Propositions · 7 propositions · 25 records · 2023–2025

Arguments about AI and biological risk

Which located texts, from 2023 to 2026, state, contest or bear on the published arguments about AI and biological risk: whether current systems already help an actor seeking biological harm, where the binding barrier lies, what published evaluations establish, whether design tools are a distinct case, whether synthesis screening is the control point, whether open weights raise the risk, and whom assessment must cover? For each proposition, which text is the earliest located?

Each argument is recorded as a proposition with one criterion. It is phrased generically and attributed to no one. A text that meets the criterion articulates the proposition. A text that disputes it contests it. A text that comes close bears on it, and its record names what is missing. Every record stays at the policy and evaluation level: it says what a text argues, not how anything could be done. Texts are listed in date order. The page records what texts say and when; it does not assess whether an argument is right, and it is not evidence about any risk.

A machine selected and arranged these records. No human review of the selection or framing is recorded.

Download research starter

The original sources first, in date order, then every proposition on this page with its criterion, earliest located text and records. Each record gives its original source and the place in it, its role, register and dates, the qualification and the missing element of a context record, then the Selekoa identifiers. Stored paraphrases and permitted short quotes are included. Original documents are not.

Original sources for a reference manager. Every source this export cites, for Zotero, EndNote and similar tools. Cite the original documents, not Selekoa, and check each entry against them.

How we searched

The collection records what located texts say about seven propositions on AI and biological risk. The propositions were written from the texts the search found, not from a list supplied in advance. “Earliest located” means the earliest text found by the searches below. It is not a claim that no earlier text exists.

Venues and years searched

Texts on AI and biological risk, 2023 to 2026

Preprints and papers: Soice and others on large language models and dual-use biotechnology (June 2023), Sandbrink on biological design tools and language models (June 2023), Seger and others on open-sourcing highly capable models (September 2023), Moulange and others on the governance of biological design tools (November 2023), Kapoor and others on open foundation models (February 2024) and Peppin and others on the reality of AI and biorisk (December 2024).
Research organisations and think tanks: CSET’s explainer on AI and biorisk (December 2023), RAND’s red-team report (January 2024) and working paper on foundation models (June 2025), and ITIF’s commentary (April 2024).
A developer’s own research post: Anthropic on language models and biological risk (September 2025).
Found by web discovery searches and retrieved directly on 2026-10-28, and again at admission on 2026-10-30.

A cross-family check, 2026-10-30

A model from another family re-read every argument record against its proposition’s criterion and searched for earlier texts.
It found three roles not established by the passages cited, which were downgraded to context at admission; the roles then moved to the next qualifying text, on passages already quoted.

Methods

Sources were retrieved directly by script, one request at a time, on 2026-10-28 and again at admission on 2026-10-30. Each retrieved text is identified by its SHA-256 hash in the source record.
Every quotation was compared with the retrieved text, both times. Paraphrases are labelled as such, including passages from PDFs whose text layer displaces characters.
Each record was applied against its proposition’s criterion as worded. A text that argues something adjacent bears on the proposition and its record says what is missing.
Two fresh-context machine audits by Claude models and a check by an OpenAI GPT model re-read these records. No person has reviewed them.

Known gaps

The physical-bottleneck proposition carries no articulation: the one text the research pack headlined was downgraded to context by its own audit, and the paywalled venues the pass could not reach were not searched. Three contesting texts and one context record stand; the imbalance is a result of the search, not a finding.
The screening-control-point proposition carries no contesting text after the check found that potential evadability does not contest the control point.
Not recorded: a 2022 commentary on dual-use drug discovery, whose full text no route served at the time of the pack; the cross-family check later reached an author manuscript, and it is left for a separate pass.
Not searched: conference talks, podcasts and social media; texts not in English; and the paywalled journals whose articles the pass could not retrieve.

A text found later that is earlier than an earliest located text becomes the new earliest located text, and the earlier headline stays on record as a correction.

