AI-enabled bioweapons are a potentially catastrophic yet manageable risk — if government, the scientific community, the public health sector and leading tech companies can develop appropriate safeguards, a new report argues.

Why it matters: The debate over AI and public safety isn't one that the health care or research communities can ignore.

Driving the news: A RAND report out this week outlines nine mitigation strategies targeting a range of actors who could use AI to design and release a biological weapon.

• While there's already considerable debate about government oversight and safeguards around frontier AI companies, RAND calls for more controls and a wide range of cross-industry cooperation.
• It recommends protecting the same biological tools and datasets that are contributing to some of today's most exciting medical advances.
• And though we all think of public health preparedness as a response to an outbreak, the report frames it as a form of deterrence.

The big picture: The nine measures would prevent a large-scale AI-enabled biological attack by managing access to information that can fall into the wrong hands, disrupting access to the materials needed to make a weapon, proactively detecting signs of misuse and deterring nefarious activity from occurring in the first place.

• Part of the problem with AI's rapid advancement is it expands the field of players potentially capable of making a biological weapon, from lone wolves to state-backed actors.
• "AI capabilities in biology are advancing really fast, but luckily most dangerous thresholds have not yet been crossed," RAND lead author Steph Guerra told me.
• Given the nature of the threat, "we need this layered system of mutually reinforcing approaches."

Zoom in: Remember all of that talk about AI helping discover drug candidates? Some of the technology enabling that work could turn dangerous in the wrong hands, Guerra told me.

• A lot of the tools and biological data being generated by pharmaceutical companies and biotechs are proprietary, meaning access is already restricted.
• Open-source biological tools and data are more concerning — including those emerging from academia and research institutes.
• "Right now, data for biology is freely out there and open because biology ... [is] for discovery and saving lives. It's not warfare first, which is a good thing," Guerra said.

Yes, but: Restricting what's publicly accessible risks slowing down scientific progress.

• "Let's build big moonshot projects and biodata factories that produce the data we need to cure diseases, but we can also create tiered systems of access so legitimate scientists are the ones who access the most misuse-relevant datasets," Guerra told me.

The intrigue: The RAND team has been exploring how the use of AI agents can make biological developments more widely accessible, lowering the bar for the level of expertise needed to make bioweapons.

• Just this week, Anthropic announced that Claude successfully designed protein binders against 14 targets — an important step in the drug development process.
• In a blog post, Anthropic acknowledged both the promise and the danger, noting that protein design and other research biology capabilities aren't available for general access in the company's most capable model.
• "The uplift provided by the increasingly autonomous research capabilities of AI models will undoubtedly speed the development of human therapies and fundamental scientific discoveries," the company wrote.
• But, it added, "without robust safety measures, they could enable bad actors to perform dangerous research, such as the development of bioweapons."

Without further ado, here are the nine strategies that RAND recommends:

1. Develop effective safeguards for so-called open-weight AI models whose core components can be downloaded by anyone.

2. Protect sensitive biological data, especially laboratory-validated datasets. The frameworks and standards to collect and analyze human genomic data could apply here.

3. Control access to AI systems — both general-purpose and biological tools — that can be used for both good and nefarious purposes.

4. Strengthen and expand screening across providers of biological precursor substances, including plasmid repositories, contract research organizations and cloud lab providers.

5. Develop the biological and forensic capabilities necessary to link attacks or misuses to specific actors, which could serve as a deterrent.

6. Set up a continuous surveillance network that detects biological threats early, which also increases the chances of identifying the bad actor.

7. Develop and demonstrate an effective rapid-response system to threats, which will deter some bad actors.

8. Develop a monitoring system across frontier AI models that can detect early signs of misuse and alert law enforcement.

9. Establish a centralized source for aggregating those signs of trouble across AI developers, cloud labs and other players.

The bottom line: The report repeatedly emphasizes the roles of the private sector, the government and the international community.

• Some of the strategies are a lighter lift than others, but none are a slam dunk to implement.