In brief: The Hugging Face incident made AI cyber risk impossible to ignore. However, biology is unlikely to give us such an easily identifiable warning: an AI-enabled bioweapon could spread far before detection and cause irreversible damage, while appropriate defences take years to build. The world seems less prepared for a pandemic than before COVID-19, and Europe needs trusted access to frontier AI capabilities for biodefence. We must build institutional biosecurity alongside cybersecurity, now.
AI-driven cyberattacks are becoming more severe and frequent
In July 2026, a self-organising swarm of ~700 agents of internal OpenAI models escaped their sandbox. They then autonomously decided to hack into the popular machine learning platform Hugging Face to cheat on an evaluation. The agents were aware that this was out of scope, but persisted nevertheless and tried to erase their activity, all to pass the automated evaluation. The AI swarm executed ~17,600 actions in 4.5 days, at a pace no human attacker could sustain. OpenAI detected their own models’ attack only six days after Hugging Face cut off access, and after noticing an internal model had gained admin rights on one of their clusters. A presentation and report from OpenAI, as well as a limited external investigation document this unprecedented event.
Following this incident, other AI companies also investigated and published instances of AIs escaping confinement and performing unintended and dangerous actions, ranging from the comparatively harmless hack of a gym’s booking server to secure the user an earlier spot to social engineering with the intent of compromising open-source software. Together with the steady stream of reports of critical infrastructure being hacked, these incidents have served as an effective wake-up call about the dangers of increasing AI cyber capabilities, and the general threat of misaligned AI. Both cybersecurity experts and the leading AI companies themselves are warning that events like these will happen more frequently in the future, urging everyone to quickly increase their cybersecurity efforts.
To help defenders, the leading AI companies launched trusted access programs (e.g., Project Glasswing and Daybreak) for organisations building the software our digital infrastructure depends on. These projects provide access to most of the models’ cyber capabilities with relaxed safeguards and already revealed an unprecedented number of critical vulnerabilities. Defenders are racing to patch infrastructure before such advanced capabilities become available to less trustworthy actors and eventually the general public via open-weight models.
The rise of biological AI capabilities and real-world threats
The capabilities of AI models in biology are lagging behind their demonstrated excellence in the cyber domain, and it takes more resources to create and release a bioweapon than just a laptop with internet connection. However, progress in biology is nevertheless real and impressive. For example, frontier models now outperform human experts in a benchmark for troubleshooting complex virology experiments, and a specialised AI system recently designed sixteen functional, novel viruses, albeit phage viruses that infect bacteria, not humans or animals. The model was deliberately not trained on eukaryote-infecting viruses, which are much harder to produce and evaluate safely than bacteriophages — but the method likely generalises, so this is an indicator of increasing risk. Anthropic’s recent misuse report also highlighted five case studies of users trying to perform viral gain-of-function research, performing experiments studying avian influenza adaptation to mammals, or writing proposals to understand the immune-evasion properties of orthopoxviruses (the viral genus containing smallpox). Anthropic has since banned these users. Unfortunately, people tend to react to realised harm, not to warnings, although real risks to society are increasing with every day we don’t act, and defences against bioweapons take years to build.
There are no signs that the speed of progress in AI capabilities, be it for cyber or for biology, is about to slow down. In fact, it seems progress is accelerating, also because the AI companies are using their own models to speed up development.
We might not get a similar warning shot with the increasing risk of an AI-enabled bio-attack.
For biological threats it seems unlikely that we will get a similar loud-but-mostly-harmless warning shot of AI capabilities crossing a critical threshold. But the stakes are higher: human bodies and the agriculture on which we depend are the vulnerable systems. Even worse, there are three critical differences from cyber: defences operate on radically different timelines, biological damage is more likely to be irreversible, and pathogens are harder to detect and attribute.
A software vulnerability can often be patched quickly, but it takes years to make society more resilient and build protections against bioweapons. Vaccines take months to years to develop and roll out. Digital activity leaves logs, while pathogens can circulate undetected, because surveillance is much more costly, and attribution is a largely unsolved problem. Yet media and institutions tend to focus on the visible, fast-moving cyber threat at hand, rather than accelerating biological defences. If an agent swarm released a pathogen instead of attacking a company, we would probably still be in the dark one week later — most likely, the virus could spread internationally for weeks before proper detection. We’ve seen it with SARS-CoV-2: the virus jumped continents and seeded extensive community transmission for weeks before it was visible. It went on to kill millions and cause lasting illness, and its origin is still contested, demonstrating the attribution problem that an attacker would exploit. These fundamental asymmetries mean that, for biological threats, the attacker is favored by default — but a determined society could flip the balance by prioritizing defence.
