Five Things: July 12, 2026
Sequel to AI 2027, Claude’s unconscious, an off-switch for virology knowledge, jihadists put chatbots on the battlefield, SecureBio warns of the “Bio Mythos” moment
Five things that happened/were publicized this past week in the worlds of biosecurity and AI/tech:
The AI Futures Project publishes “Plan A”
New method of probing AI “subconscious”
Anthropic and AE Studio build an “off switch” for dual-use knowledge
Field work reveals that Boko Haram has been using chatbots as battle tools
SecureBio tells policymakers to prepare now for the “Bio Mythos” moment
1. Plan A
About a year ago there was a widely discussed forecasting project called AI 2027, describing how the authors thought AI development would play out in terms of geopolitics on the road to a terrifyingly powerful general intelligence that may end up killing all of humanity. Their predictions for the year of 2026 have been scarily prescient, and so now the team behind AI 2027 (aka the AI Futures Project, i.e. Daniel Kokotajlo, Thomas Larsen, Eli Lifland, Romeo Dean, Ryan Greenblatt, and Brendan Halstead) is back with a sequel. Where AI 2027 was a forecast of what they thought would happen, “AI 2040: Plan A” is more of a recommendation than a prediction. As the blog announcement puts it, it’s “what we think should happen, not what will happen, though we think it’s plausible enough to aim for.”
The plan, condensed to the five talking points:
Slow down AI development
Cut a deal with China
Monitor the major sources of compute
Lean on “mutually assured compute destruction” as a stabilizing deterrent (with credible ways to trigger that destruction”
Expect very fast progress toward superintelligence around 2040 regardless of slowdowns.
As with AI 2027, you can consume this in lots of different ways; there isn’t an Aric Floyd video (yet) but there is an unofficial fan-made visual-novel adaptation if you’d rather click through it like a game. There’s a lot to think about here (see reflections by Scott Alexander and Zvi Mowshowitz) and what to critique (e.g., great responses from Richard Ngo and Forethought’s Tom Davidson) from the people I like reading on these questions. My normie take is that the whole thing still sounds crazy! Taking it seriously requires a major emotional step, one that I think many people will have a hard time with; it’s hard to expect that the world will look so freakishly radically different in twenty years from how it does now. But that doesn’t make AI 2027 wrong!
2. There’s a “global workspace” inside Claude
Anthropic published “A global workspace in language models”, reporting that they’ve found a small, verbalizable subset of Claude’s internal representations. This is incredibly interesting for two reasons that, in theory, have nothing to do with each other: model welfare (do these things have anything like “consciousness”?) and for mechanistic interpretability (paths towards ensuring that these mysterious models don’t end up doing anything horrible by understanding why they do what they do).
I also really love this as a way of doing science in the modern world. Anthropic posted the full technical paper with all their experiments, a more accessible (and very pretty) explainer, and even a short YouTube video with some slick graphics that pair nicely with the overall Anthropic aesthetic. But the absolute best thing they did was to invite outside experts to weigh in on their findings, and have those experts publish their responses along with the research paper. Some academic journals do something like this, such as how eLife, the most “open” of journals, publishes the peer reviews and Science (and others) will publish short overviews by outside experts on the significance of a paper. But I’ve never seen anything that goes this far, where the outside reviewer (Neel Nanda in this case) doesn’t just assess the findings, but actually does a replication of the key experiments!
The full technical companion defines the workspace, which they call “J-space” after the mathematical methods used, as representations satisfying five properties that mirror human conscious access according to the Global Neuronal Workspace (GNW) hypothesis of human consciousness.
So, as part of their “outside elicitation,” they got cognitive scientists Dehaene and Naccache, who came up with this GNW theory of consciousness, to weigh in. With some reservations, they do call the finding “a landmark in consciousness research” and “a mechanistic, testable version of the GNW hypothesis,” while sensibly cautioning that Claude’s lack of a body and lack of enduring episodic memory are real disanalogies to human consciousness. But wow, quite an endorsement, and also… what does this mean for whether the models are actually conscious is both an open question that may never be resolved, but also all the evidence so far seems to point to models being at least capable of the architecture needed to have subjective experience.
