We recommend states recognise the common threat posed by the proliferation of AI-enabled cyberattack and biological misuse capabilities and commit to prevention efforts.

Continuously advancing AI capabilities are empowering malicious, non-state actors in two ways: lowering the floor for who can cause harm, and raising the ceiling on how much harm can be caused.

The potential for harm is currently most acute in the cyber domain. Offensive operations that once required weeks of specialist labour can now be executed by some frontier AI systems, and through them, anyone with access to these systems. Attacks once aimed at individual targets can be deployed at scale, and sophisticated exploits that once required well-resourced actors—cyberattacks that shut down hospitals, water supply systems, the electrical grid, financial markets, or air traffic control—can be performed by far more people at far greater scale.

The same pattern, on a slower timeline, is also unfolding in biology. Frontier AI systems are outperforming PhD-level experts on tasks relevant to pathogen design, putting lower-level biological capabilities within reach of non-experts. At the same time, advanced AI systems can modify and design increasingly sophisticated pathogens. If these trends continue, AI systems may soon enable far more actors to attempt biological attacks with capabilities that would cause mass casualties and overwhelm healthcare systems.

The rapid emergence of capable AI agents compounds these risks, increasing the speed and scale of potential cyber and biological misuse.

We assess that dual-use capabilities that were previously concentrated in states—or that required state-level resources to acquire—are fast becoming accessible to non-state actors, from terrorist groups to lone individuals. Currently deployed AI safeguards are far from adequate, and basic technological and societal defences remain embryonic and unevenly deployed across jurisdictions. Coordinated action from frontier AI developers, governments, research institutions, and critical infrastructure entities is necessary if we are to prevent societal-scale harm from AI-enabled attacks.

We recommend states recognise the common threat posed by the proliferation of AI-enabled cyberattack and biological misuse capabilities and commit to prevention efforts. Leading AI jurisdictions have a particular responsibility for coordination. This includes the US and China in particular, as well as other jurisdictions with significant AI development, deployment, and evaluation capabilities.

AI-Enabled Cyberattacks Are an Imminent Threat

On current trajectories, non-state actors¹ with minimal capacity will gain access to certain state-level cyberattack capabilities within the next year, creating unprecedented risks to critical infrastructure and national security. Some damage is now likely, as preparation has lagged. But urgent action can still contain harm to remain below societal-scale and build the defensive capabilities needed for what comes next.

Frontier AI systems already complete, in hours, coding work that would take expert teams weeks and can discover and exploit vulnerabilities in the world’s most scrutinised codebases—including every major operating system and browser. Societies are nowhere near prepared for this imminent threat.

The measures below are necessary but not sufficient; they are illustrative steps in a continuous process of defensive improvement.

Priorities for addressing AI-enabled cyberattacks:

• Protect critical infrastructure. Governments should urgently accelerate work to harden critical systems against AI-enabled attacks, drawing on national cybersecurity agencies, critical-infrastructure operators, and the defensive cybersecurity community.
• Develop the capacity to evaluate frontier AI systems for cyberattack capabilities. Building on existing efforts, leading AI jurisdictions should develop domestic capacity to evaluate frontier AI systems for cyberattack capabilities.
• Require pre-deployment testing and delay wider availability where warranted. Governments and developers should jointly establish frontier cyber capability thresholds that trigger pre-deployment testing and delayed release, codified through a legal compact rather than voluntary commitments alone. Such delays are not necessarily permanent; they create space for risk evaluation and remediation, and are particularly important for frontier open-weight releases, which are irreversible.
• Implement access controls on frontier AI systems with advanced cyber capabilities. Developers, supported by governments, should provide early access to validated defenders, enabling remediation before wider deployment. For models with the most advanced cyberattack capabilities, developers should adopt robust access controls, such as identity verification, to detect misuse and restrict access for malicious actors. These measures should be paired with continued investment in misuse monitoring, with appropriate safeguards for user privacy throughout.
• Establish information sharing and vulnerability disclosure mechanisms. Governments, working with industry, should build mechanisms to share AI-enabled cyber threat indicators and enable collective detection and disruption of misuse. Cross-jurisdictional arrangements among leading AI jurisdictions are essential. Developer coordination with law enforcement and international bodies (e.g., Interpol) supporting the identification and deterrence of malicious actors would be welcome.
• Invest in long-term resilience. Public investment should accelerate long-term resilience of critical digital infrastructure. No single technical approach is sufficient; sustained progress requires a portfolio of measures, including modernising legacy systems, translating code into memory-safe languages, deploying AI for defence, and applying formal verification.

