How the prior work of Brent and collaborators establishes the threat model, the empirical basis, and the technical framework the present proposal extends.

For over 25 years, commencing with the DARPA Unconventional Pathogen Countermeasures/Advanced Diagnostics programs, Roger Brent has advised US government bodies on defense against biological attack and emerging infectious disease. In June 2024, he closed his biological laboratory at the Fred Hutch to commit fully to AI × bio safety and committed to building a public publication record in this work. His understanding of this space led to the idea of approaching arXiv, bioRxiv, and biological-software developers and soliciting the active participation of the directors of those servers (support letters attached).

In a strategy document, Brent (2005) established the first part of the threat model within which this entire project operates: democratized biotechnology creates ever increasing catastrophic risks that static defenses cannot address. AI only makes it worse.

Brent, McKelvey & Matheny (2024) in Foreign Affairs reviewed the 20th century history of biological warfare and showed how modern biotechnology/synthetic biology powered by AI could bring about catastrophe. Brent & McKelvey (2025) showed that then contemporary foundation models used as chatbots already increased biological-weapons risk.

Building on that and a serendipitous observation from July 2025, he and coworkers (Barkan et al., in prep., to appear via RAND) introduced the concept of “LLM repellents” — text and code strings that biological-software developers can embed in their tools to create friction when AI agents attempt to operate them. This work, still unpublished, lays out the technical framework that Aim 1 of the present proposal directly extends.

He led a group (Williams et al. (2026)) that developed a risk-scoring method for how AI might be aiding execution of biological methods that could produce more dangerous viruses. The team identified five functions of interest: host range, genome replication, countermeasure evasion, environmental stability, and transmission dynamics. In that work the team unearthed genuinely alarming dual-use papers from more than 25 years ago. The method was complex enough to require multiple LinkedIn posts simply to explain the approach and its implications: the explainer post and the how to use it post.

References