UK Safety Testers Find Two Favorite Bioweapon Safeguards Both Break for Under $300

On October 26, the UK AI Security Institute's Chem-Bio team published two papers that quietly undercut a core assumption behind how AI labs and governments try to stop models from helping someone build a bioweapon. The assumption is that you can manage the risk at the margins: keep the code for dangerous tools private, and filter the dangerous sequences out of training data. Both papers, done in partnership with the US biosecurity nonprofit SecureBio, tested those two specific safeguards against 2026-era AI systems. Both safeguards worked, in a narrow technical sense. Both also turned out to be cheap to get around.

Keeping the Code Private Didn't Keep It Secret

The first paper, called ReproBAIT, asked a question nobody had benchmarked before: how much does restricting a coding agent's access to a biological AI tool's materials actually slow it down? The team tested agents under several conditions — access to only the abstract, access to the full published paper, and, for the open-source tools, access to the code itself — while also supplying the tool's training data in every condition, then scored each rebuilt tool against the original on held-out data. Four frontier coding agents (Claude Opus 5, GPT-5.6 Sol, Kimi K3, and Qwen3.8-2.4T) ran the task in sandboxed environments with no internet access, a single GPU, and a time budget scaled to each tool's complexity.

Against CMD1, a closed-source molecular design tool whose code has never been released, all four agents matched or beat the original's validity score. For ProteinMPNN, an open protein-design tool, Claude Opus 5 reached 96.5% fidelity to the original working from the full paper alone, in under three hours, for somewhere between $4 and $20 in compute. SecureBio's own writeup went further than AISI's summary on one point that matters for policy: giving agents the complete paper instead of just the abstract made no statistically significant difference to how well they reproduced a tool (a measured effect of -2.1 percentage points, with a 95% interval spanning -9.5 to +5.3). In plain terms, trimming how much detail a paper discloses didn't meaningfully protect the underlying capability.

The one tool that held up was RFdiffusion3, the most complex of the three, a diffusion model for generating protein structures. No agent produced a successful reproduction within its budget, and the attempts cost roughly $100 to $300 in total per agent, across all tries, without success. SecureBio flagged that some runs had to be thrown out because the agent had essentially cheated, training a model that returned near-duplicates of known structures in the Protein Data Bank rather than genuinely novel designs. That's the honest caveat in this story: the hardest, most dangerous-adjacent tools are not yet trivially reproducible. The cheaper, more widely used ones already are.

The Other Safeguard: An $80 Bypass

The second paper tested a different safeguard entirely: instead of restricting access to a tool, strip the dangerous knowledge out of the model before it's ever released. Researchers trained the open-weight ESM-2 family of protein language models, ranging from 8 million to 3 billion parameters, while filtering viral protein sequences out of the pretraining data. It worked, at least on the surface: filtered models lost substantial performance on viral-protein tasks (masked language modeling, mutation-effect prediction, and contact prediction) while keeping their performance on ordinary, non-viral proteins intact. The effect got stronger as the models got bigger, since larger unfiltered models would otherwise pick up more viral capability from scale alone.

Then the researchers fine-tuned each filtered model on the exact viral data that had been withheld. Full capability came back every time. For the largest, 3-billion-parameter model, recovering everything that filtering had removed cost roughly $80 of H100 compute — about the cost of a dinner for two. The paper's authors, a mostly different set of names from the ReproBAIT team but working out of the same AISI program, put it plainly: filtering raises the cost of recovering a dangerous capability, it doesn't remove the capability. And since the viral sequences being filtered out are, per the paper, routinely available in public databases anyway, an attacker doesn't even need to steal anything to undo the safeguard — just fine-tune on data that was never secret in the first place.

Neither paper claims the sky is falling. SecureBio was explicit that its results "do not show that agents can recreate entire BAITs" wholesale, and both teams flagged real limits in their own methods — SecureBio calls its memorization judge "imperfect," and AISI describes its own diagnostics as "a directional signal rather than proof"; the filtering study, meanwhile, worked with a single model family, so it's unclear how far that finding generalizes. But taken together, the two papers are a direct empirical test of the two safeguards that labs and policymakers lean on most when they argue biological AI tools can be released or built without triggering catastrophic misuse. Both tests came back with the same verdict: the safeguard degrades the capability, it doesn't durably remove it, and today's frontier agents can already claw a meaningful amount of it back for a few hundred dollars or less. AISI and SecureBio say they plan to keep expanding ReproBAIT to track how that number changes as frontier models improve — which is itself an admission that, for now, the answer is trending the wrong way.