TAI BUI
Back to curriculum
LearnPython

Dual-Use Risk — Cyber, Bio, Chem, Nuclear Uplift

Three of the four CBRN domains crossed a threshold between 2024 and late 2025. In bio, OpenAI's April 2025 Preparedness Framework v2 warned that models were "on the cusp of meaningfully helping novices create known biological threats," and Anthropic's bioweapon-acquisition trial measured 2.53x uplift. In cyber, Anthropic's November 2025 report described Chinese-linked state actors using Claude's agentic coding tool to automate up to 90% of an attack campaign, with humans stepping in at 4-6 points. In chem/bio, vision-enabled frontier models (GPT-5.2, Gemini 3 Pro, Claude Opus 4.5, Grok 4.1) can watch wet-lab video and correct mistakes in real time, which weakens the old defense that information alone is not enough. Across all of it, AI gives novices the bigger relative lift and experts the bigger absolute capability.

TIME: ~75 minutesPREREQUISITES: Phase 18 · 17 (WMDP), Phase 18 · 18 (safety frameworks), Phase 18 · 28 (ecosystem)

Learning Objectives

  • Describe the 2024-2025 bio-uplift narrative: "mild uplift" -> "on the cusp" -> "2.53x uplift insufficient to rule out ASL-3."
  • Describe the November 2025 Anthropic cyber report: Chinese-linked automation of 80-90% of a cyberattack campaign.
  • Describe the chem/bio execution-gap erosion: vision-enabled real-time correction of wet-lab experiments.
  • State the novice-relative vs expert-absolute asymmetry and its implication for safety-case construction.

The Problem

Lesson 17 covers how to measure dual-use capability. This lesson is where those measurements landed as of 2026. Between 2024 and late 2025, three of the four domains crossed a threshold that the 2024 frameworks did not anticipate, and the fourth stayed bounded for reasons that have little to do with information.

Warm-up0/3
1. In a lab's scaling policy, what does reaching a capability threshold such as ASL-3 trigger?Warm-up
A capability score rising over time and crossing a dashed vertical marker labeled ASL-3, with a dashed box past the crossing point and a note asking what happens once the line reaches that threshold.
Typed schematic, not captured output.
2. What does "dual-use" mean when describing a technology?Warm-up
A card labeled a kitchen knife with two arrows, one green arrow to chopping vegetables for dinner and one red arrow to used to threaten someone, with a dashed box asking what property this shows.
Typed schematic, not captured output.
3. A study gives one group an AI model and a control group only web search, then compares task success. What does the gap between the groups estimate?Warm-up
Two equal starting bars labeled search only and AI model, with a dashed box to the side and a note that the two groups' scores are then compared, with the gap itself left undrawn.
Illustrative, generic numbers not from the lesson.
Check: The Problem0/1
1. An analyst writes: "By late 2025, all four domains had crossed a threshold the 2024 frameworks missed." What is wrong with this claim?Analyze
The claim quoted in full, above four neutral cards for bio, chem, cyber and nuclear with no status marked, and a dashed box asking whether the claim is accurate.
Claim quoted as given.

The Concept

Bio/chem uplift narrative

The story has three phases (repeated from Lesson 17 so this lesson stands alone):

  1. 2024 "mild uplift." Early Preparedness and RSP evaluations reported small novice advantages over internet search.
  2. April 2025 "on the cusp." OpenAI's PF v2 warned that models were "on the cusp of meaningfully helping novices create known biological threats."
  3. 2025 Anthropic bioweapon-acquisition trial. A controlled novice study found 2.53x uplift on acquisition-phase tasks, which was not enough to rule out ASL-3.

The change is one of kind. "Mild" became "plausibly enabling" within eighteen months, and the evaluations that said so were run on models that were not a clean break from their predecessors.

Chem/bio execution-gap erosion

The classic defense went like this: information is necessary but not sufficient, and the skill needed to execute a protocol keeps novices out. Frontier models with vision break that defense in part:

  • Real-time protocol correction. GPT-5.2, Gemini 3 Pro, Claude Opus 4.5, and Grok 4.1 can observe wet-lab video and flag errors mid-procedure.
  • December 2025 OpenAI demonstration. GPT-5 iterated on wet-lab experiments and reached a 79x efficiency improvement through protocol optimization.

