Bioterrorism has historically remained rare, largely due to the specialised expertise required. IEP Intern Kayla Davis examines how the convergence of AI and biotechnology could raise terrorism risks.
The global proliferation of artificial intelligence (AI) is changing who can access scientific knowledge and technical expertise. Bioterrorism has historically remained rare, largely due to the specialised expertise required to produce and deploy biological weapons. However, the emergence of large language models (LLMs), AI-enabled biological design tools and automated science is changing this by making increasingly complex scientific information accessible to individuals without specialist training using general-purpose AI systems.
AI-bio capabilities are also expanding to become more capable of providing information relevant to biological and chemical weapons development, including responding to queries about the acquisition and formulation of deadly agents. The convergence of AI and biotechnology now extends beyond information access, with biological foundation models becoming increasingly capable of generating novel biological designs and reconstituting pathogens that are more severe and deadly than those found in nature.
These developments may give individual actors technical capabilities that raise the terrorism risk. This trend is consistent with findings from the 2026 Global Terrorism Index (GTI), which identifies lone-wolf actors as responsible for 93% of fatal terrorist attacks in the West over the past five years, and reports that they were three times more likely to execute an attack than groups of two or more successfully.
The Global Peace Index (GPI) found that new technologies are lowering barriers to participation in conflict for both state and non-state actors. AI may reduce the knowledge barriers associated with bioterrorism, expanding access to capabilities previously concentrated among actors with specialised expertise. Yet, the extent to which AI can overcome practical and scientific barriers to developing biological weapons remains uncertain.
The 2026 International AI Safety Report demonstrates that AI systems are improving at tasks relevant to the development of biological and chemical weapons, including accurately providing details about pathogens and expert-level laboratory instructions. General-purpose AI systems can provide information relevant to multiple stages of biological and chemical weapons development.
This includes providing detailed scientific information relevant to complex laboratory procedures, including generating experimental protocols and troubleshooting technical problems. AI systems can also provide forms of ‘tacit knowledge’, referring to practical expertise typically formed only from hands-on laboratory experience, increasingly at a level that exceeds that of human experts. For example, OpenAI’s o3 model achieved 43.8% accuracy in troubleshooting complex virology laboratory protocols, outperforming 94% of expert virologists, including those within their areas of specialisation.
AI-bio capabilities have also shifted from the prediction of outcomes to the active generation of content. Biological foundation models can generate novel designs or reconstitutions of pathogens that may be more severe and deadly than those found in nature. In early 2023, a biochemist and former United Nations (UN) weapons inspector brought a small box containing a dozen chemical ingredients to the White House. The ingredients had been recommended by LLM Claude and, if assembled correctly, could be used as precursors to trigger another pandemic. He warned the White House that tools such as ChatGPT could help terrorists identify potent biological agents and obtain the materials needed to make them.
More recently, in 2025, researchers demonstrated the first instance of genome-scale generative AI design, showing that a biological foundation model could generate coherent, genome-scale sequences for a significantly modified virus entirely from scratch. The resulting virus was capable of targeting and killing strains of E. coli.
Terrorist groups have historically shown interest and willingness in employing chemical and biological weapons, but their capabilities have been constrained by a lack of expertise, resources and access to information.
For example, in 1990, the Tamil Tigers conducted the first chemical weapons attack by a non-state organisation, releasing chlorine gas against the Sri Lankan military. The attack was fundamentally rudimentary, relying on environmental conditions to disperse the gas, but a sudden change in wind direction caused the gas to drift back towards enemy lines. Similarly, the 1995 Aum Shinrikyo attack on the Tokyo subway, which involved the nerve agent sarin, was limited by the quality and dissemination of the agent used. Subsequent expert assessments have suggested that the attack could have caused significantly higher casualties had the group possessed more advanced technical knowledge to produce a purer form of sarin. The Islamic State’s chemical weapons programme represented a more sophisticated chemical weapons capability. Between 2014 and 2017, the group produced and employed sulphur mustard in Syria and Iraq, becoming the first non-state actor known to combine a banned chemical warfare agent with a projectile delivery system. However, the programme remained constrained by limited technical expertise, with few members possessing the specialised knowledge required to develop more advanced agents beyond the low-grade mustard agent employed.
AI may reduce some of these information barriers that have historically constrained non-state actors. There is evidence that individuals have used AI to obtain information relevant to attack planning.
For example, the suspected perpetrator of the February 2026 Tumbler Ridge school shooting in Canada reportedly used ChatGPT to explore a hypothetical shooting scenario. The chatbot initially declined the request but responded after the prompt was reframed as hypothetical. While OpenAI had flagged the account internally, it did not alert police. In a separate case, the attacker responsible for the January 2025 Cybertruck explosion in Las Vegas used ChatGPT to research how much explosive he needed, where to buy fireworks and how to obtain a phone without identification.