AI-Enabled Biological Misuse

In the near future, AI may put high-consequence biological capabilities—potentially including the design of pathogens more dangerous than anything found in nature—within reach of actors who cannot access them today. The consequences could be catastrophic for public health and carry devastating economic impact. These risks must be managed if society is to harness AI's benefits for the life sciences.

Frontier AI capabilities relevant to biological misuse are growing rapidly. In two years, frontier AI systems have gone from scoring well below PhD-level experts to outperforming them on open-ended questions, protocol generation, and laboratory troubleshooting. Controlled studies show they provide substantial virology uplift in protocol generation over Internet access alone, and, as of mid-2025, are able to assist non-experts in some steps of laboratory work. Genome language models have already generated novel viable organisms. This risk is further compounded by the emergence of AI agents that can coordinate multi-step laboratory and information-gathering tasks and help build new specialised biological AI models.

Current model-level safeguards—particularly for open-weight models—are fragile and routinely bypassed. Better defences against AI-enabled biological attacks exist, including nucleic acid synthesis screening, personal protective equipment, air filtration, antivirals, and biosurveillance, but remain nascent and unevenly deployed.

Priorities for addressing AI-enabled biological misuse:

• Harden AI safeguards against high-consequence biological misuse. No single mechanism is sufficient. Developers should invest in a portfolio of model-level safeguards (e.g., pre-training data filtering, refusal training) and system-level safeguards (e.g., trusted access programmes, misuse monitoring via classifiers). Governments should fund sustained safety research to strengthen these safeguards over time and enable information-sharing of best practices between companies. Until broader defences mature, high-consequence AI biological capabilities and datasets should be limited to validated users, such as researchers at vetted institutions.
• For frontier proprietary models: strengthen refusal training, identity-verified access controls, and targeted usage monitoring against high-consequence biological misuse. Developers should continue to harden safeguards against jailbreaking and other adversarial attacks, build out trusted-access programmes, and improve classifier performance, especially in distinguishing legitimate from malicious use.
• For frontier open-weight models: research and institute pre-training data filtering for high-consequence biological knowledge. Pre-training data filtering is one of the few potential mitigations for open-weight releases. While not a durable standalone solution, it may meaningfully slow proliferation while stronger safeguards are developed. Developers and researchers should continue to improve filtering methods, assess their effectiveness at production scale, release open-source implementations, and pursue further research into open-weight model safeguards. Governments should help secure the most concerning dual-use pathogen datasets against malicious training and fine-tuning.
• Develop the capacity to evaluate frontier AI systems for biological uplift. Leading AI jurisdictions should build domestic capacity to evaluate frontier systems for meaningful uplift for biological misuse for both experts and non-experts. Tiered oversight mechanisms analogous to biosafety-level (BSL) frameworks—with relevant authorities receiving early access to evaluate systems with potentially high-consequence biological uplift—should be developed, so consequential judgements are not left to developers alone.
• Coordinate internationally on nucleic acid synthesis screening. Governments and relevant expert communities with synthesis capabilities should coordinate on comprehensive and mandatory nucleic acid synthesis screening as an immediate priority, building on existing national regulatory frameworks.
• Accelerate defence against AI-enabled biological attacks. Governments should invest in the capabilities needed to detect, contain, and respond to AI-enabled biological threats, with particular attention to regions where gaps in biosecurity capacity create shared vulnerabilities. Such research should be structured to avoid advancing offensive capabilities as a byproduct.

The safeguards, controls, and societal defences set out above are necessary and urgent. A serious AI-enabled catastrophe would not just cause enormous direct harm, but would also be catastrophic for public trust in AI systems, squandering AI’s substantial societal benefits. The Chernobyl disaster decimated the global nuclear industry and still casts a shadow over civilian nuclear power despite vastly safer modern designs. With trillions of dollars and millions of lives at stake, we will need immediate action and sustained investment from governments, industry, and the research community.

AI-enabled cyberattacks are already upon us, and significant damage is likely in the coming year. Biological misuse is not far behind. We have warned of exactly this dynamic: AI capabilities are outpacing the world’s ability to prepare. What is now unfolding in cyber should serve as a warning for biological risks and for the broader set of risks ahead, including loss of control over increasingly autonomous AI systems. Preparing before capabilities emerge, rather than after, must now be the default posture.

¹ We use “non-state actors” to include individuals, criminal groups, and other non-governmental entities with intent and capacity to misuse AI capabilities.