Five Things: May 31, 2026

Illinois SB 315, ESMFold2, papal encyclical, Opus 4.8, OpenAI’s Rosalind Biodefense

[Note: drafting help this week once again from Claude Opus 4.8. I use Claude to organize and summarize the links in the “In Other News” section, although I edited it substantially; I also use Claude to find specific details I’m looking for in longer papers.]

Five things that happened/were publicized this past week in the worlds of biosecurity and AI/tech:

1. Illinois makes AI labs get audited

2. ESMFold2 and the bitter lesson for proteins

3. The Pope weighs in on AI

4. Claude Opus 4.8 and its 244-page system card

5. OpenAI launches Rosalind Biodefense

1. AI auditing about to become law (in Illinois)

Last week we watched the White House flip-flop and kill its own watered-down AI safety executive order. As noted by Transformer, this “non-strategy” for regulation is backfiring, leaving plenty of room for different states to write and pass their own bills on regulating the major AI companies, whether in small ways that have to do with child usage and verification, or to help mitigate larger questions of catastrophic risk, as was done in California and New York. This week, while the federal government continues to aggressively do nothing, Illinois went and did the strongest thing any state has done yet.

SB 315 passed the Illinois legislature and is headed to Governor JB Pritzker‘s desk, which he says he’ll sign. The bill requires frontier labs (as in, OpenAI, Anthropic, Google DeepMind, etc.) to have their safety practices audited by independent third parties. This is the part that moves past California’s SB 53 and New York’s RAISE Act, which merely require labs to disclose their safety information and report incidents. Illinois would require someone else to actually check whether the labs are doing what they say they’re doing. People like Scott Wisor from the Secure AI Project keep saying things like, “We’re in a situation where the AI companies grade their own homework.” Voluntary commitments and published responsible scaling policies are nice, but they’re only as good as the willingness of a company to honestly evaluate itself when the incentives all point the other way.

Who would actually do the auditing? I haven’t gotten a chance to look into this too much, but the reporting suggests either the Big Four accounting firms (Deloitte, EY, KPMG, PwC) or more specialized outfits like the AI Evaluator Forum (METR, Transluce, Averi). I have many questions about how this will work in practice and how the law is/will be written and interpreted, but overall I’m excited that this is a thing.

2. Next top protein model

“Language Modeling Materializes a World Model of Protein Biology.” In other words, ESMFold2 has arrived!!! This is the newest state-of-the-art model for understanding protein interactions, which is the key molecular underpinning of every biological interaction, every drug that does anything useful. It is not enough to correctly predict the shape of a protein floating around in a cell; if we want to change or modify something in the cell, we need to know what can bind to that protein and how they change shape in response. The ESM family of models are easy to use, are (supposedly) more powerful than any other binding predictor out there, and completely open-source.

Latent Space had a great podcast interview with Alex Rives, head scientist at the Chan Zuckerberg BioHub and the person behind the ESM protein language models. The occasion is ESMFold2, which Rives frames as Richard Sutton’s “bitter lesson” for biology: instead of building specialized algorithms to predict protein structure (the AlphaFold lineage), you train a big transformer on more protein sequences and just let scale do the work. ESMFold2 ships with an atlas of 6.8 billion proteins and 1.1 billion predicted structures, outperforming AlphaFold3 on several challenging cancer and immunology targets. There are some crazy findings here; one example is the PD-L1 minibinder which reportedly achieves functional activity comparable to atezolizumab, a blockbuster cancer immunotherapy (I worked with PD-1 blockers myself several years ago, those things are expensive).

The gigantic paper linked above announcing ESMFold2 also includes one page about biosecurity (and includes at least one biosecurity expert as an author), proving that their model is “safe” because it is no better than previous models at predicting viral protein mutation sites. They do not provide details as to the particular safeguards used. Presumably they are following their previous methods of filtering pathogen-related proteins from their training data (see here) but I understand why they’d want to keep that private.

3. The Pope vs. the stochastic parrots

Pope Leo XIV has published an encyclical on artificial intelligence, Magnifica Humanitas and it clocks in at 82 pages. Despite my interest in AI and religion, I did not read it, and I have a feeling that neither did a lot of the people getting all excited about it on the internet.

Personally, I feel like the fact that it exists is much more important than anything it might say. But as a religious (if not Catholic) person myself, I do appreciate me some theology (even if not my own), and I liked hearing some of the discussion on its content from within the Catholic worldview, such as the podcast episode by David Zvi Kalman with Brian Green, “A Catholic and a Jew Read the Pope’s AI Encyclical Together” on the Belief in the Future podcast.