The mechanistic-interpretability question is the one with the concrete safety payoff. Because the workspace is both readable and editable, it doubles as a tool for alignment auditing: these models are opaque, and having another tool to look under their hood will help us understand why they output the text that they do, and why they might lie or cheat or plot against people who want to shut them down. Here, Anthropic got probably the world’s expert on mechanistic interpretability, Neel Nanda, to weigh in, and he is impressed.
3. An off switch for virology
Anyone who has been using Claude (and, to some extent, ChatGPT or Gemini) for work in biology knows that these chatbots will fairly quickly shut down talk of biology even when it’s perfectly safe because of over-zealous classifiers that exist as guardrails against potential misuse. This is bad, not just because it hinders the millions of people who really just want to understand biology (and improve human health and well-being!) but because it means everyone–heroes and villains alike–will want to use other tools that don’t have these annoying refusals.
Another approach would be if, instead of having to keep the model behind bars, so to speak, the model is “safe” from the get-go. Last week, Anthropic’s Alignment Science team, along with AE Studio, introduced “an off switch for dual-use knowledge” — a technique called GRAM (Gradient-Routed Auxiliary Modules) that creates dedicated, removable weight compartments for specific dual-use knowledge categories. The four they tested: virology, cybersecurity, nuclear physics, and some niche code capabilities. The idea here is that instead of stopping access to the model, you do one training run that routes hazardous knowledge into compartments you can then lop off, approximating several differently-filtered models at once. The full research paper shows that this approach matches conventional data-filtering on restricting the target knowledge, while being substantially more resistant to adversarial elicitation — i.e. malicious fine-tuning to claw the capability back — than the MaxEnt unlearning baseline.
This is great; it may be necessary for future powerful models and can also be applied to biological AI models such as ESMC or AlphaFold, to keep them generally useful for biological research while making them incapable of designing new biological weapons. But really, I’m just waiting eagerly for when I can use Claude Fable to help with my genomics projects.
4. The terrorists’ chatbots
The whole point of these restrictions is to prevent misuse by malicious actors. But do they actually? An extraordinary new paper documenting careful research by Cambridge researcher Antonia Juelich on how terrorist organizations are using AI. Juelich conducted nearly 60 interviews with 27 former Boko Haram members in Nigeria, and finds that AI chatbots (even “safe” models such as ChatGPT and Gemini) are being used not just for propaganda but for tactical purposes including designing weapons and attacks. I’m glad it was picked up by the New York Times but the actual paper was a much better read than the news version.
There are lots of interesting things in this report, not all of them having to do with AI (for example, that Boko Haram routinely loses lots of members who get killed in the process of training, and “While entertainment media is considered haram (proscribed by Islamic law) and hence prohibited, war movies and documentaries are an exception.” Here’s a quote that has it all:
We saw in a movie how motorcycles can jump over bridges. We used AI to learn how to do this. We gave it information, like what motorcycles we use and the distance we need to jump and so on and it gave us steps on what we have to do. We practiced a lot and kept asking questions. We dug holes and filled them with broken glass and fire to practice. 18 of us died in the process. Eight of us managed to do it. The next time we attacked, we could jump.
Of course, the frontier models have safeguards–they are not supposed to be helping users commit terrorist attacks, but this didn’t seem to impose a serious barrier. Early in the report, Juelich quotes:
Here the groups described restrictions as manageable rather than prohibitive. As one commander put it, “boys that have received extensive training [...] bypass the 7 restrictions. They say they need it for a movie or something like that.” They used jailbreaking techniques taught by foreign operatives, and because they keep accounts across multiple providers, a single refusal or suspension rarely mattered. Whether more recent safeguard updates present greater obstacles is not known, but throughout 2024, restrictions did not appear to prevent misuse.
The report also discusses the attitudes of Boko Haram members towards the development of weapons of mass destruction, including bioterrorism, saying that they do not rule them out but (probably) not actively pursuing such weapons. The report notes that Ayman al-Zawahiri, successor to Osama bin Laden, had a background in medicine and was interested in pursuing biological weapons.
