What the Anthropic September 2026 report says about biosafety risks of AI
24 September 2026
Donald Harvey Marks MD PhD
Anthropic's September 2026 threat intelligence report, Detecting and Countering Misuse of AI, details malicious operations disrupted between December 2025 and August 2026 involving the Claude model family. This report sits at the center of a difficult choice: the same AI capabilities that could accelerate medicine (rare diseases) and vaccine development (COVID) are also directly applicable to potentially dangerous gain-of-function research (Wuhan Institute of Virology) and, in the wrong hands, biological warfare.
Key Findings of the Anthropic Report
Seven Core Harm Areas: The report covers disruptions across cyber operations, influence operations, surveillance, scams/fraud, biological misuse, conventional weapons development, and illicit model distillation.
Models Involved: Misuse cases primarily utilized Claude Haiku, Sonnet, and Opus models, with no involvement from advanced Fable or Mythos-class models (except for one illicit distillation case).
Notable Incidents:
Banned a China-based, PRC-aligned intelligence operation using Claude to build Chinese-language dossiers for transnational surveillance targeting Tibetan Buddhist civil society and the government-in-exile.
Identified an Iran-linked operator using Claude for targeting recommendations regarding U.S. naval forces in the Middle East.
Highlighted industrial-scale distillation campaigns by labs like DeepSeek, Moonshot AI, and MiniMax extracting Claude's capabilities.
Noted instances involving biological research queries relating to pathogens and toxins, alongside various state-backed cyber espionage campaigns.
The Core Dilemma: Dual-Use Research
Anthropic explicitly states in their recent report that biological research IS “dual-use”—the same knowledge that helps develop a vaccine can also be used to make a pathogen more dangerous. The report describes five cases where scientists used Claude for research that could support biological weapons development, while acknowledging the work could “certainly” have legitimate applications like vaccine and therapeutic development.
The Chikungunya Gain-of-Function Case.
The most detailed disclosed case involved a request for Claude to help write a grant application for gain-of-function research on the chikungunya virus. Does anyone see flashes of Dr Fauci and NIAID here? The proposed work aimed to alter the virus’s transmissibility and immune-evasion properties, seeking mutations to make this virus progressively more harmful. This is the textbook definition of gain-of-function research: genetically altering an organism to create a new or enhanced biological property. While it could improve vaccines, it could also make the pathogen more dangerous. The application was linked to a military research institute, though it suggested civilian researchers were involved.
Biowarfare Implications
This referenced Anthropic report treats the potential for biological misuse as one of the “most serious risks” of frontier AI models, warning of potential “catastrophic consequences” without proper safeguards. Annie Jacobsen describes these dangers in her 2026 fiction book BioWarfare, which I found rather believable and prescient. Beyond the chikungunya case, researchers also sought AI assistance for experiments involving highly pathogenic bird flu and other agents with potential weapons applications. Anthropic could not determine the users’ intentions with sufficient certainty, so it did not identify (oh, if course) the institutions or countries involved. To me, the intentions were fairly clear.
The Medical Counterpoint
The Anthropic report does not claim AI biological research is inherently malicious. Of course not. It repeatedly notes that the blocked requests could have served legitimate medical purposes, including vaccine and therapeutic development. Exactly, of course, right. The challenge is that intent is often ambiguous at the query stage—a request to enhance a virus’s transmissibility could be for pandemic preparedness research or for weaponization. The recent book Biowarfare, by Annie Jacobsen, highlights many of the dangers inherent in this research , and although fictional, certainly has a lot of truth to it
The Bottom Line
The Anthropic report’s biological findings are best understood not as evidence of an imminent bioweapon, but as a demonstration of the dual-use problem in practice. AI is lowering the expertise barrier for complex biological research, making it harder to distinguish between legitimate medical inquiry and dangerous gain-of-function work aimed at weaponization. This is why Anthropic has activated stricter safeguards (ASL-3) specifically targeting CBRN-related queries. What about other AI companies here and in China?
