well i guess i gotta

We're talking about the September 2026 anthropic report on dual-use biology stuff today.

tl;dr it's not that much stuff, considering

Case 1: Chungunyika gain-of-function

Probably the most lurid, this is explicit gain-of-function chungyunika virus research conducted at a military lab in a (reading between the lines) sanctioned country. People do do this kind of thing "normally", but it is both difficult and dangerous and of all the cases this is the most easily blocked, and in fact it was.

Fun hit: the infrastructure to route biosafety queries claude wouldn't answer to other more-permissive models was itself developed with claude. Really the big ai cloud providers have an absolutely unprecedented level of visibility into what people at companies are doing. (echoes of the reveal that the houthis in saudi arabia were trying to develop guided missile technology using Claude. the prototype crashed, or at least the account asked 'why did our missile crash' a couple days later)

Case 2: Bird flu gain-of-function

This is also relatively normal-ish bird flu biology research that was completely delegated from opus to haiku. I guess there's exactly one guy out there who is using Haiku to write their entire study design, grant, data analysis, and write up the article at the end? A task for which it was not especially good at (by design i suppose, that's what the safeguards are supposed to do). This is a live research program involving several prompts over multiple days.

Case 3: orthopoxvirus gene deletion

This one is kind of interesting. Running a viral gene knockout study to test which genes affect host immune evasion is exactly what you would do to hunt for new antiviral targets if you were trying to come up with new drugs to treat orthopoxviruses(monkeypox, smallpox, etc). This is someone who cleverly anonymized their access and then one-shot a grant proposal and never came back. I wonder if it was ever submitted, never mind performed.

Fun hit: anthropic says this is "equally useful to someone seeking to attenuate a virus and to someone seeking to preserve, enhance, or transfer that function in others". a) I don't agree b) neither does the biosafety classfier, which simply wrote the whole proposal in Opus.

Case 4+5: Toxins, Proteins, etc

Case 4 looks like a totally standard bioinformatics research project to me. Protein toxins are peptides after all, and they're a huge and new drug class for a reason. It doesn't look like anything was actually synthesized and this research looks completely legitimate to me (and indeed it is, or was, state-sponsored health research.)

Case 5 is someone who was using Claude just to write up quarterly progress reports without mentioning the exact research they were working on, which at the very least shows awareness that every prompt you send up there is not private. This is in almost no sense biology-related as a task.

reading between the lines a bit

All of these biorisk cases were banned for restricted-region evasion, and the only really scary one (case study 1) immediately re-established access and increased the sophistication of their workarounds. An uncharitable take might be that the biorisk safeguards were entirely worthless this year, the only questionable research being performed this year was being done by a sophsticated enough actor to simply bypass the safeguards(at least in part). Given the five case studies we have here I think they were probably chosen specifically because they involve ToS violations, specifically to avoid "anthropic detects sketchy biorisk prompting, does not ban user" as a takeaway. Much of the biorisk safeguard activations are false positives, after all, including at least four of these. Maybe all five depending on whose military bases are hosting pathogen research.

So one lesson might be that people are not trying to do sketchy biorisk things at all. In august Anthropic did significantly relax their biosafety safeguards in August of this year, so perhaps they agree. Perhaps all the sketchy biosafety things are happening in supported customer countries and we are simply not hearing about them (unlikely).

P.S

I find the new york times coverage of this irresponsibly breathless, which is unsurprising.