5. Bracing for the “Bio Mythos” moment
There have been some great blog posts from SecureBio (Coleman Breen and Hodan Omaar) lately; the most recent builds off of their capabilities charts to think about “Preparing for the ‘Bio Mythos’ Moment”. SecureBio’s argument is that a biological version of that moment is coming, and that policymakers should build the evaluation infrastructure before a model crosses into dangerous biological capability, not after. (The folks at the AI Futures project also discuss this; in AI 2027 they predicted that cyber would cause the first freak-out moment in government, but they believe that a bio incident might be not so far behind)
So what do we do? SecureBio points to its own Bio Capabilities Index (BCI) and BioTIER benchmark as the kind of tooling that needs to exist and be trusted before the crisis, so the policy response isn’t the panicked, unilateral, ad-hoc thing we got with cyber.
In other news...
[Drafted mostly by Claude Opus 4.8 with light editing]
On AI doing (and not doing) things:
An OpenAI model decisively beat elite human programmers at the 2026 AtCoder World Tour Finals in Tokyo, sweeping both the heuristic and algorithmic divisions and solving all 5 algorithmic problems — while 12 human competitors couldn’t crack 2 of them.
Interestingly, the supposedly best about-to-be-available model, OpenAI’s GPT-5.6 “Sol” at max reasoning effort scored just 7.8% on ARC-AGI-3 (interactive games testing fluid intelligence) versus humans’ 90%+.
Speed-run division: Anthropic’s Fable produced the fastest megakernel ever submitted to KernelBench-Mega, an 18.71x speedup over the PyTorch baseline on a Blackwell GPU.
Epoch’s new EBR-bench finds models show little evidence of learning from experience across repeated attempts at complex tasks. This is largely by design, so I’m not sure exactly what the point of this is until those new “world/learning models” come out that some people are so excited/terrified about.
Scott Alexander’s “The AI Superforecasters Are Here” pits AI forecasting startups against a real question (odds the Intercept Initiative halves U.S. cold rates by 2040 — the AIs said ~7–9%, converging with a human superforecaster) and estimates human-AI forecasting parity is ~6 months out. Daniel Reeves at AGI Friday pushes back hard: most real-world prediction has irreducible chaos, like weather, and prediction markets already beat humans only “razor thin.” The FT separately clocks Mantic’s AI roughly tying — but not beating — the market on Fed rate decisions, with human superforecasters still winning at the key inflection points. My money’s on “AI closes the gap on average, humans keep the edge at the turns” for a while yet.
AI safety, evaluation, and governance:
The Future of Life Institute’s Summer 2026 AI Safety Index is out: Anthropic led with a C+ (2.66), then OpenAI (C, 2.28) and Google DeepMind (C, 2.01); xAI, DeepSeek, and Mistral got outright failing grades (Mistral lowest at 0.33). The scoring here is somewhat subjective; mostly this is just a way of summarizing what safety researchers think about the latest models.
The UN’s Independent International Scientific Panel on AI launched its first Preliminary Report on July 1. Even if there is no new information here, I think it is a very big deal that the world’s main institutional body for international governance is taking up this issue, and trying to do it in a way where the developing world has a say in how this is all going to play out.
FT reports that the White House is accelerating voluntary model-release standards. This is mostly a good thing for AI model companies, and also hopefully for democracy and for humanity.
And a WSJ follow-up to the saga we’ve been living in for a month: the released court emails show exactly how the Anthropic-Pentagon relationship collapsed.
Keller Scholl at Transformer argues the proposed “independent verification organizations” for AI safety will inevitably trade genuine safety for speed and cost, drawing the uncomfortable analogy to credit-rating agencies (whose “ratings were not consistent with actual risks”) and FTX’s auditors. Obviously people who are advocating such independent evaluators (eg Miles Brundage) know about these failure modes; the question is what factors will be decisive.
