $52 million for Biothreat Radar, a national pathogen detection system at CDC drawing directly on NAO's pilot findings. Designed to detect novel pathogens before 12 in 100,000 Americans are infected.¹³

Military adoption: Through the ANTI-DOTE program (Defense Innovation Unit), the NAO performs metagenomic sequencing at 5 US military facilities in the Indo-Pacific region.¹⁴

AI Bio-Capability Evaluations

Evaluating whether AI systems can meaningfully assist bioweapon development:

• Virology Capabilities Test (VCT): Developed by SecureBio, CAIS, and MIT. 322 multimodal questions testing practical virology laboratory knowledge. Key finding: leading AI models outperform the vast majority of practicing virologists sampled. Now adopted by major AI labs for pre-deployment testing.¹⁵
• RAND Red-Team Study (2024): 12 teams of 3 people given 80 hours over 7 weeks to plan biological attacks with/without LLM access. Found no statistically significant difference in plan viability—but this was with 2024-era models.¹⁶
• OpenAI 100-Person Study: 50 biology PhDs + 50 students, assessed across 5 stages (ideation, acquisition, magnification, formulation, release). Found GPT-4 provided "at most a mild uplift."¹⁷
• FRI Expert Survey: Forecasting Research Institute survey estimated AI capabilities matching expert virologists would increase annual epidemic probability from 0.3% to 1.5% (5x increase).¹⁸

Defend: Resilience and Countermeasures

Some critics have highlighted resilience-based approaches as more promising than restriction-based ones—and EA/x-risk organizations are actively working on both.

Medical Countermeasures

• Red Queen BioOrganizationRed Queen BioAn AI biosecurity Public Benefit Corporation founded in 2025 by Nikolai Eroshenko and Hannu Rajaniemi (co-founders of HelixNano).Quality: 55/100 — Spun out of HelixNano (clinical-stage mRNA therapeutics), raised a $15M seed round led by OpenAI in 2025. Core thesis: "defensive co-scaling"—coupling defensive compute and funding to the same forces driving the AI capability race. Works with frontier labs to map AI-enabled biothreats and pre-build medical countermeasures.¹⁹
• Platform vaccine technologies — mRNA platforms (demonstrated during COVID-19) enable rapid design of vaccines against novel pathogens within days of sequencing. The Coalition for Epidemic Preparedness Innovations (CEPI)OrganizationCoalition for Epidemic Preparedness InnovationsCEPI is an international vaccine development partnership founded in 2017 that addresses market failures in pandemic preparedness by funding vaccines for diseases with limited commercial viability. ...Quality: 53/100 has invested over $1.5B in pandemic preparedness vaccines, including its 100 Days Mission to compress vaccine development timelines.
• Broad-spectrum antivirals — Still underdeveloped relative to need. Could provide pathogen-agnostic treatment.

Far-UVC and Physical Defenses

Blueprint BiosecurityOrganizationBlueprint BiosecurityAn EA-funded biosecurity nonprofit founded in 2023 by Jake Swett, dedicated to achieving breakthroughs in pandemic prevention through far-UVC germicidal light, next-generation PPE.Quality: 60/100, an EA-funded organization, has made far-UVC technology a centerpiece of their work:

• Far-UVC light (222nm) can inactivate 99.8% of airborne pathogens in occupied spaces while remaining safe for human exposure—the light is absorbed by dead skin cells before reaching living tissue.²⁰
• Columbia University research (David Brenner) demonstrated effectiveness; technology licensed to Ushio Inc. (Care222 product line).²¹
• Blueprint's EXHALE Program: ≈$1M in grants to evaluate far-UVC against real human-generated respiratory aerosols (Emory, Virginia Tech, University of Nebraska). Results expected mid-2026.²²
• Blueprint's Project AIR: Launched to address three bottlenecks—global health agency endorsements, real-world implementation guidance, and multinational funding.²²
• Key limitation: No binding regulatory standards exist worldwide for safe far-UVC dosage as of 2025.²³

How the X-Risk Approach Differs from Traditional Biosecurity

Key Organizations

Key Funding Flows

Coefficient GivingOrganizationCoefficient GivingCoefficient Giving (formerly Open Philanthropy) has directed $4B+ in grants since 2014, including $336M to AI safety (~60% of external funding). The organization spent ~$50M on AI safety in 2024, w...Quality: 55/100 (renamed Coefficient Giving in November 2025) is the dominant funder. Key biosecurity grants:

Other EA-aligned funders include the Musk Foundation (NAO sensitivity research), Longview Philanthropy (>$50M directed in 2025 across x-risk areas), Founders Pledge (recommends SecureBio and IBBIS), and Survival and Flourishing Fund.

The Restriction vs. Resilience Debate

A key tension in biosecurity strategy is whether to prioritize restricting dangerous capabilities (limiting what AI models can say, restricting DNA synthesis) or building resilience (making it so that even if someone creates a pathogen, we can detect and respond fast enough to prevent catastrophe).

The EA/x-risk community's actual position is: both are necessary, and the portfolio reflects this. The Delay/Detect/Defend framework explicitly incorporates both restriction (Delay) and resilience (Detect + Defend). The field generally agrees that:

1. Restrictions buy time but are insufficient alone—information wants to be free, and restrictions become harder as capabilities proliferate (especially via open-source models)
2. Resilience is the long-term solution but isn't ready yet—metagenomic surveillance, far-UVC, and platform vaccines are still scaling
3. The transition period is the most dangerous — we need restrictions now while building resilience infrastructure for the future

This is substantively different from the perception that EA biosecurity work is "only about limiting what LLMs can do."

Sources