How to read a record

Articulates: A passage meets the proposition’s criterion.
Contests: A passage disputes the proposition or a premise it depends on.
Bears on: A passage comes close without meeting the criterion; the record names what is missing.
Earliest located: The earliest articulation the searches found, dated by its wording. It is not a claim that no earlier text exists. The earliest located text that contests a proposition is chosen by the same rule.
Earliest located use of the name: The earliest located text that uses the proposition’s usual name. A title can carry the name without stating the proposition.
Engages a premise, states the contrary: A contesting passage engages a premise when its paragraph, message or dialogue turn gives a reason against it. Otherwise it states the contrary conclusion only.
Dates: The first date is the one the work is dated by. “Wording attested” gives the date from which the quoted wording is known, when it survives only in a later copy. “Claimed” gives an earlier talk, draft or presentation that does not date the wording.
Register: the kind of text: Fiction, satire, a dream frame or a relay of another author is labelled. A passage in fiction records what the work says, not its author’s view. Unlabelled records are nonfiction.

Limits of this page

“Earliest located” means the earliest text found by the searches described under “How we searched”. It is not a claim of first use or first statement.
A record documents what a text says. It is not evidence that the proposition is true, that any system can do what a text says, or that any measure works.
A proposition is phrased generically and attributed to no one. Texts grouped under one proposition disagree with each other about much else.
Every record stays at the policy and evaluation level. No record carries a method, a protocol, an agent or a screening criterion, and where a source holds such content the record cites only its policy-level passages.
The codes D1 to D7 correspond to B1 to B7 in the research pack the records come from, which clashed with the dataset’s own B codes.
A machine selected and classified these records, and machine checks from two model families re-examined them. No person has reviewed them.

R · What current systems and evaluations show

Whether systems already available increase an actor’s ability, where the binding barrier lies, and what published evaluations of biological capability establish.

D1 Currently available AI systems increase an actor's biological-misuse capability

Criterion. The text states that AI systems already deployed or publicly available at the time of writing increase the ability of an actor seeking to cause biological harm, relative to the resources otherwise available to that actor.

Earliest located: arXiv (preprint, Emily H. Soice, Rafael Rocha, Kimberlee Cordova, Michael Specter, Kevin M. Esvelt) · Can large language models democratize access to dual-use biotechnology? · 2023-06-06
Earliest located text that contests it: RAND Corporation · The Operational Risks of AI in Large-Scale Biological Attacks: Results of a Red-Team Study · 2024-01-25

Filled dots articulate, open dots contest, small dots bear on the proposition; a large dot is an earliest located text. A line below a dot runs to the date from which its wording is attested.

Texts that articulate or contest it (6)

D2 The binding barrier is physical execution rather than information

Criterion. The text states that access to information is not the barrier that limits biological misuse, because what remains required is physical: acquiring materials and succeeding at hands-on laboratory work.

Earliest located: No located text meets the criterion.
Earliest located text that contests it: arXiv (preprint, Emily H. Soice, Rafael Rocha, Kimberlee Cordova, Michael Specter, Kevin M. Esvelt) · Can large language models democratize access to dual-use biotechnology? · 2023-06-06

Filled dots articulate, open dots contest, small dots bear on the proposition; a large dot is an earliest located text. A line below a dot runs to the date from which its wording is attested.

Texts that articulate or contest it (3)

Texts that bear on it without meeting the criterion (1)

Bears onCenter for Security and Emerging Technology, Georgetown University · AI and Biorisk: An ExplainerCSET's explainer "AI and Biorisk" (December 2023) states that the barrier to scientific information is not high even for beginners, and that feasibility depends on both information and hands-on production success, without stating which of the two limits biological misuse.Missing: The explainer states that information and hands-on production success are both required; it does not state that access to information is not the barrier that limits biological misuse.2023-12 Inspect claim & evidence ↗Document page →

D3 Published evaluations do not establish real-world biological risk

Criterion. The text states that published evaluations or benchmarks of AI systems' biological capability do not, as conducted, establish the level of real-world biological misuse risk.

Earliest located: arXiv (preprint, Aidan Peppin, Anka Reuel, Stephen Casper and others) · The Reality of AI and Biorisk · 2024-12-02

Filled dots articulate, open dots contest, small dots bear on the proposition; a large dot is an earliest located text. A line below a dot runs to the date from which its wording is attested.

Texts that articulate or contest it (3)

G · What follows for governance

Whether biological design tools are a distinct case, whether screening orders for synthesised nucleic acids is the control point, whether publishing model weights raises the risk, and whether assessment must cover actors who already hold relevant skills.

D4 Biological design tools pose risks distinct from those of language models

Criterion. The text states that AI tools built to design or predict biological molecules or systems create misuse risks that differ in kind, in the actors they affect or in the governance they require, from those of general-purpose language models.

