AI-redesigned toxin sequences slipped past DNA synthesis screening

A paper published in Science on 2 October describes finding a hole in the screening systems that commercial DNA synthesis companies use to avoid manufacturing dangerous genetic sequences, and then closing it [s1].

The vulnerability is a consequence of what AI-assisted protein engineering is good at. Advances in that field are enabling breakthroughs in the life sciences but also introduce new biosecurity challenges [s1].

Why DNA synthesis is where the control point sits

If someone wants a protein, they generally need the DNA that encodes it, and for most purposes that means ordering synthetic DNA from a commercial provider. Nucleic acid synthesis is a choke point in AI-assisted protein engineering pipelines [s1] — a place where a physical, commercial transaction interrupts an otherwise purely computational process.

That is why biosecurity effort has concentrated there. Providers screen incoming orders against databases of sequences of concern. The screening works by looking for similarity to known dangerous sequences, and similarity is the assumption the whole system rests on.

What the researchers tested

They evaluated whether open-source, AI-powered protein design software could create variants of proteins of concern that would evade detection by the biosecurity screening tools used by nucleic acid synthesis providers [s1].

It could. The paper reports a vulnerability in which AI-redesigned sequences could not be reliably detected by the tools in use [s1].

The reason is structural rather than a bug in any one product. Generative protein design tools are built to produce sequences that fold and function like a target protein while differing from it in primary sequence. That is the point of them. Screening built on sequence similarity is therefore looking for exactly the property these tools are designed to discard, while function — the property that actually matters for hazard — is preserved.

What they did about it

The team developed and deployed patches, greatly improving detection rates of synthetic homologs more likely to retain wild-type-like function [s1].

Two details in that sentence are worth separating. "Deployed" indicates the fixes went into the tools before publication, rather than the vulnerability being disclosed and left for others to address. And the targeting is functional: the patches improve detection specifically of redesigned sequences judged more likely to retain the original protein's activity, which is a narrower and more useful criterion than flagging everything that superficially resembles a concerning sequence.

The disclosure question

This is dual-use research, and how it was handled is part of what it demonstrates. The paper reports a capability gap and a remedy in the same publication, with the remedy already in place. That is the coordinated-disclosure model familiar from computer security, applied to biological design tools.

It is not a costless model. Publishing that AI protein design can evade sequence-similarity screening is itself information, and patched tools are not universally adopted — screening is voluntary in many jurisdictions and uneven where it is required. A patch improves the systems that run it.

What this does and does not establish

The study demonstrates that current screening tools could be evaded by redesigned sequences and that detection can be improved [s1]. It does not demonstrate that anyone has done this, that redesigned sequences ordered this way would function as intended in a laboratory, or that synthesis screening is the only barrier that would need to fail for harm to result.

Nor does it settle the more general problem, which is that this is a moving target. The patches address detection of synthetic homologs from the tools tested. Protein design software continues to improve, and each improvement in generating functional sequence diversity is, by construction, an improvement in evading similarity-based detection. Screening built on a different principle — predicted function rather than sequence resemblance — would be a more durable answer, and the paper's functional targeting is a step toward it rather than an arrival.

What to watch

Three things determine whether this result matters in practice. Whether the patches propagate to the full set of providers rather than the subset that participated. Whether screening moves from voluntary practice to regulatory requirement in major jurisdictions. And whether the next generation of design tools reopens the gap that this work closed.

The broader lesson is about where safety effort in AI-for-biology can usefully go. Model-level restrictions on what design software will produce are hard to enforce on open-source tools that anyone can run locally. A physical choke point where an order must be placed with a company is a comparatively tractable place to intervene — provided the screening at that point keeps pace with what the models can do.

Sources

• Strengthening nucleic acid biosecurity screening against generative protein design tools — Science, 2 October 2025