AI and Bioweapon Risk: MI5 Adds It to Its Threat List

The debate over whether artificial intelligence increases the risk of biological weapons has entered the official agenda of intelligence services. In his annual national threat speech, MI5 Director General Sir Ken McCallum said AI could "shift the balance" in both existing and emerging biological weapons. Dr. Tom Inglesby, Director of the Johns Hopkins Center for Health Security, also explained on the Guardian's podcast what worries governments.

What happened?

McCallum addressed AI not only alongside classic cyber and espionage threats but also in terms of biological risks. Inglesby, for his part, argues that the risk is real but that countermeasures are possible. What is new about the debate is not the warning itself but who is delivering it: the issue is now part of the official threat narrative of state intelligence, not just of academic security circles.

How exactly does AI change the risk of biological weapons?

The barriers to developing a biological weapon fall into three groups: knowledge, skills and materials. A language model touches the knowledge link of this chain the most. It compiles scattered literature, explains protocols and helps with debugging. Reading and screening work that once took an expert team weeks could shrink to hours with a sufficiently capable model.

But knowledge is not the weakest link in the chain. History shows this: in the 1990s, Aum Shinrikyo's attempts with biological agents largely failed despite money and trained staff. The problem was not finding papers. Producing the agent, keeping it stable and dispersing it effectively required laboratory dexterity and seasoned experience. This "tacit knowledge" does not transfer easily through writing.

That is why "does the model remove the barrier?" may be the wrong question. The better one is: which barrier does the model lower, for whom, and by how much? For an expert, the gain may remain small. For someone with a moderate grasp of biology, the difference could be large. This second group is at the center of the concern, because the pool of threat actors is widening.

"Agent" models that interpret images, suggest experimental plans and use tools make the picture even more delicate. A model doesn't just answer; it can help carry out a workflow step by step. We have no solid evidence on how much of the physical work in the lab it can take over; caution stems from this uncertainty.

Which measures actually reduce risk?

The value of each measure depends on which barrier it touches.

Uplift tests are the most talked-about tool. Some labs track biological capability thresholds as a separate category in their own safety frameworks and activate additional safeguards once a threshold is crossed. The problem is that the tests mostly measure through knowledge questions and short tasks. Controlled studies that measure how far a real person working in a lab gets with a model are more expensive and rarer.

In my view, DNA synthesis screening is the most defensible intervention. Whatever the model knows, a dangerous sequence still has to be physically obtained. Making order screening mandatory for synthesis providers creates a checkpoint that works independently of AI and can be audited. Its weaknesses are that it relies on voluntary participation and is applied unevenly across countries.

Open-weight models are the hardest topic. On a closed API, usage can be monitored and accounts can be shut down. With open weights, that is impossible. Still, lumping all open models together is misleading: what matters most is how close a model is to frontier capability on biological tasks. For models below the frontier, the benefits of openness may outweigh the risk; above it, the same calculation may not hold.

What does the intelligence services' involvement change?

When an agency like MI5 moves the issue into the official threat narrative, two things follow. The first is resources and authority: intelligence services have access to classified information and can share it with labs. The second is political priority: biosecurity was for years an area that stayed in the background of budgets. Even after the pandemic, investment lagged behind the seriousness of the warnings.

There is also a risk. As threat rhetoric grows, pressure for disproportionate regulation may emerge, which could slow legitimate biology research and defensive work. Good policy should tighten the physical bottlenecks, namely synthesis, equipment and the supply chain, rather than restricting models across the board.

What's next?

Three developments are worth watching. First, how transparently labs publish their human-participant uplift studies and results. Second, whether DNA synthesis screening moves from voluntary practice to binding rules. Third, whether governments make biological evaluation a condition in open-weight release decisions.

My assessment: AI does not create the bioweapon risk from scratch, but by widening the pool of attackers it pulls the threshold down. The most robust defense is not censoring what the model says but overseeing the supply points in the physical world. The warnings are justified, but the response has to be proportionate and measurable.

For the full conversation, see the Guardian podcast recording and the work of the Johns Hopkins Center for Health Security.