AI biosecurity safeguards tracker: what has been tested, what failed and what is still open

Biological AI safeguards are being tested in public, and the results so far are mixed. This tracker logs the dated evidence in one place so a reader can see which safeguards have been tried, what the tests showed, and what remains untested. It is a living page: when a new evaluation, policy or incident is published, we will update it through a correction rather than write a new article. Last updated: October 28, 2026. No named person is quoted in this log beyond the cited authors, so there is no pull quote.

How to read this tracker

Each entry gives the date, the source, what was tested and the finding. We separate tested (someone ran an experiment and published a result) from announced (a program or promise exists, but no result is public). We mark each source as independent or vendor. Where a result is a preprint, we say so.

Data filtering at pretraining

October 19 to 26, 2026. UK AI Security Institute and co-authors. Tested; preprint. The team pretrained ESM-2 protein language models from 8 million to 3 billion parameters with viral proteins removed. Filtering substantially reduced viral-protein performance across three tasks while preserving non-viral performance, and the effect was stronger in larger models. Continued training on the withheld data fully restored viral performance, and recovery in the 3 billion model cost about $80 of H100 compute. The authors call filtering a selective, partial safeguard that needs complementary measures. Limits: one model family, imprecise recovery-cost measurements. Our full report on the study ran alongside this tracker.

Withholding code

October 26, 2026. UK AISI with SecureBio, ReproBAIT. Tested. Four agent setups (Claude Opus 5, GPT-5.6 Sol, Kimi K3 and Qwen3.8-2.4T) tried to rebuild three published biological AI tools from a paper, on one GPU with no internet. Two simpler tools, ProteinMPNN and the closed-source CMD1, were rebuilt for roughly $4 to $20; Claude Opus 5 reached 96.5% fidelity on ProteinMPNN sequence recovery with the full paper. RFdiffusion3 was not reproduced within budget, and attempts cost $102 to $301 each. The authors say withholding code does not by itself assure control and that controlling the underlying biological data appears more promising. They also say the results do not prove full reproduction, and note possible memorization.

Independent evaluators

October 15, 2026. Anthropic. Announced; vendor source. Anthropic described a three-tier evaluator access model. METR, with six employees onboarded, holds the third tier with employee-like access. SecureBio and Accenture are named as other evaluators, and SecureBio is reviewing the chemical and biological weapons chapter of the August 2026 Risk Report, following a pilot review of the previous report in February 2026. No SecureBio finding is public as of this update. Related coverage: Anthropic's employee-like access for METR.

Verified-user access

October 22 and 27, 2026. Anthropic. Announced; vendor source. Anthropic's open call for guest investigators in the life sciences offers 8 to 12 weeks of collaboration at no charge, with results to be published and data and code open-sourced. Its October 27 drug-development post describes a Life Sciences Verification Program that gives scientists direct access to its most capable publicly available models for biology, with more permissive safeguards for trusted organizations. The criteria and the rate of denials are not public in the pages we read.

Government side

The UK's funding commitments for an AI biosecurity lab sit outside the tested-evidence log above; see our report on the UK biosecurity lab for what is funded versus announced.

What is not yet public

The log has gaps worth stating. No independent replication of the filtering result on a non-ESM-2 model has been published that we have found. No evaluator has published a biology finding under the new access tiers. No verification program has released outcome data. There is no public standard that says how much recovery cost counts as durable.

Why the cost figures matter

Cost is the common thread. A safeguard is only as strong as the price of getting around it, and the two AISI studies put numbers on that price. Roughly $80 of GPU time undoes a filter on the largest filtered protein model tested, and $4 to $20 buys a rebuild of a simple tool. Those are far below the cost of building the original models. They are also far below the cost of a wet-lab program, which remains the real bottleneck for anyone trying to turn a model output into a physical outcome. The studies do not measure that step, and neither does this log. What they measure is the digital half: how cheaply a capability can be restored or recreated once someone wants it.

That is why both teams point toward data governance. Data about dangerous organisms is the input that every route depends on, and it is the one input a regulator can plausibly restrict. The counterargument is that the sequences are already public, which the filtering paper itself notes.

How we will update this page

We add an entry when a primary source publishes a new test, policy or incident, and we edit an existing entry only with a dated note. Corrections go through the same loop. Items that would earn a new entry: a replication or a rebuttal of the AISI filtering result; a SecureBio or METR biology finding; a lab's change to its biology safeguards; a government rule that names a data-control requirement.

Our take

The pattern across October 2026 is consistent. Every cheap safeguard tested in public was soft, and every strong-sounding one is still untested. That favors layered controls and a stronger focus on data governance. Watch for the first independent biology finding from an evaluator with real access, since that will say more than any further announcement.