AISI Studies Find Bio-AI Filtering and Code Withholding Easily Defeated

Two studies from the UK AI Security Institute find that common strategies for limiting dangerous biological AI capabilities have low barriers to defeat. For protein language models, filtering viral protein sequences from pretraining data reduces model performance on those sequences, but fine-tuning on the excluded data fully restores the capability across all tested model sizes. Recovering the capability in the largest tested model, at 3 billion parameters, cost approximately $80 of H100 compute. Viral protein data is routinely made publicly available even when excluded from model training, keeping the excluded data accessible. Separately, a joint study by AISI and SecureBio built a benchmark called ReproBAIT and tested whether coding agents could replicate functions of biological AI tools given only published papers and training data. Four coding agents, Claude Opus 5, GPT-5.6 Sol, Kimi K3, and Qwen3.8-2.4T, were tested in isolated sandboxes without internet access. Given a tool's description plus training data, agents matched selected metrics of two of the three tested biological AI tools but did not successfully rebuild RFdiffusion3, the most complex tool tested. Reproduction cost ranged from $4 to $20 on a single GPU. AISI concluded that withholding code does not by itself make a biological AI release safe, and that controlling access to underlying training data looks more promising.