This post investigates emerging biorisk capabilities and when AI systems may cross important risk thresholds.

It lays the groundwork for a broader risk forecast (currently in progress) on the annual likelihood of AI-enabled biological catastrophes.

For now, the analysis focuses on general-purpose AIs such as large language models (LLMs). A later post may examine Biological Design Tools—specialized AI systems that represent another major driver of AI-enabled biological threats.

This is my median timeline for significant biorisk capability thresholds:

Now: AIs can support human experts in acquiring and deploying biological weapons, but cannot yet assist in the research required for developing novel biological weapons.
Late 2025: AIs can support human novices in acquiring and deploying biological weapons but cannot yet assist in the research required for developing novel biological weapons.
Late 2026: AIs can support human experts in developing novel biological weapons.
Early 2028: AIs can support human novices in developing novel biological weapons.

Biorisk Capability Evaluations

The most thorough published evaluations of AI biorisk so far come from Anthropic and OpenAI, which report their findings in system/model cards (notably for Claude 4 and GPT-5).

Both companies assess whether their AIs have crossed capability thresholds that indicate significant risks. The frameworks differ slightly:

OpenAI checks whether models reach High or Critical capability in dangerous domains, including biological and chemical threats. (See their Preparedness Framework)
Anthropic checks whether models reach CBRN-3 or CBRN-4 capability levels (Chemical, Biological, Radiological, Nuclear). (See their Responsible Scaling Policy)

High capability / CBRN-3: the AI can substantially assist novices (e.g. people with an undergraduate STEM background) in creating or obtaining dangerous weapons.

Critical capability / CBRN-4: the AI can substantially assist experts in developing novel threat vectors (e.g. pandemic-capable agents).

Anthropic also has general capability thresholds called AI Safety Levels (ASL). When CBRN-3 and 4 have been reached, the AI is at ASL-3 and ASL-4 respectively. So, when you see a phrase like “ASL-3 red teaming for biological capabilities”, it means the system is being tested at the CBRN-3 threshold.

Summarizing the companies’ evaluation frameworks:

Both companies focus their evalua...

Health / Medicine / Disease