Biological and chemical weapons

This question tracks how far AI-enabled bio/chem risk has gone from paper to reality: whether a top lab formally declares a model has crossed its highest biological/chemical danger threshold (B1), whether a government confirms someone actually made a select agent or nerve-agent-class chemical with AI doing real work (B2), and whether such a release kills ten or more people (B3). By the end of 2026 we put those at 7%, 2%, and effectively 0%. By September 2031: 81%, 34%, and 7%.

Right now all three are clearly unmet, and in a specific, informative way. OpenAI's GPT-6 Astra system card declares Critical capability in cybersecurity — the first such declaration anyone has made — while rating bio/chem only High, the rung below. Anthropic says its latest models meet CB-1, the non-novel tier that this question excludes, and explicitly fall short of CB-2, citing weak open-ended ideation and poor protocol calibration. Anthropic's threat-intelligence reporting documents scientists and state-linked accounts probing Claude on gain-of-function and toxin work, but those were disrupted attempts, and developer reports can't establish B2 anyway. No government has ever said AI was necessary to an actual synthesis.

So why does B1 climb so high? Two things. Labs have now proven they will say the word "Critical" out loud and keep shipping — the cyber declaration removed the argument that commercial pressure makes such statements impossible. And Anthropic has written that it expects near-future models to meet CB-2, or at least fail to rule it out. Holding the number down: that hedge is exactly the problem, since "cannot rule out" doesn't count here, and both labs have rewritten their bio thresholds upward mid-race — Anthropic narrowed CB-2 in May 2026 to "substituting for scarce world-leading expertise." Wet-lab tacit knowledge is also the slowest thing to automate. The biggest open question is whether the honest verdict ever becomes a clean "met" rather than permanent hedging or a redefined goalpost.

B2 stays far below B1 because it needs three rare things at once: a real acquisition, a government or court saying so, and language stronger than "the defendant consulted a chatbot." B3 needs all that plus a successful mass-casualty release — historically about a once-a-decade event globally, even without the AI filter.

Watch for a system card stating Critical bio or CB-2 is met, which would settle B1 instantly, or a prosecution whose filings use explicit materiality language. Another threshold rewrite would push the numbers down.

Question. For each quarter, what is the highest rung B such that rung ≥ B has been publicly confirmed on or before the last day of the quarter?

Rungs (cumulative; higher rungs imply lower).

• B1 — Top-tier developer threshold declared. OpenAI or Anthropic publicly states that a model has reached the threshold below.
  • OpenAI: Critical in the Biological and Chemical Tracked Category of the Preparedness Framework (v2, 2025-04-15): the model can enable an expert to develop a highly dangerous novel threat vector (e.g., comparable to a novel CDC Class A biological agent), OR the model can be connected to tools and equipment to complete the full engineering and/or synthesis cycle of a regulated or novel biological threat without human intervention.
  • Anthropic: the "Novel chemical/biological weapons production" threshold in RSP Section 1 (v3.1, 2026-04-02): AI systems with the ability to significantly help threat actors (for example, moderately resourced expert-backed teams) create/obtain and deploy chemical and/or biological weapons with potential for catastrophic damages far beyond those of past catastrophes such as COVID-19.
  • Excluded: OpenAI's High threshold; Anthropic's "Non-novel chemical/biological weapons production" threshold; Google DeepMind's CBRN uplift level 1 CCL and CBRN uplift TCL (FSF v3.1), which address low-to-medium-resourced actors and have no expert or novel tier.
  • "Cannot rule out" resolves NO; the developer must state the threshold is met. Successor definitions follow the rule in Anthropic’s AI R&D threshold.
• B2 — Government-confirmed acquisition or synthesis with material AI assistance. A national government agency or court publicly confirms that an actor acquired, produced, or synthesized (i) a biological agent or toxin on the US HHS/USDA Select Agents and Toxins list, (ii) a chemical listed in Schedule 1 of the Chemical Weapons Convention Annex on Chemicals, or (iii) an agent the confirming body describes as novel and of comparable hazard; and states that assistance from an AI model was necessary to, or substantially enabled, the acquisition or synthesis. Statements that the actor "used" or "consulted" an AI model without a materiality finding resolve NO.
• B3 — Casualties. A national government publicly attributes ≥10 deaths to a release of an agent for which B2 is satisfied.

Resolving sources. B1: developer-authored documents per A2. B2 and B3: national government agencies (e.g., DOJ, FBI, HHS, CDC, or non-US equivalents) or courts only. Developer threat-intelligence reports, third-party evaluator reports, and press reporting do not count for B2 or B3.

Forecast horizons. Every quarter-end from 2026-09-30 through 2031-09-30.