On August 6, Stanford and the Arc Institute published the first peer-reviewed demonstration of a generative model designing complete, functional viral genomes. Sixteen of the designs assembled into working bacteriophages that infect and kill E. coli. None of them resemble anything in nature.

The number that matters is not 16. It is 14,466: the size of the curated sequence set the team fine-tuned Evo on to get the control they needed. And the number under that one is zero, as in the count of eukaryote-infecting viral sequences the base model was ever shown.

Those two facts are the whole safety story, and they point in opposite directions. The safeguard here is an absence in a training corpus. The paper is also, incidentally, a clean demonstration of how to put an absence back.

Evo 2 predicts the next base pair the way a text model predicts the next token. It was trained on 9.3 trillion nucleotides from more than 128,000 genomes, uses a StripedHyena 2 architecture at 40 billion parameters, and reads context windows up to one million bases at single-nucleotide resolution.

That resolution is the point. Protein design tools work on one self-contained molecule. A genome has to hold eleven genes, overlapping reading frames, packaging signals and replication origins in mutual agreement. Break one and nothing assembles. The team picked bacteriophage ΦX174 precisely because it is unforgiving: 5,386 nucleotides, 11 genes, several of them physically overlapping, so a mutation in a shared region has to satisfy two proteins at once.

Generation ran end to end in a single left-to-right pass with nothing inserted by hand. Brian Hie, who led the work with first author Samuel King, said that in lab tests "a few of Evo's suggestions had higher fitness than the native" phage. One design, Evo-Φ36, carried a packaging protein borrowed from a distantly related phage, a swap that had defeated earlier rational engineering attempts. Cryo-EM showed the shorter protein sitting at a different orientation inside the capsid, held there by compensatory changes elsewhere in the genome.

The therapeutic result is real. Against three E. coli strains already resistant to natural ΦX174, cocktails of the AI designs cleared resistance in all three within one to five passages. Natural ΦX174 alone failed outright. Bacterial antimicrobial resistance directly caused roughly 1.14 million deaths in 2021, and no phage therapy has full regulatory approval in the United States yet, so this is not a toy target.

Every containment measure in this paper worked. That is worth stating plainly before anything else. The question is which of them travel with the artifact after publication and which stay behind in Palo Alto.

This is the part that should interest you even if you never touch a pipette. Genome models give us the cleanest natural experiment anyone has run on whether removing training data removes a capability. The answer, twice measured, is yes. And the second half of that finding is that the removal is undone by the same mechanism the authors used to specialize the model in the first place.

The hit rate is low. Thousands of genomes generated, 285 taken to synthesis, 16 alive. Jordi García Ojalvo of Pompeu Fabra makes the fair comparison: everything that failed was, functionally, a hallucination, and every candidate has to be validated in wet lab one at a time. That is a very different risk profile from a text model that fails at zero marginal cost.

Evolution finished the job. Simon Jackson of Waikato notes that around half the functional phages had picked up mutations, suggesting that "natural evolution assisted in polishing those AI-generated designs". The phages that beat resistance were mosaics, recombinants stitched from two or three separate AI designs during passaging. Impressive, and not pure model output.

ΦX174 is the easy case. Tom Ellis at Imperial has pointed out it is about the smallest and most studied genome available. A coronavirus genome runs roughly six times longer, and difficulty scales steeply with length, on his estimate something like a hundredfold for that jump. Nobody has designed a genome at that scale.

Compute is a real gate, for a while. Running the 40 billion parameter model at full context is estimated to take roughly eight high-end GPU servers, a quarter to a third of a million dollars in hardware. That excludes a lone actor. It does not exclude a funded lab, and the number falls every year.

Hie's own argument deserves a fair hearing too, because it is the strongest case against restriction: existing pathogens are easier to obtain and easier to grow than anything a model designs, and you cannot install a safety filter inside natural evolution. Openness, on that view, produces defense faster than it produces offense.

Thomas Inglesby and Moritz Hanke of the Johns Hopkins Center for Health Security published a Perspective in the same issue. Their line is the one that traveled: the ability to compose viral genomes with generative AI exists, and "the governance to safely steer it does not". They credit the authors for engaging biosafety more deliberately than most model developers, and they draw a hard line against extending the method to viruses that infect humans, animals or crops.

Note the mismatch. The July 28 federal policy on high-risk life sciences bans funding for dangerous gain-of-function work, which is defined as modifying an existing organism to raise its transmissibility or pathogenicity. Generative genome design modifies nothing. It writes sequences with no natural precursor. The policy sets up an interagency group to watch the AI and biology boundary, and stops there. In regulatory terms this capability currently sits in a category that does not have a rule attached to it.

The case for a vetted-access regime does not rest on fear of this paper. It rests on two measurements sitting next to each other. Withholding a data class reliably removes a capability class. Screening a finished sequence against a list of known agents reliably does not catch things designed to look unlike known agents. One of those is a control surface. The other is a filter that its own designers have publicly reported working around.

The concrete proposal already exists, and it is tiered rather than prohibitive. Bloomfield and colleagues laid out Biosecurity Data Levels in Science in February, borrowing the logic of biosafety levels and applying it to datasets instead of organisms.

Tiering has real costs and pretending otherwise makes the argument weaker, not stronger. Resistant bacterial infections are projected to kill close to 1.9 million people a year by 2050. The pipeline that produced 16 candidate therapeutics against that runs on open models and open corpora, and researchers in the field say so publicly. Access controls also concentrate capability inside institutions that can satisfy the paperwork, which a response published in Science flagged as a participation problem, not a hypothetical one.

Filippa Lentzos at King's College London argues the sensible shape is layered rather than single-point: model safeguards, research review, synthesis screening and lab biosafety operating together, since restricting models alone will not hold. That seems right, and it is compatible with putting the strongest gate at the layer where the evidence for effectiveness is strongest.

Simon Clarke at Reading put the residual worry in one sentence worth carrying around: this team showed restraint, and there is no assurance that everyone attempting something similar will. Every safeguard in this paper was adopted voluntarily, not required. That is the actual finding for policy.