In context, the US government has officially banned financial support for dangerous gain-of-function research under the U.S. Government Policy for Stopping High-Risk Life Sciences Research released by the Department of Health and Human Services (HHS) and the Trump administration in 2026. Core policy details include:
Explicit Prohibition: Bans federal taxpayer funding for high-risk, dangerous gain-of-function research globally and domestically.
Definition: Targets work on pathogens or toxins engineered to increase transmissibility or pathogenicity.
Enhanced Oversight: Mandates independent, top-down risk assessments and stringent reporting protocols for broader life sciences studies.
I think that this 2026 policy builds on the previous policy of President Nixon, who in 1969 unilaterally terminated the United States' offensive biological weapons program. The Statement on Chemical and Biological Defense Policies and Programs (formalized via National Security Decision Memorandum 35) renounced the use of lethal and incapacitating biological agents. At that time, President Nixon ordered the destruction of existing bioweapon stockpiles and restricting all future research strictly to defensive countermeasures.
To clarify and place in context my comments on the Anthropic report, although I do not claim to be an expert in artificial intelligence, I often use AI applications. I do have expertise in the area of biological research, having both an M.D. and Ph.D. (Microbiology and Immunology). Both degrees are from U.C.L.A. I have submitted five research grant proposals to the NIH, one to DARPA, have published many articles (some are listed below) in peer reviewed medical journals, including on vaccines, and I hold several vaccine patents. I am a former military medical officer and researcher (Letterman Army Institute of Research), and I have taken biological warfare training at Fort Dietrich, Maryland. My bio pharma industry experience includes Aventis Pasteur (vaccines) and Hoffman LaRoche (anti-infectives).
References:
1. Anthropic report 2026 “Detecting and countering the misuse of AI".
2. Trump ends dangerous gain of function research. Karie Pavlich, Townhall 19 June 2025
4. The September 2026 anthropic report on AI dangers - what it means. DH Marks 18 Sept 2026
5. Anthropic quietly sets up biology lab as it ramps AI drug program - Reuters 18 Sept 2026
6. Claude discovers a novel enzyme system with CRISPR-like repeats. Sep 23, 2026.
7. Keller, D, Koster, FT, Marks, DH et al. Safety and Immunogenicity of a Recombinant Outer Surface Protein A Lyme Vaccine. JAMA, June 8, 1994, p 1764-1768.
8. Sigal LH --- Marks D, Malawista SE. A vaccine consisting of recombinant Borrelia burgdorferi outer surface protein A to prevent Lyme disease. Recombinant Outer-Surface Protein A. Lyme Disease Vaccine Study Consortium. N Engl J Med (1998 Jul 23) 339(4):216-22.
9. Kanesa-thasan N --- Marks DH et al. Safety and immunogenicity of NYVAC-JEV and ALVAC-JEV attenuated recombinant Japanese encephalitis virus--poxvirus vaccines in vaccinia-nonimmune and vaccinia-immune humans. Vaccine (2000 Oct 15) 19(4-5):483-91.
10. VanKampen KR --- Marks D, Elmets CA, and Tang DC. 2004. Safety and immunogenicity of adenovirus-vectored nasal and epicutaneous influenza vaccines in humans. Vaccine. 2005 Jan 11;23(8):1029-36.
11. Jonas Salk, Polio Vaccine and Vaccinating Against Hate. The healthcare discovery that saved the lives of millions of children. Remembrance of my afternoon in Paris with vaccine titan Jonas Salk. by Donald H Marks
Seven Core Harm Areas: The report covers disruptions across cyber operations, influence operations, surveillance, scams/fraud, biological misuse, conventional weapons development, and illicit model distillation.
Models Involved: Misuse cases primarily utilized Claude Haiku, Sonnet, and Opus models, with no involvement from advanced Fable or Mythos-class models (except for one illicit distillation case).
Notable Incidents:
