Nature Sets a Baseline, Not a Ceiling

On intent, optimization, and what AI-enabled design tools change about the upper bound of biological harm.

Illustration by Becca Chandler Bostock

In more than 30 conversations with academic researchers about the risks of AI-enabled biological threats, one recurring objection to taking the risk of deliberate biological misuse more seriously has been that “nature is the worst bioterrorist”¹. This phrase is often attributed to Anthony Fauci, who in a 2018 interview on CBS stated “nature is potentially the worst bioterrorist for us”. However, the phrase has been circulating in public discourse since at least a 2003 editorial in Nature that called the emerging SARS epidemic “a timely reminder that Mother Nature is the ultimate bioterrorist”². I agree that, historically, engineered biological agents have been poor terrorist weapons compared to alternatives. In 2026, however, AI is greatly reducing the level of expertise and luck required for deliberate misuse and should be considered at least an equally serious threat, alongside naturally occurring pathogens.

This is not a new point of view. Writing in 2021, Chris Bakerlee argued in a piece titled Mother Nature is not ‘the ultimate bioterrorist’ that this phrase had strayed from its original purpose of warning against neglecting natural pandemics and instead become a way of discounting engineered threats. A key point, that “nature has no interests, motives, or political goals”, emphasizes that humans may be able to create pathogens that can cause more harm than is likely to arise in nature. In the last few years, this has become an even greater concern. In 2025, the Nuclear Threat Initiative (NTI) issued a statement signed by more than 40 experts warning that AI-enabled tools could make it possible to design “pathogens that are more dangerous than what is found in nature”.

Humans can scale natural processes

As humans, we already harness and exceed natural biological processes. Nature supplies the parts, but humans assemble them to achieve outcomes not found in the natural world. These are, for the most part, hugely beneficial; think bacteria engineered to produce insulin on an industrial scale. By engineering these bacteria, scientists give bacteria a capability they would never evolve on their own and manufacture huge quantities of highly purified insulin. This allows people with diabetes to manage their condition with greater ease.

However, producing biological products or agents on an industrial scale can also lead to harm. For example, anthrax inhalation is vanishingly rare in nature, even though Bacillus anthracis lives in soil across the globe. In 1979, a Soviet spore production facility in Sverdlovsk suffered a filter failure and released a plume of spores across the city. The resulting outbreak of inhalational anthrax killed at least 66 people across an area up to 4 km downwind.

Nature has no intent

Casting nature as a ‘bioterrorist’ is a rhetorical move intended to highlight the dangers of natural infections, not to suggest nature has an agenda or intentionality, as a human bioterrorist would. Nevertheless, this phrase muddies the water by metaphorically linking the two. Much of the concern about engineered threats stems directly from the fact that they would be created with the intention of harm.

Nature optimizes for reproductive fitness: replication, transmission, and persistence. The classical theory is that there is a trade-off between transmission and virulence such that viruses will settle at an end-point of intermediate virulence³. This is why natural pathogens rarely evolve to be highly transmissible and highly lethal. But there is no fundamental law of nature that says a pathogen can’t be both. Granted, once released, an engineered pathogen will face the same evolutionary pressures as a natural one⁴. But that takes time. Acute harm happens fast, before evolutionary pressures catch up.

A malicious actor or group can also choose where and when to release the pathogen to maximize panic or economic disruption, raising the ceiling of harm even without invoking novel biological capabilities. As the anthrax example demonstrates, human-derived changes in cultivation and distribution can dramatically increase the realized impact of even natural pathogens.

In terms of likelihood, it is true that the next pathogen outbreak is more likely to be from a known pathogen such as measles among a population with low vaccination rates, or a variation of last year’s seasonal flu, than from intentional release of an engineered pathogen. Larger-scale outbreaks may result from novel zoonotic spillover events, made more likely by rapid deforestation and wildlife trafficking. This, however, may not be as bad as it could get.

Where AI fits in

AI is not yet able to design a novel pathogen from scratch, but capabilities are rapidly increasing. General-purpose AI models can provide scientific expertise and troubleshooting⁵. Biological AI models (BAIMs), which are specialized machine-learning systems trained on biological sequences, structures, or experimental data, can be used to predict molecular structures and interactions and also estimate regulatory activity and variant effects. They include biomolecular structure predictors such as AlphaFold 3, protein language models such as ESM3, DNA sequence-to-function models such as AlphaGenome, and genome language models such as Evo 2.

These tools speed up research by screening many possible variants in silico and highlighting the most promising for laboratory verification, saving time and resources needed for scientists to test all these variants in the laboratory. For example, Evo models have generated viable ΦX174 bacteriophage (a virus that infects bacteria) genomes that were not previously detected in nature. Although researchers dispute the extent of their novelty, this work demonstrates that BAIMs can compress the time it takes scientists to optimize biological variants, narrowing the window for law-enforcement intervention. These tools are also opening up entirely new protein variant possibilities; BAIMs and more traditional laboratory methods can be used together to generate proteins that would not arise in nature.

AI tools still fail at some tasks, such as predicting viral epistasis (the way individual mutations interact within a genome to generate specific properties)⁶ or designing a completely novel virus. I have heard arguments that this proves we cannot build anything worse than nature. It may in fact be the case that we cannot now build anything worse than nature. But if success at such tasks would demonstrate the latent potential for such a dangerous use, shouldn’t we keep an eye on them? This makes it worth spending time and resources to measure AI capabilities and put safeguards in place before these thresholds are crossed. Boko Haram used AI to plan attacks in Nigeria in 2024, and al-Qaeda ran a biological weapons program focused on anthrax production from 1999–2001. The convergence of this longstanding interest in biological weapons, coupled with the potential capability uplift from AI, is worrying.

Future possibilities of harm

Where could AI-enabled biological design lead us in the future? There is huge potential for positive medical developments, such as improved vaccines, antivirals, and antibiotics. However, these technologies are often dual-use, a concern highlighted by the National Academies and the NTI, among others. A model that predicts which virus strains won’t be stopped by current vaccines can be used to develop more effective vaccines, or to design vaccine-resistant pathogens. This is the same AI capability, with very different end goals. Interspecies transmission prediction helps us prepare for pandemics by predicting which genome mutations and changes in protein structure allow a pathogen to infect new species. This capability could allow someone to engineer an animal pathogen to spread through human populations.

Defense against biological threats

To reduce the biological risks posed by AI models, it is important to identify emerging risks and reduce them. Our work at SecureBio AI focuses on developing evaluations to measure frontier AI capabilities. This empirical measurement is necessary to understand where capabilities and risks currently lie. This is vital information as we intentionally decide as a society how to develop AI models for public good and to mitigate harm.

Pandemic preparedness and outbreak surveillance are important and will remain so. But to be truly robust, surveillance and defensive efforts pertaining to biological risk should include engineered pathogens. Pathogen-agnostic surveillance systems, such as those developed by SecureBio Detection, identify novel and known pathogens from environmental samples and swab sampling. This work alerts us to natural outbreaks and engineered pathogens alike. As an article in Lancet Infectious Diseases concludes, “preparedness for intentional outbreaks has the important added value of strengthening preparedness for natural epidemics, and vice versa”.

Although natural pathogen outbreaks are real, happen frequently, and can be devastating, they are not the ceiling of possible harm. We may face worse threats in the future, particularly with advances in AI capability. The argument here is not that one threat matters more than the other, it is that our attention and resources should consider both.

Footnotes

1. Also heard by colleagues at SecureBio in their conversations with researchers and scientists.

2. The reasoning behind it is still older; an editorial from 2000 calls for scientists to “be careful not to exaggerate the usefulness of biological agents as terrorist weapons”. The “political” context of this threat environment included ongoing BWC verification negotiations and shifting funding priorities; both pharmaceutical companies and the US military and related industries had stakes in the game.

3. This trade-off is real but perhaps not universal: some systems do not conform to classical trade-off theory, as shown through mathematical models and as has been argued to be the case for pandemic SARS-CoV-2.

4. The classic example is myxoma virus, a South American rabbit poxvirus (which causes mild skin lesions in native species) that was released in Australia in 1950 to control European rabbit populations. In this new species, it caused over 99% lethality within two weeks of infection. However, within a few years, the virus attenuated to a milder version as the more lethal strains killed rabbits before mosquitoes could spread the virus.

5. These capabilities are measured through evaluations of frontier AI models, such as those carried out by SecureBio.

6. Epistasis is where the effect of a mutation depends on the rest of the genome it is a part of, rather than having a fixed effect that adds up with other mutations. Mutations in one part of a viral genome can have effects elsewhere in the genome that are difficult to predict. As described in Epistasis in RNA viruses.