More recently, AI has been utilised by a non-state armed group for weapon development. In September 2026, Anthropic reported that a cell in Houthi-controlled Yemen used Claude over approximately nine months to support guided weapons development, including generating guidance, navigation and control software. Although the cell did not produce a functioning weapon, Anthropic reported that it “did carry out a failed test of a guided rocket”. These cases demonstrate that non-state and lone-wolf actors have demonstrated an intent to exploit AI systems for practical assistance related to violence. However, their capability is restricted as, while the barriers to information access may be lowered, users still require sufficient scientific judgement to assess whether information is credible and applicable.
The potential implications for bioterrorism arise from the ability of LLMs to rapidly synthesise information from a range of sources and communicate it in an accessible language that allows malicious actors to become familiar with a range of biological agents, allowing for the democratisation of scientific knowledge which historically has been concentrated among trained specialists and institutions. However, the ability to retrieve or generate scientific information does not necessarily establish the ability to produce a biological weapon.
AI is accelerating the terrorism environment. The 2026 GTI finds that radicalisation can now occur within weeks, compared with 18 months in 2005. This becomes particularly harmful as the speed at which AI technologies are evolving now surpasses the capacity of government regulatory oversight. The 2026 GPI found that 118 of 193 UN member states were not participating in any of the seven major AI governance initiatives, while a 2025 study found that just 3% of 375 biological AI tools surveyed had any form of safeguards. Exacerbating this risk is that the economic cost to resurrect a dangerous virus similar to smallpox can be as little as US$100,000, while developing a vaccine can be over US$1 billion.
AI may lower the knowledge barriers that have kept bioterrorism rare. Large language models, AI-enabled biological design tools and automated science are making increasingly complex scientific information accessible to individuals without specialist training. However, the extent to which AI can overcome the practical and scientific barriers to developing biological weapons remains uncertain, and the ability to retrieve or generate scientific information does not necessarily establish the ability to produce a biological weapon.
The 2026 International AI Safety Report finds that AI systems are improving at tasks relevant to the development of biological and chemical weapons, including accurately providing details about pathogens and expert-level laboratory instructions. OpenAI's o3 model achieved 43.8% accuracy in troubleshooting complex virology laboratory protocols, outperforming 94% of expert virologists, including those within their areas of specialisation. Biological foundation models are also moving from predicting outcomes to generating content: in 2025, researchers demonstrated the first instance of genome-scale generative AI design, producing a modified virus capable of targeting and killing strains of E. coli.
Bioterrorism has historically remained rare, largely due to the specialised expertise required to produce and deploy biological weapons. Terrorist groups have shown interest and willingness in employing chemical and biological weapons, but their capabilities have been constrained by a lack of expertise, resources and access to information. The 1990 Tamil Tigers chlorine attack was rudimentary, the 1995 Aum Shinrikyo sarin attack on the Tokyo subway was limited by the quality and dissemination of the agent, and the Islamic State’s chemical weapons programme remained constrained by limited technical expertise.
There is evidence that individuals have used AI to obtain information relevant to attack planning. The suspected perpetrator of the February 2026 Tumbler Ridge school shooting in Canada reportedly used ChatGPT to explore a hypothetical shooting scenario, and the attacker responsible for the January 2025 Cybertruck explosion in Las Vegas used ChatGPT for research. In September 2026, Anthropic reported that a cell in Houthi-controlled Yemen used Claude over approximately nine months to support guided weapons development, although the cell did not produce a functioning weapon. These cases show intent to exploit AI systems, but capability remains restricted because users still need sufficient scientific judgement to assess whether information is credible and applicable.
AI developments may give individual actors technical capabilities that raise the terrorism risk. The 2026 Global Terrorism Index (GTI) identifies lone-wolf actors as responsible for 93% of fatal terrorist attacks in the West over the past five years, and finds they were three times more likely to successfully execute an attack than groups of two or more. It also finds that radicalisation can now occur within weeks, compared with 18 months in 2005.
The speed at which AI technologies are evolving now surpasses the capacity of government regulatory oversight. The Global Peace Index (GPI) 2026 found that 118 of 193 United Nations member states were not participating in any of the seven major AI governance initiatives, and a 2025 study found that just 3% of 375 biological AI tools surveyed had any form of safeguards.
Terror groups had been using artificial intelligence mainly as a propaganda tool, useful for generating slick recruitment videos or...
While advancing a “maximum lethality” doctrine in its war with Iran, the US is simultaneously testing a large-scale AI-driven military...
Identifying and measuring the factors that drive peace