We should not take much comfort in the fact that fewer actors may be willing to manufacture and release a bioweapon than to launch a cyberattack; sufficiently reckless bad actors exist, and stronger AIs could provide the necessary knowledge. For example, the helpful-only version of OpenAI’s new GPT-6 Astra model, without safeguards, scored a new high on SecureBio’s Advanced Screening Evasion benchmark.
And while the world has responded to rising numbers of cyberattacks, from humans and AIs, by coordinating and bolstering its efforts for cyber defence, similar endeavors to increase our resilience against bioweapons have lagged behind or even degraded. Concerningly, the Global Preparedness Monitoring Board thinks we may have become more vulnerable to another pandemic than before COVID-19, mostly because of increasing inequity, less international cooperation, and eroding trust in public health. The Board’s 2026 report is warning that we are living in “A World on the Edge”, and that “advanced AI tools [...]—without safeguards and effective governance—could reduce health security”.
Europe depends on trusted frontier access for bio-defence
Defences take more time to build than we’ll likely have before a pandemic or bioweapon attack hits. Using the growing capabilities of frontier AI models to accelerate the research that strengthens our defences could compress this period of vulnerability. But the most capable models are trained and served by US companies. Access is gated through direct agreements with the companies, and in practice, the US administration. This became painfully clear when the US government suddenly ordered Anthropic to restrict access to Mythos and the newly released Fable 5 model for all foreign nationals, forcing Anthropic to suspend the models for 18 days. Because no clear rules exist, nothing stops this or more severe and longer-lasting restrictions from recurring in the future. Europe is deeply vulnerable in this regard.
The question of frontier access gets more consequential when it comes to biological capabilities: the models widely released by US companies have safeguards for tasks related to biology and potential dual-use applications, similar to safeguards against offensive cyber use. However, the dual-use problem is symmetric: understanding a biological vulnerability well enough to devise a defence usually means you could also exploit it. This means that safeguards generally also block defensive work to avoid dangerous requests, severely restricting the publicly available frontier models for defence research. Companies like Anthropic are therefore increasingly moving to trusted access models, as “the only safe way to serve frontier biological capabilities is to offer them in trusted user programs.”
Because frontier models can also provide significant R&D uplift, there is concern that the US administration would want to retain them exclusively for American universities and companies, like they have already done for Anthropic’s cyberdefence Project Glasswing: European organizations like the EU Agency for Cybersecurity (ENISA) were originally invited, but most non-US access was never reinstated, even after the export controls for Fable 5 were lifted. The widely shared Europe 2031 scenario has illustrated this vulnerability and discussed strategies to tackle it.
Some argue we should turn towards Chinese open-weight models, expecting transparency and dependability. However, their current models have very few safeguards against the dangerous dual-use capabilities we need to keep out of the wrong hands — but even if they had them, open-weight models can be easily stripped of their safeguards. It seems plausible that the Chinese government will restrict the distribution of open-weight models above certain levels of capability and risk. In any case, relying on Chinese open-weight models trades one dependency for another, and Europe can currently rely on neither the US nor China.
Therefore, Europe must act decisively to secure reliable access to frontier capabilities for defence and research, or risk falling further behind scientifically and economically.
What Europe should do now, for bio-defence and research competitiveness
Europe must act now to defend against biological threats and ensure that the research institutions and biotech and pharmaceutical industries underpinning its health and prosperity continue to thrive in the (AI-) future. We need to acknowledge the reality of the situation: AI capabilities in biology and other domains are advancing rapidly, and Europe is falling behind in an increasingly skewed competitive research landscape. New threats are emerging for cyber and biology, and we need to take them seriously.
Defence in depth
Defence against such biological attacks is possible both prophylactically and once the attack or outbreak is already in progress. Esvelt’s Delay, Detect, Defend framework can serve as inspiration here:
Delaying by restricting sensitive information, securing the chokepoints of bioweapon manufacturing, and deterring actors by enabling attribution of attacks. In particular, mandating DNA synthesis screening for both long and short fragments is a critical first step, including for novel variants and attempts of obfuscation.
Detecting threats early is paramount to have crucial time to react. Monitoring viruses and bacteria in wastewater has proven an effective window into circulating pathogens, and airport air and airplane wastewater in particular can surface both known and novel threats as they begin to spread.
Hardening infrastructure by implementing ventilation, air filtration, and UVC, and stockpiling masks and other personal protection equipment to reduce the likelihood and speed of bioweapon spread.
Developing, improving, and stockpiling vaccines and antivirals for likely threats (e.g., H5N1 influenza or smallpox) but also for other pathogen families or completely novel threats, by investing in the design, testing, and production pipelines for fast rollout.