As someone who is just starting to learn where the US government has its AI expertise, I really liked Remco Zwetsloot’s Horizon explainer maps who actually owns AI security in the U.S. government after the recent executive order and NSPM-11
OpenAI published its National Security Principles, committing (like Anthropic once tried to with the Pentagon) to no mass domestic surveillance, no autonomous weapons direction, and no high-stakes automated decisions, while touting cyber-defense partnerships across nine allied governments and expanded biodefense access to its GPT-Rosalind model.
A Nature paper worth a longer look: LLMs can now predict the results of social-science experiments (r = 0.85 across 70 preregistered studies, ~120,000 participants), comparable to pooled human forecasters — though they systematically overestimate effect sizes.
AI, China, and the compute cold war:
The FT reports OpenAI and Google have been selling models to Singapore-based subsidiaries of Pentagon-blacklisted Alibaba, Baidu, and Tencent; OpenAI suspended one Alibaba-linked account over suspected distillation.
Anthropic, by contrast, bans PRC-controlled companies outright and has accused Alibaba of running ~25,000 fraudulent accounts generating 28.8 million Claude exchanges. Jeffrey Ding’s ChinAI adds a wild detail: Claude Code was found containing code identifying Chinese users, which Anthropic removed once discovered — after which Alibaba mandated wiping Claude from employee machines.
The Economist asks whether China has obtained “the world’s most important machine” — EUV lithography — despite export controls. Meanwhile The Wire China documents Nvidia using “the specter of Huawei” to argue for looser export rules, even though Huawei’s chip output is ~5–6% of Nvidia’s and, per one CFR expert, “does not pose a competitive threat to Nvidia globally right now.” (Zvi Mowshowitz just calls it straight up “Nvidia lied to everyone”)
AI and the economy:
Arvind Narayanan and Akash Kapur argue AI firms will escape the model-layer “commodity trap” by moving up the stack into enterprise lock-in — and warn that accumulated “data gravity” (memory, custom skills, workflows) could make an AI agent “a digital employee that effectively cannot be fired” unless portability is engineered in. They project $4–8 trillion in AI infrastructure by the early 2030s, needing ~$16–32 trillion in annual revenue to recoup. For scale: airlines run on 2–4% margins.
Ben Bernanke — yes, that one — joined Anthropic’s Long-Term Benefit Trust.
Two “is AI killing jobs?” data points pulling in the reassuring direction: Ramp/Exponential View finds heavy-AI-adopting firms grew employment ~10% over two years (entry-level up 12%), and Ramp’s own econ lab finds open-weight self-hosting is still just 5.8% of AI-spending businesses — and 93.2% of those also use Anthropic, i.e. cheap open models are supplementing, not replacing, the frontier labs. Anthropic holds 42.4% of business AI adoption to OpenAI’s 39.5%.
Biosecurity:
This week in Science: “We introduce Biomni, a general-purpose biomedical artificial intelligence agent that autonomously executes diverse research tasks... Its general-purpose architecture integrates large language model reasoning with retrieval-augmented planning and code-based execution, dynamically composing workflows without predefined templates.” 🫨
The DNA-synthesis screening drumbeat continues: IFP’s June update and its full brief argue for mandatory screening across the ~80% of gene-synthesis providers plus strategic ambiguity about who screens, backed by an open letter signed by Sam Altman, Dario Amodei, and Demis Hassabis.
SecureBio’s metagenomic wastewater pipelines, chewing through over a trillion sequencing reads, can now distinguish benign biotech signals (vaccine-manufacturing CMV, patent-matched protein-expression constructs) from genuinely concerning engineered-pathogen signals. Hooray!
On the “can AI actually do the biology” question that RAND raised last week: a new arXiv paper, ProtoPilot, converts written biological protocols into executable robotic lab workflows, hitting an 88.24% pass rate on physical Opentrons execution (vs. 32.35% for the prior baseline) and producing Sanger-confirmed PCR products. Real wet-lab automation, not simulation — and very squarely dual-use!
A new org, Global BioFutures, launches to address biotech/AI governance gaps in the Global South.