Controlled evidence that frontier LLMs let novices match or beat experts on dual-use biology tasks, and that refusal safeguards were often ineffective. This shapes how safeguards and evaluations are judged.
Key takeaways · AI-distilled
In a study by Scale Labs, SecureBio, Oxford and UC Berkeley, non-experts using frontier LLMs beat an internet-only group on nearly all 10 in silico biosecurity tasks and scored above domain experts on benchmarks including VCT and HPCT.
Nearly 90% of participants reported no meaningful barriers to dual-use-relevant information despite model safeguards, and the study found refusals did not meaningfully limit access to most of the relevant information.
The best standalone LLMA large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.Full definition → often beat the human-LLM pairs, which the analysis links to imperfect reliance such as second-guessing correct answers. Humans with AI did clearly beat the best single-shot LLM on the open-ended HLE short-answer task.
The authors argue risk evalA repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.Full definition → should move from single-question tests to interactive, task-based settings, and that refusals are easy to route around, suggesting alternatives such as plausible but incorrect answers to high-risk queries.
Terms in this piece · Glossary
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.
eval — A repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.