Even without a deliberate attack, these measures would help contain naturally emerging pathogens and reduce the disease burden and deaths they cause. But as long as our computer networks are susceptible to AI-supercharged cyber attacks, these barriers are brittle: synthesis screening is irrelevant if you can hack your way around it, and a pathogen won’t be detected if an agent swarm compromises the analysis pipeline. Hardening our digital infrastructure and personal devices is the necessary foundation for the other points.
Europe needs trusted access to frontier AI capabilities in biology to keep us safe.
Prepare now for access to frontier bio capabilities
Crucially, the best AI models are needed to accelerate research and development of antivirals and vaccines with broader and longer-lasting protection, especially for novel threats that bioterrorists might develop.
Frontier bio capabilities are accessible only via trusted access pathways which are even more restricted than their cyber equivalents — rightfully so, given the more drastic consequences of errors. Currently, OpenAI offers the Trusted Access for Biology Research program, the frontier bio model GPT-Rosalind, as well as the biodefence-focused Rosalind Biodefense project. Anthropic has started rolling out a similar bio-focused program only for a set of US organizations.
One of the preconditions of the available OpenAI trusted-access pathways for research institutes and companies is to fulfill security requirements and have designated responsible staff — this is one area where every organization can act now to prepare. But more broadly: Europe, and European entities at every level, need to both seek inclusion through formal channels for trusted access schemes and develop the necessary structures and documentation to get approved.
To be clear, the case here is for a narrow, vetted, auditable pathway for defensive work. The security preconditions have to be strict, precisely because the consequences of getting this wrong are the ones described above. Europe’s contribution to this problem should be as a third party that takes defence seriously, not a third competitor in the capability race. Therefore, the infrastructure of organizations that receive access has to be as secure as possible against threats from both the outside and the inside, with clear usage policies and monitoring to detect unauthorised external or dangerous internal access — the Hugging Face incident gave us a first idea how devastating cyber vulnerabilities can be; this only becomes more crucial with advanced bio capabilities. The EU NIS2 Directive for securing network and information systems is a first step, but needs to expand to universities and research organizations and be implemented quickly.
Institutional readiness: coordination and defence
We propose to accelerate these efforts in a coordinated fashion in the European Union, as one part of a wider AI trust infrastructure. The EU Commission has published plans for a European Blueprint for Structured Access to Advanced AI Capabilities for Cybersecurity Purposes with ENISA — but no similar programme exists yet for biological threats, despite the higher severity. The fast route would be extending the cyber blueprint to cover access to frontier biological capabilities. Establishing a dedicated biodefence track might cost years.
The EU should accelerate the legislative process for its European Biotech Act, which is a strong proposal with the requirement for mandatory synthesis screening, but needs amendments to strengthen the mandate of the Advisory Group on Biosecurity. Similarly, the threat modeling and model evaluations of the EU AI Office CBRN evaluation consortium are a good start, but are dependent on access to the frontier models in question, and we need to move beyond just evaluations and on to preparedness. And even if we can design and test vaccines and drugs faster, regulatory and evaluation pathways will need to keep pace, through faster assessment procedures that do not lower safety standards.
Importantly, each level in Europe, from the EU Commission, through states, down to individual organisations, needs to take action and take on responsibility. The EU AI Office could emerge as the coordinating center for many of the AI-related questions and tasks, but would need the funding appropriate for the significance of the mission: securing trusted access to the frontier AI models we need to defend ourselves.
As stated above, these points should be seen as just one example of the changes we need to achieve in Europe to stay sovereign and work towards a better future. For more information, see the Accelerate Europe initiative website, and subscribe to this substack.
This article was updated on September 14, 2026 to include Anthropic’s Detecting and countering misuse of AI report, which includes five case studies of biological dual-use real world research projects.
Views expressed in this text are our own and do not represent those of our employers.
Authors:
Peter Stepper is a molecular biologist working on technology development in functional genomics and spatial transcriptomics. He is currently a Senior Postdoctoral Fellow at CeMM Research Center for Molecular Medicine (ÖAW). He writes here as Senior Advisor AI×Bio with Accelerate Europe.
Stephan Reichl is a biomedical data scientist at CeMM Research Center for Molecular Medicine (ÖAW) and the Institute of Artificial Intelligence (MedUni Vienna) applying bioinformatics and ML/AI to projects in cancer, immunology, neuroscience and single-cell biology.
Matthias Samwald is Associate Professor at the Institute of Artificial Intelligence (MedUni Vienna). His background spans technical AI research, biomedical informatics, and European AI policy. He co-chaired the Safety & Security chapter of the EU General-Purpose AI Code of Practice, the first regulatory framework for frontier AI models, and serves on the EU AI Act Scientific Panel.