Weekly Arc: Anthropic opens a verified lane for biology
Last week's issue argued that safety work in biomedical AI had moved earlier in the pipeline. OpenAI shipped GPT-6 Astra with three biology evaluations run before release, and Anthropic published a detailed account of attempted misuse. Both produced a record, and neither could be rerun by anyone outside the company. This week the check moved again, in a direction the arc had not anticipated. Anthropic opened a Life Sciences Verification Program, a formal route for a life-sciences organization to identify itself to the company and, having done so, get access to biology work the model would otherwise refuse. The control point is no longer the output. It is the customer.
Anthropic starts vetting the organization
For two years the working constraint on frontier models in biology has been a blunt one. A vendor cannot tell from a request whether the person asking wants to design a better vaccine antigen or something far worse, so the refusal falls on everyone. Antibody engineers and virologists have spent that period rephrasing prompts around a filter built for the worst case.
The verification program splits that population. An organization identifies itself, submits to whatever review the company runs, and on the other side gets access to capability the default model withholds. Nothing about the model changed. What changed is that the company now distinguishes between askers.
The commercial logic showed up the same week. Novo Nordisk said it will run drug discovery work on Claude, and Anthropic published its own measurement of where Claude provides uplift in biomolecular modeling. So one company is now measuring how much its model helps with structural and molecular work, selling that help to one of the largest pharmaceutical buyers in the world, and deciding which organizations qualify to receive it. In most regulated technical fields, those three functions sit in three different places.
Why a designed sequence cannot be screened
The check migrated because the artifact will not hold one. An Axios report on AI-designed viruses named the problem precisely, and it is verification rather than capability: given a designed viral genome or protein sequence, there is no dependable way to establish in advance how dangerous it would be if someone built it. Existing biosecurity screening works by comparison, matching an ordered sequence against a list of known hazards. A generative model's output has no natural counterpart to match against, which is what made the Stanford-designed virus reported in early August the kind of result this arc has kept returning to.
Anthropic's threat intelligence report shows what the alternative looks like. It is a careful catalog of attempts to misuse Claude for cyber operations, influence campaigns, surveillance, biology and weapons work, and it is written entirely in the past tense. Documentation after the fact is worth having. It is not a control.
Between an artifact nobody can screen and a log that arrives too late, the identity of the requester is the only checkpoint with real leverage. That is not a clever answer. It is the answer that select agents, controlled substances and fissile materials all arrived at, which is worth stating plainly: biology's AI safeguard is converging on licensing, built by companies rather than by statute.
Verification binds only where a vendor controls access
A verified lane requires a door, and much of the stack does not have one. Open-weight protein and genome models run on a workstation with no request for anyone to approve. This arc has tracked backdoors found across genomic foundation models and whole genomes written with openly released Evo models, and none of that work passes through a vendor's front end.
The agent layer weakens the identity check from the other side. A template circulated this week lets agents call tools through MCP without ever holding the credentials themselves, which is sound security practice and also means the thing doing the work is not the thing that was verified. An arXiv proposal for giving long-running agents persistent internal drives concedes the same gap from the alignment side: a check applied when a session starts says little about a run that continues for weeks. Then there is scale. The VirtualBiotech paper in Science ran tens of thousands of agents across a simulated company, from target discovery through clinical development. Verification is issued to an institution. The work is increasingly done by populations.
So the principle for reading this thread from here. When a field cannot audit what a model produces, it falls back on auditing who is permitted to ask, and that check holds only over the portion of the stack a vendor gates. The verification program is genuine progress for API access and no progress at all for the rest.
The open question is who does the accrediting. Anthropic has not published the criteria, and no outside body reviews the decisions. Worth watching next: whether a second vendor builds the same lane, and whether verification ever runs in both directions, obliging the verified organization to keep a record an outsider could read.
- Benchmarks as audits: U.S. health agencies moved to accelerate medical AI into clinical use while the tests kept arriving from outside the clinic, including CausalArena on whether large models recover cause from correlation and CLEAR on how models handle sources that disagree; watch for the first coverage or clearance decision that cites any of them.
- Agents as bench scientists: VirtualBiotech ran a simulated company with tens of thousands of agents, an autonomous formulation lab required a citation behind every decision, and Anew Labs closed design and wet-lab feedback into one loop; watch for a simulated pipeline's predictions checked against real trial outcomes.
- The infrastructure nobody owns: Novo Nordisk put discovery work on Claude and Paper2Agent turned published methods into agents a vendor's model calls; watch what a pharma pipeline does the first time those access terms change mid-program.
Reply with what you're seeing. A human reads them. Forward freely.
|