Earliest located: arXiv (preprint, Jonas B. Sandbrink, Nuffield Department of Medicine, University of Oxford) · Artificial intelligence and biological misuse: Differentiating risks of language models and biological design tools · 2023-06-24

Filled dots articulate, open dots contest, small dots bear on the proposition; a large dot is an earliest located text. A line below a dot runs to the date from which its wording is attested.

Texts that articulate or contest it (3)

D5 Synthesis-order screening is a control point for AI-related biological risk

Criterion. The text states that screening orders for synthesised nucleic acids is a control point on which mitigation of AI-related biological risk depends.

Earliest located: arXiv (preprint, Jonas B. Sandbrink, Nuffield Department of Medicine, University of Oxford) · Artificial intelligence and biological misuse: Differentiating risks of language models and biological design tools · 2023-06-24

Filled dots articulate, open dots contest, small dots bear on the proposition; a large dot is an earliest located text. A line below a dot runs to the date from which its wording is attested.

Texts that articulate or contest it (1)

Articulates · Earliest locatedarXiv (preprint, Jonas B. Sandbrink, Nuffield Department of Medicine, University of Oxford) · Artificial intelligence and biological misuse: Differentiating risks of language models and biological design toolsSandbrink's preprint (arXiv v1, 24 June 2023) states that enhanced screening of gene synthesis is among the measures key to reducing the risks it describes.2023-06-24 Inspect claim & evidence ↗Document page →

Texts that bear on it without meeting the criterion (2)

Headlines replaced

The preprint of 6 June 2023 on large language models and dual-use biotechnology, headlined as earliest located by the research pack of 2026-10-28. The cross-family check found that proposing screening among three promising measures does not state the dependence the criterion asks for. Sandbrink’s preprint of 24 June 2023, which states that reducing the risks depends on enhanced screening of gene synthesis, holds the role. Recorded 2026-10-30.
The workshop paper of 27 November 2023, headlined as the earliest located contesting text by the research pack of 2026-10-28. The cross-family check found that stating that design capabilities could be used to evade screening does not contest screening’s role as a control point. No contesting text holds the role. Recorded 2026-10-30.

D6 Public release of model weights increases biological misuse risk

Criterion. The text states that making model weights publicly available increases the risk of biological misuse, or that some models should for that reason not be released openly.

Earliest located: arXiv (preprint, Elizabeth Seger and 21 other authors; Centre for the Governance of AI and others) · Open-Sourcing Highly Capable Foundation Models: An evaluation of risks, benefits, and alternative methods for pursuing open-source objectives · 2023-09-29
Earliest located text that contests it: arXiv (preprint, Sayash Kapoor, Rishi Bommasani and others) · On the Societal Impact of Open Foundation Models · 2024-02-27

Filled dots articulate, open dots contest, small dots bear on the proposition; a large dot is an earliest located text. A line below a dot runs to the date from which its wording is attested.

Texts that articulate or contest it (3)

D7 Assessment must cover actors who already hold relevant skills

Criterion. The text states that assessment of AI-related biological risk must cover actors who already hold relevant scientific skills, and not only actors without them.

Earliest located: RAND Corporation (working paper WR-A3853-1), posted to arXiv · Contemporary AI foundation models increase biological weapons risk · 2025-06-12

Filled dots articulate, open dots contest, small dots bear on the proposition; a large dot is an earliest located text. A line below a dot runs to the date from which its wording is attested.

Texts that articulate or contest it (1)

Articulates · Earliest locatedRAND Corporation (working paper WR-A3853-1), posted to arXiv · Contemporary AI foundation models increase biological weapons riskThe RAND working paper of 12 June 2025 states that safety assessments rely on benchmarks that overlook the full range of potential threat actors and fail to account for how AI could enhance the capabilities of skilled individuals as well as enabling non-experts.2025-06-12 Inspect claim & evidence ↗Document page →

Texts that bear on it without meeting the criterion (2)

Headlines replaced

Sandbrink’s preprint of 24 June 2023, headlined as earliest located by the research pack of 2026-10-28. The cross-family check found that stating that design tools expand the capabilities of sophisticated actors does not state that assessment must cover them. RAND’s working paper of 12 June 2025, which states that safety assessments fail to account for skilled actors, holds the role. Recorded 2026-10-30.