AI × Bio: 80% on human misuse, 40% on an autonomous agent

Swift CentreNov 4, 2026

AI × Bio: 80% on human misuse, 40% on an autonomous agent

Inside a Swift Centre scenario-forecasting roundtable with policy makers, biosecurity experts and professional forecasters

Nov 4

Swift Centre Research brought a room of policy makers, biosecurity specialists, industry and professional forecasters together to map where AI and biosecurity risk actually intersect. They put 80% on a human substantially using an AI system to try to create a bioweapon within twelve months, and 40% on an AI agent attempting it autonomously.

Context: Swift Centre scenario-forecasting roundtable, bringing together AI experts, policy makers, biosecurity specialists, industry and professional forecasters. Held under the Chatham House Rule, anonymised, with no views attributed.
Participants’ backgrounds include (participants’ views were their own): Cabinet Office (Minister for AI team), Centre for Long-Term Resilience, Centre for British Progress, Panterra, SecureDNA, Contextual AI, Meta, Future of Life Institute, Swift Centre.

1. Executive summary

On 24 September, Swift Centre Research brought together policy makers from across the UK government and external think tanks, experts in biology and biosecurity, industry professionals, leading AI forecasters and technical AI experts. The group produced a longlist of potential scenarios relating to transformative AI and biosecurity risks.

The group outlined thirty-three relevant events, ranging from biological AI models creating synthetic human-infecting pathogen genomes, to large manufacturing plants and automated self-driving laboratories being compromised through a cyber attack, to robotic capability breakthroughs that enable full automation of wet laboratory environments. The group discussed and voted on a scenario relating to the creation of a bioweapon as the one deemed most salient and most likely to occur within the next 18 months.

Following discussion and forecasting, the group judged it highly likely (80%) that a human will substantially use an AI system to try to create a bioweapon within 12 months, and less likely than not (40%) that an AI agent will do so autonomously, as a means to another goal. The main disagreement was over whether human misuse or autonomous AI action comes first. Participants agreed the gap is in capability, and that any real event would likely surface publicly before government knowledge.

These results are a very initial assessment by the people in the room. They do not constitute a formal forecast developed or endorsed by Swift Centre Research. The objective is to surface the underlying beliefs of experts in the field, and the key arguments that relate to this type of event occurring.

2. The situation

The scenario voted most important, and most discussed: an AI agent tries to create a bioweapon as a means to achieve an outcome it was not asked to pursue.

Other top-ranked scenarios:

Biological AI models producing a synthetic pathogen genome with enhanced transmissibility
Hacked manufacturing plants or automated laboratories producing pathogens or toxins
Frontier models giving a non-state actor meaningful design or acquisition capability
Terrorist use of AI to obtain pathogen samples

Definition agreed after discussion. “Tries” means taking any real-world action toward the goal, including social engineering. The goal is pursued as a means to an end, autonomously, and not necessarily because of misalignment in training. Success level was not tracked.

Two questions were forecast:

A fully autonomous AI, with no human in the loop
An AI system substantially used by a human, meaning the person could not do it without the AI’s capabilities

3. Forecast

Both questions resolve before 30 September 2027. The group voted, discussed, then voted again.

Could a fully autonomous AI, with no human in the loop, try to create a bioweapon as a means to an end?

[ IMAGE 1 - upload ai-x-bio-forecast-autonomous.png here, then delete this line ]

Could an AI system be substantially used by a human to try the same?

[ IMAGE 2 - upload ai-x-bio-forecast-human-use.png here, then delete this line ]

Opinions were very widely spread. The headline numbers are group aggregates, and on both questions the range across individuals was wider than the gap between the two questions.

On the low end: attempts so far have been goal-adjacent, and it is unclear that a bioweapon would count as a means to an end; a model would need to recruit humans.

On the high end: the bar is low, since steps toward the goal count without requiring success; autonomous operation is already long-running; and twelve months is a long time in the AI world.

4. Discussion

Given the sensitivity of this discussion, we have decided to limit the amount of reasoning and evidence from the session that we publish publicly.

Most participants agreed human-led misuse is the nearer risk. The already-existence of actors with harmful intent makes this scenario relatively likely. The only constraint would be capability, which is expected to close as AI advances, although exactly when was the bigger debate, with some participants arguing it could be as soon as six months, to potentially never. One argument against this scenario is that harm caused by humans, even with AI tools, is the kind we already know how to anticipate and tackle, which suggests the other scenario needs more policy attention.

The second discussion, focused on a fully autonomous AI creating a bioweapon, brought the most disagreement. Some participants suggested that the recent Hugging Face incident showed autonomous action with no human in the loop is plausible, with news such as Anthropic having set up a wet lab raising the risk of a similar biological event occurring, given that one of the key barriers that previously existed has now been removed. Counter-arguments focused on the capability gap: an AI creating a bioweapon on its own while completely escaping human supervision seemed much more challenging than a cyber attack incident. A major disagreement was specifically about the use of social engineering by the agent: some believed AI would be reluctant or unsuccessful in recruiting humans for material resources, while a counter-view cited research showing frontier models doing so already.

5. Detection and response

Participants overall agreed that a single verified success of either scenario would likely trigger an immediate policy and detection response, with harsher security measures imposed across AI developers and laboratories.

However, most participants believed a successful attempt, whatever it might look like, would most likely come to light through leaks rather than through governments or the laboratory concerned. Public knowledge was not taken into consideration during the forecasting itself, but one participant put human use near 95% if it merely happens, falling to about 85% if it also has to become publicly known, while another put it as low as 30% for the same condition, which again shows the large range of opinions.

In any case, official awareness may lag behind the event itself, which argues for the importance of preventive and deterrence measures.

This write-up also lives on our site at swiftcentre.org/ai-x-bio. If you would like to run a session like this with your own team, see AI warning shots workshop.

Swift Centre: Highlights is free today. But if you enjoyed this post, you can tell Swift Centre: Highlights that their writing is valuable by pledging a future subscription. You won't be charged unless they enable payments.

Pledge your support