The knowledge used to prevent infections can also be misused. Through a personal reflection on gaming, AI, and biological research, an infection preventionist explores why faster answers make human judgment, peer consultation, and accountability increasingly important.
The real world mirrored this duality. In 2013, the CDC invited the game’s developer to speak at its headquarters about the game's potential to teach epidemiology.1 By February 2020, China banned it entirely.2 Same simulation, opposite judgments, depending on who holds it.
As an infection preventionist (IP), I have thought about that duality ever since, especially with the rapid growth of AI. Combine domain expertise, a bit of curiosity, and an unrestricted platform on your couch, and people will be people. I know because I am one of them.
Earlier this month, Anthropic released Detecting and Countering Misuse of AI, documenting threat activity identified between December 2025 and August 2026.3 The section on biological threats is where I stopped.
Anthropic uncovered these cases in system logs despite user efforts to hide their tracks via third-party channels.3 While older models fell short, newer generations can support sophisticated scientific tasks: assisting in making existing pathogens more dangerous or creating brand new ones. Anthropic also noted that, to its knowledge, no private company had previously published evidence of potential misuse of its own platform for biological weapons development.3
Biological Case Studies: 3 Pathogens, 1 Pattern
Anthropic is careful about who these people are. It describes them as working scientists, and it is clear that this report does not assert any intent to harm.3 That is the core dilemma: biological expertise is inherently dual-use. Sophisticated actors exploit that ambiguity as a form of plausible deniability, sometimes to the point that the researchers using these models may themselves be unaware of the aims of their work. The report draws a historical parallel to the Soviet Biopreparat program, which employed thousands of scientists who believed they were doing routine or defensive research because no one told them the program’s real purpose.3
The report presents 5 case studies. I’m including the 3 that involve pathogens with direct implications for infection prevention practice.
Anthropic’s biological safety classifier blocked a request for grant writing assistance for gain-of-function research on the chikungunya virus. The goal: to enhance the virus’s transmissibility and its ability to evade the immune system.3 The proposal outlined identifying mutations, engineering them into infectious clones, and repeatedly passing the virus through live animals to select the most disease-causing variant. While this research could reasonably be used to support the development of vaccines or treatments, it could also be used to make the virus more virulent.
Chikungunya holds implications for IPs. Because it is mosquito-borne and not transmitted person-to-person, an intentional release would take longer to detect. Surveillance systems would initially assume a spike in cases is simply an abnormally active season.3
How Anthropic uncovered it: Investigators flagged the activity after noticing the grant described civilian researchers doing work intended for a military research institute. They found that the request originated from an intermediary service reselling access to circumvent regional restrictions. The service automatically rerouted questions it refused to a competitor’s AI. When Anthropic banned the accounts, the operator re-established access within days under fresh identities. The research itself continued, with subsequent materials describing the viral modifications in terms that emphasized loss of function rather than gain.3
Anthropic detected a researcher outside the US planning experiments on highly pathogenic avian influenza (H5N1). Specifically, adaptation to mammals and the mechanism for disseminating severe disease beyond the respiratory tract. This is a strain for which most humans have no prior immunity, and infections are fatal in roughly half of confirmed human cases.3,4 While it does not readily spread person-to-person, there are documented cases from direct contact with birds, livestock, and other infected animals, such as domesticated cats.5
For an IP, that last part would mask the true risk. The CDC describes the first US human case linked to exposure to dairy cattle as the first likely instance of mammal-to-human spread of this virus.6 Sustained human-to-human transmission has not occurred, and the CDC continues to assess risk to the general public as low.7 But the traits that the researcher was working to engineer, mammalian adaptation and airborne transmissibility, would be devastating.
How Anthropic uncovered it: The researcher used an account that masked their location and identity, from a location Anthropic does not serve.3 They exchanged thousands of messages over several weeks on study design and data analysis. The good news is that the safety restrictions worked; the user was unable to access the more robust models. Despite the researcher’s best efforts, what they were able to pull from the model was limited to clerical support.3
The third case involves the most consequential pathogen family in the report and is the one in which no safeguard was engaged at all.3
An account authored a grant application for orthopoxvirus research at a state-associated infectious disease laboratory. The application described access to high-containment facilities and planned work with live orthopoxviruses. Orthopoxviruses include variola, the agent of smallpox, and mpox. Routine smallpox vaccination ended decades ago, with limited remaining human immunity.3
The grant proposed identifying genes that shut down a particular host antiviral pathway and confirmed that deleting one of them attenuates the virus in mice, stripping it of its ability to cause disease.3 The implications of this are clear: learning which genes to prevent infection can also be used to make it more infectious.
How Anthropic uncovered it: The account was anonymous, and access was resold and shared by more than 12 unrelated customers.3 Tens of thousands of messages were exchanged across the group over days. The actual grant application was written in a single session. It included a central hypothesis, experimental design, dosing, statistical plans, and contingency strategies. The safeguard was not triggered; the focus was on attenuation, not gain of function.3 Across all 3 cases, the same handful of methods appear (Table 1).
The system read the framing, not the work. That distinction does not stay in the report.
The Person in the Case Studies
Reading those 3 cases, the Plague Inc. tablet was the first thing that came to mind. Because I recognized the person in those case studies, someone with deep content expertise and a burning research question could arrive at an answer that could be used in a way they did not intend. The report made it clear that none of the cases described were known to have been used in the creation of a weapon.
The IP writing an exposure investigation and the researcher writing a poxvirus grant are asking the model for the same kind of help. What differs is not the request. It is what happens downstream of the answer. The report does not draw a line between good people and bad actors, and I think that is deliberate. Malicious actors did not just use the documented evasion methods; they were real-world accounts of working researchers actively bypassing friction to achieve their aims.
What stayed with me longest after reading the Anthropic report was how easy it was to see the motivation behind the evasion. The case studies were examples of subject-matter experts creatively removing friction to achieve the outcomes they wanted. The same thing we all do at work every day. The difference was the subjects and topics, not the barriers.
Not long ago, a question you could not answer meant a phone call. Another IP, a mentor, a colleague who had seen something similar. That conversation did more than answer the question. It slowed you down, invited pushback, and forced you to say out loud what you were actually asking and why. AI does not do any of that. It answers. Quickly, confidently, and without knowing what it does not know to ask.
The pause that used to live in that phone call belongs to us now. It always did.
References