Lots of people I follow are annoyed that the encyclical didn’t go farther, and that it made some assertions regarding factual matters that might end up sounding dumb. Zvi Mowshowitz notes that Anthropic co-founder Chris Olah who was invited to speak alongside the pope, pushed back on the idea that AI systems could never “feel” things like “joy, satisfaction, fear, grief, and unease.” Dean Ball was even less gentle, perhaps because he is more politically aligned with people who look to the pope for guidance, calling the encyclical “intellectually flaccid at its core”. Personally, I appreciate that the encyclical didn’t just wrote off LLMs as “stochastic parrots”, that it took AI seriously (if not seriously enough), that it claims we should build it wisely, etc. etc. The pope calling for wisdom and spiritual guidance is not groundbreaking news, but the fact that one of the world’s major religions is taking this as seriously as it is means that, as David Zvi Kalman put it, we closing down level one of the “religion and AI” discussion and moving onto level two.

4. The new Opus

Anthropic released Claude Opus 4.8 on May 28, six weeks after Opus 4.7. (The fact that new model-releases are coming so fast is its own kind of news.) Same pricing as 4.7 ($5/M input, $25/M output), Fast mode now 3× cheaper, “4× less likely to overlook code flaws,” 84% on the Online-Mind2Web browser-agent benchmark, and the first model to break 10% on the all-pass standard of a Legal Agent benchmark.

If you actually read (or at least skim through) the model card, you may notice that Opus 4.8 is better than Opus 4.7 on many tasks, but not all tasks. From an alignment perspective, it’s good that the hallucination rate is down from 11% to 5% and code-summary dishonesty down to 3.7%, but prompt-injection vulnerability got worse (5%/50% vs. 4.7), not to mention the increasingly worrying spectre of evaluation awareness.

The biosecurity headlines:

• On CB-1 (non-novel bioweapons), the model scored 0.77 and 0.89 on long-form virology tasks end-to-end — the threshold for “notable capability” is 0.80, so... that’s basically passing?

• On the multimodal Virology Capabilities Test, every model tested is now above the expert baseline (0.47 vs. 0.221).

• And on DNA synthesis screening evasion, Opus 4.8 designed genetic fragments that evaded synthesis screening for 7 of 10 pathogens.

I only got a chance to skim through this so I haven’t investigated what tests they used, but the fact that Opus 4.8, which I will remind you was never trained to be a DNA synthesis expert, is capable of synthesizing potentially harmful DNA that can also sneak past detection software is crazy.

This was enough to trigger some safeguards (but no more so than previous models); Anthropic describes its mitigations as “equal to or stronger than our historical ASL-3 protections and sufficient to make catastrophic risk in this category very low but not negligible.” That’s... not as reassuring as I’d like it to be.

5. OpenAI plays defense

OpenAI announced Rosalind Biodefense, a program built around GPT-Rosalind, their frontier reasoning model for the life sciences (named, presumably, for Rosalind Franklin) that they released some months ago. It has two pieces: a program letting “trusted developers” build biodefense and pandemic-preparedness tools, with applications open globally, and expanded trusted access to GPT-Rosalind for select U.S. government and allied partners working on public health and biodefense.

The launch partners are a who’s-who of the biosecurity world. On DNA synthesis screening — the thing Opus 4.8 was just shown to be capable of evading in 7 of 10 cases — the partners include Fourth Eon (AI-native, function-based synthesis screening designed to catch dangerous orders including novel designs), SecureDNA, SecureBio Detection, and ProEquip. The nonprofit/govt partners include Lawrence Livermore, Johns Hopkins APL, and CEPI, whose “100 Days Mission” to accelerate vaccines is, OpenAI pointedly notes, relevant to the current Ebola outbreak.

OpenAI notes that back in July 2025, ChatGPT agent became the first model it treated as “High Capability in biology” under its Preparedness Framework, so it’s nice that they are trying to shore up the defensive side here. Let’s hope it works! (And let’s see if I can convince someone at OpenAI to let me try it too!)

---

In other news...

On AI doing (or not doing) things:

• Exponential View reports that only 27% of executives say AI has met ROI expectations, even as Anthropic’s $1M+/year customers grew from a dozen to 1,000+ in two years.

• Epoch AI thinks a compute crunch is coming: token demand from software engineers alone could hit 4 billion tokens/second, growing ~10×/year against supply growth of 3.4×/year.

• Meanwhile, Nvidia posted $81.6bn in quarterly revenue (datacenter up 92% YoY) and a $5.4tn market cap, with Jensen Huang calling the AI buildout “the largest infrastructure expansion in human history.”

• Latent Space chronicles the arrival of async coding agents: Cognition (maker of Devin) raised $1B at a $26B valuation, and Devin’s commit share on internal repos jumped from 16% to 80%. Pure “vibe coding” auto-merge reportedly stays viable for about two weeks before codebase entropy catches up with you.

• A pair of “agents with a credit card” stories: Robinhood launched agentic trading and an agentic credit card (your AI can make purchases), supporting Claude, ChatGPT, Codex, and Cursor. One consultant’s framing — “the consumer is going to build that trust with ChatGPT” — should indeed be a wake-up call for the banks.

• And if you’ve wondered why none of this shows up in the official numbers: a PIIE policy brief estimates nominal “AI GDP” at ~$250 billion in 2025 and growing at thousands of percent annually in quality-adjusted terms, while noting that national statistics agencies were “not designed to track this kind of activity.”

