I recently sat down with Eric Nguyen, co-founder and CEO of Radical Numerics. He’s one of the people who taught artificial intelligence to write DNA, and is hoping to use AI to rid us of cancers and other diseases via targeted DNA editing and custom-built personalized-to-your-DNA medicines. But in the course of our conversation, he described a threat that sounded less like calm, academic biology and more like something out of a Hollywood cyber-thriller: a deepfake virus.
A deepfake biological virus is not something that attacks your phone or your laptop. It’s not after your money or your identity.
Rather, it attacks the cells in your body, and it threatens your health because it’s cloaked – deepfaked – so that it doesn’t look like any virus your body has ever seen before, and slips right through your immune system’s defenses.
“One could design DNA to essentially function like a virus, but be able to obfuscate or intentionally basically switch the letters around … so that existing detection systems cannot actually notice that it’s a virus that they’ve seen before,” Nguyen told me in a recent NEXT podcast. “So it’s rearranging the alphabet or rearranging the letters in a way that maintains the function, but then does not match what’s been seen before.”
That’s a real virus, but one re-engineered by AI to keep every dangerous function intact while quietly rearranging its own genetic sequence so that our artificial – and natural – screening systems never see it coming.
I was wondering if that was a problem for later. Maybe next year, or next decade.
Well guess what: later just showed up.
On August 6, a team of researchers from Stanford and the Arc Institute published a paper in Science announcing that they had used generative AI to design working viruses from scratch. These are the first functional genomes ever composed by a machine that have not been found in nature. The team generated hundreds of candidate genomes, synthesized almost 300 of them in the lab, and brought 16 of them to life as bacteriophages that successfully infected and killed E. coli.
Guess what AI models they used? Evo 1 and Evo 2 … models built at the Arc Institute by Eric Nguyen and others. So the man who warned me about deepfake viruses in an interview watched his own creation become the proof of concept a week later.
What the Stanford team actually built
First off, deep breaths. The Stanford research team did not build a superbug. They built bacteriophages: viruses that infect bacteria, not humans. Antibiotic-resistant infections kill something like two million people a year, and phage therapy is one of the weapons medical scientists have against them.
Designing better phages on demand can be a genuinely good thing.
They also did the responsible version of this experiment. They stripped human, animal, plant and fungal virus sequences out of their training data, so the model couldn’t learn to build viruses that infect humans or plants. And they ran the work in secure facilities.
But the capability speaks for itself.
What the Science paper shows is not just that AI can make a bacteriophage. It’s that generative models can now make functional virus genomes – coherent, working sets of genetic instructions — from a text prompt and a training set. That is no longer science fiction. And, importantly, the technique is agnostic. Aim it at phages and you get phages. Aim it at something else … and we’ll get something else. The reason we didn’t get something worse is that these particular researchers chose not to build it.
That’s not something we can assume of all teams in all countries.
Deepfaking viruses with AI
And that’s a problem.
There are some safeguards here, of course. DNA synthesis companies run screening software to flag dangerous sequences before they ship. Order something that looks dangerous and, ideally, the order gets stopped.
The trouble, Nguyen explained, is that AI can design genetic sequences that evade detection systems. Rearrange the genetic letters but preserve the function, and the pathogen could slip past the filter wearing a disguise … just like it slips by our immune systems.
There’s the same deadly payload, but with a different fingerprint. And that’s a biological deepfake.
“These AI biological foundation models, which are trained to be able to generate new sequences of proteins and DNA, you can then actually intentionally have them design things that can get around these detection systems, right?” he told me. “And that’s a concern that’s a growing concern for a lot of folks, especially at the national security level.”
This, of course, keeps biosecurity people up at night. Nguyen says our ability to design is sprinting ahead of our ability to defend. There are three pillars of biodefense: detecting an outbreak early, attributing it to a natural source or a lab or an attack and manufacturing countermeasures fast enough to matter. On each of them, he says, we are far, far behind.
Rules, regulations and laws don’t exactly cover this
You’d assume there’s some kind of regulatory body for this. And there is, sort of.
The U.S, recently prohibited federally funded gain-of-function research. But that framework was built for a world in which the threat is a scientist modifying an already-existing virus. It says very little about an AI composing a novel genome that never existed in the first place.
Plus, it’s just a rule about federal funding, not a general law. Even further, it only covers one country, not the entire world.
As biosecurity researchers Thomas Inglesby and Moritz Hanke put it after the Science paper dropped: the ability to compose viral genomes using generative AI now exists. But the governance to safely steer it does not.
Of course, this technology is powerful for good too
In reality, this technology has literally enormous upside.
AI that can read and write DNA could help us catch diseases earlier, design personalized drugs faster and manufacture antivirals on demand when the next pandemic hits. All of this is wonderful.
But there are some truly enormous downsides as well.
Interestingly, Nguyen’s changed his mind about openness as the stakes have risen. Evo was released openly: the DNA training data was public anyway. But newer and more powerful models from Radical Numerics are being kept behind closed doors, due to safety concerns.
The reality, however, is that collectively as a species we’ve built health detection systems for a world in which making a virus is hard. As of the last few months, it just got a lot easier. And that’s dangerous.
The 16 phages in that Science paper are harmless to you and me. But the machine that made that possible enables other feats as well, and faster than we can collectively respond.
Pandora is out of the box.
As long as that’s true, we essentially have no choice but to continue to develop this technology as a safeguard against others with fewer scruples who will use it for evil, all in the hope that we can create good-enough and fast-enough defenses that will protect us when the first AI-designed deepfake viruses start propagating. That’s a core capability that Nguyen says we can build: an AI system that can rapidly design new medicines to fight new threats, on demand.
Looks like we’ll need it.