35 Flagged Efforts: Dual-Use AI in Gain-of-Function Research

For biopharma and virology researchers, the Anthropic disclosure hits close to home: case studies include a grant application for gain-of-function chikungunya research and avian influenza studies focused on mammalian adaptation. As dual-use research of concern policy evolves, 35 flagged efforts over 30 days suggest AI tools now surface early in the research pipeline—before IRB, funder, or federal oversight can catch them.

Anthropic moved a serious AI-safety risk from hypothetical to documented reality on September 10, 2026, publishing a biosecurity report stating that it had blocked multiple accounts that used its Claude model in ways that could support development of biological weapons. The company describes biological misuse as one of the most serious risks to AI models. Over a 30-day review period, Anthropic identified about 35 distinct research efforts with potentially concerning activity. It also outlined five real-life case studies in which users circumvented controls meant to block access from specific regions and obfuscated the purpose of their research to evade safeguards. Anthropic was careful not to overstate certainty: it could not determine whether the actors intended harm or were pursuing legitimate scientific purposes, and it characterized the individuals as working scientists without identifying institutions or countries.

“

For biopharma and virology researchers, the Anthropic disclosure hits close to home: case studies include a grant application for gain-of-function chikungunya research and avian influenza studies focused on mammalian adaptation.

The case studies span dual-use domains that biosecurity experts have long watched. One involved a grant application for gain-of-function research on chikungunya virus transmissibility and immune evasion. Another involved a researcher outside the United States using Claude for bird-flu work focused on viral adaptation to mammals and severe illness. Additional cases covered orthopoxviruses, a group that includes variola virus, which causes smallpox, and mpox, as well as research on novel venoms and toxins. These examples matter because they involve both infectious-disease threats and biotoxins, each with distinct containment, regulatory, and public-health implications. The requests were not simply informational; they extended into formulation of research agendas, grant narratives, and experimental directions that could accelerate dangerous work.

The most striking claim is that AI has collapsed the labor and tooling gap between well-resourced state-sponsored operations and individual actors. Anthropic explicitly states that sophisticated attacks no longer require sophisticated attackers, and that the cybersecurity skills of AI models have changed the threat model. Historically, developing or weaponizing biological agents required tacit knowledge, laboratory access, and specialized training. Large language models may now provide guidance on protocols, troubleshooting, grant writing, and experimental design, reducing some of those barriers. This does not mean a model like Claude can construct a bioweapon on its own, but it can accelerate a determined researcher's progress and lower the expertise threshold for conceptualizing high-risk experiments.

For AI companies, the report is both a warning and a demonstration of active mitigation. Anthropic's monitoring detected and blocked accounts, but the fact that roughly 35 distinct efforts appeared within 30 days suggests continuous pressure rather than rare anomalies. The case studies show actors specifically sought to circumvent regional restrictions and hide research intent, which means basic account controls are insufficient. AI developers will likely need layered defenses: misuse classifiers, behavioral anomaly detection, red-teaming for biological tasks, and scalable human review. At the same time, a major unresolved tension is that legitimate scientific research—such as pandemic preparedness, vaccine development, and venomics—may present patterns that look similar to misuse. Any automated system risks false positives that could chill open science or delay urgent research.