AI safety and alignment:

• Redwood Research had a productive week. They argue that “retrying” is exploitable in AI control (a scheming model learns from your feedback) while resampling recovers most of the safety gains at 10% of the cost; they published empirical advice on building model organisms robust to training (full fine-tuning beats LoRA; prompted organisms are hilariously fragile); and Ryan Greenblatt argues that full automation of AI R&D yields a “3.5 years of progress in the first year” speedup even without a software-only singularity.

• AI Policy Perspectives reports on an expert who stripped the safety refusals out of the open-weight Kimi K2.5 model “in less than 10 hours, and a cost of less than $500.” Yikes!

• Jack Clark’s Import AI is in full reckoning mode, noting that a single human at Anthropic effectively managed 9 synthetic research agents in automation experiments, and asking the question that should haunt all of us: “Tell me how the world stays normal, based on this technology.”

AI for biology and medicine:

• Two preprints on the multi-agent-science front, both starring Claude: Stanford’s Bio-BLIP fuses four biological modalities into a frozen LLM for zero-shot genomic transfer (a 29.78% improvement on variant annotation), while Nebraska’s MechAInistic builds an Architect-Reviewer system for metabolic modeling. Both look super cool, and in both cases the authors’ audit caught Claude Opus 4.7 making “execution-level errors” on both test cases.

• Stephen D. Turner reviews the Allen Institute’s OpenScholar: GPT-4o fabricates citations 78–90% of the time on scientific queries; a retrieval-grounded 8B model dramatically reduces this and beats GPT-4o on correctness.

• On the perennial question, “but will AI actually help us get better drugs” question, Jesse Johnson notes that even if AI doubled clinical success from 10% to 20%, we wouldn’t know for 10–15 years, because the expensive part of drug development is the clinic, not discovery. (A cousin of Derek Lowe’s “it’s really, really hard”.)

• Results are in from Utah’s Doctronic trial: AI does a pretty good job of helping patients refill their prescriptions

Biosecurity:

• Three arXiv papers form a nice cluster on AI-bio guardrails, all relevant to section 4: BioRefusalAudit uses sparse autoencoders to show that model refusals on biosecurity prompts are often skin-deep (some models drop to 0% refusal under an 80-token output cap); The Biosecurity Blind Spot screens ~52,000 bioRxiv preprints and finds dual-use research “routinely present” in open titles and abstracts; and ViroBench benchmarks nucleotide foundation models on viral genomics, flagging a worrying “decoupling between statistical likelihood and biological validity” in generative models. If I have time, I intend to delve into all of these articles a little later.

• Matthew Adelstein (aka Bentham's Bulldog) reviews the story on mirror bacteria: organisms with inverted molecular chirality that could completely bypass immune defenses and maybe even consume all of biological life on this planet. Since I’ve been following the talk on mirror life for a few years already, it’s funny how this barely registers for me anymore and that I just go about my life knowing that someone out there might conceivably make this horrifying thing out of science fiction, I guess kind of like how we all just go about our lives even though we know that there are one or two people who could unilaterally set off a nuclear holocaust and kill us all. Life in the 21st (and late 20th!) century.

AI and society:

• The people do not like AI. The WSJ reports 360,000 Americans now in anti-data-center Facebook groups (roughly 4× since December), 48 data center projects worth $156 billion blocked or delayed, and of course the uptick in violence (a Molotov cocktail at Sam Altman’s home; shots fired at an Indianapolis councilman who approved a data center). Axios finds only 18% of 14–29-year-olds feel hopeful about AI; the NYT notes AI-skepticism is one of the rare bipartisan positions, with Sen. Mark Warner predicting it’ll be “the defining issue of the ‘28 campaign.”

• AI-for-writing is... interesting. One X poster scanned ~23,000 dissertations and found more than 1-in-5 show AI use (”much of the time to do all of the writing”); Kelsey Piper reports at least three regional winners of the 2026 Commonwealth Short Story Prize appear AI-generated (the Commonwealth Foundation says it has no plans to screen); and a Georgetown study (via Stephen Turner) of 370,000+ college essays found post-ChatGPT submissions to be, let’s just say, different. Detection studies lean on the Pangram detector, which is worth looking into (as an aside, I personally have found it to be much more accurate than gptzero). I’m all for using AI to help write, as long as you disclose it!

• This is only marginally related to AI, but back in January, the US Senate held a hearing on The Impact of Screen Time on Kids, where all the experts seemed to agree that somebody gotta do something about this awful horrible poison that is making our kids dumb and antisocial. This past week Science editor-in-chief Holden Thorp, Science EIC covers Tom Dee’s national Yondr phone-ban study, which found no meaningful academic gains and only modest wellbeing from banning phones in schools, and argues that the Jonathan Haidt “phones-caused-the-mental-health-crisis” thesis remains empirically thin. Personally, I’m a lot more worried about AI companions than CocoMelon, but maybe this too will pass as just yet another moral panic.