Execution skill is a weaker barrier than it was. Procurement and equipment gaps remain, but the tacit-knowledge gap is narrowing.

Cyber uplift (November 2025)

Anthropic's November 2025 report describes Chinese-linked state actors using Claude's agentic coding tool to automate 80-90% of a cyberattack campaign. Humans had to step in at 4-6 points.

What follows from that:

  • Agentic coding is the attack-automation primitive. Earlier AI cyber assistance stopped at the code-snippet level. Agentic workflows chain reconnaissance, exploitation, post-exploitation, and exfiltration.
  • Those 4-6 human steps are the bottleneck, and further capability gains would likely shrink the count.
  • Defenders get a dual-use option too. OpenAI's "trusted access" pilot gives vetted security organisations (established incident-response firms, government) capability access for defense. If the pilot scales, the access asymmetry favors defenders.

Nuclear

This is the least-analyzed of the four CBRN domains in public documentation, and the threat model differs. Fissile-material acquisition dominates the difficulty, not information, so AI uplift on the information layer gives novices limited help in practice. No major-lab report from 2024-2025 identifies a nuclear-specific threshold crossing.

Novice-relative vs expert-absolute

The same pattern shows up in all four domains:

  • Novice-relative uplift. High and multiplicative. Anthropic's 2025 bio trial put it at 2.53x.
  • Expert-absolute capability. High ceiling. An expert gets more out of the model than a novice does, because the expert knows what to ask and how to read the answer.

For safety cases, this means that handling novice uplift alone (input filters, refusals, calibrated uncertainty) does not control expert-absolute capability. You also need elicitation-hardening, capability unlearning (Lesson 17), and control protocols (Lesson 10).

Cross-domain synthesis

Domain20242025Inflection
Biomild uplift2.53x uplift, ASL-3 approachacquisition-phase automation
Chemmild upliftexecution-gap erosion via visionreal-time wet-lab correction
Cybercode assistance80-90% campaign automationagentic coding
Nuclearlimitedlimitedmaterial-access bottleneck holds

Three domains crossed thresholds. One is still bounded by a non-informational barrier.

Where this fits in Phase 18

This is the capstone: the current dual-use picture that every earlier lesson helps measure, limit, or govern. Lessons 17-18 give the measurement and the frameworks, Lessons 12-16 the evaluation tooling, Lessons 24-25 the regulatory and disclosure layer, and Lesson 28 the research ecosystem. Here the evidence lands.

Check: The Concept0/22
1. In dual-use risk evaluations, what is "uplift"?Define
Two bars for the same task's capability, one labeled no AI help and a taller one labeled with AI help, with a dashed vertical line between them marked uplift equals a question mark.
Illustrative, generic numbers not from the lesson.
2. What does novice-relative uplift measure?Define
Two bars for the same novice's task success, search only and a taller search plus model, next to a dashed box reading novice-relative uplift equals a question mark.
Illustrative, generic numbers not from the lesson.
3. What is expert-absolute capability?Define
A curve of capability extracted by a motivated expert across repeated attempts, rising then flattening near a dashed line marked ceiling equals a question mark.
Illustrative, generic numbers not from the lesson.
4. What was the execution gap in the classic chem/bio defense argument?Define
A novice who has the written information passing through a dashed gate labeled named question mark and coming out blocked, next to an expert who has the same information and skips straight to completing the protocol.
Typed schematic, not captured output.
5. What is agentic coding in the cyber context?Define
A four-stage chain from recon through exploit, post-exploit and exfiltrate, all driven by one system with no human at each step, above a smaller box describing the old way as a human running one AI-written line, with a dashed box asking what this new way is called.
Typed schematic, not captured output.
6. Which steps make up the acquisition phase of a bio threat?Define
A dashed box reading acquisition phase equals a question mark, an arrow through intervening steps, and a labeled box reading synthesis, then delivery, with no list of what the acquisition phase actually contains.
Typed schematic, not captured output.
7. What is OpenAI's "trusted access" pilot in the cyber context?Define
A box labeled cyber-capable agentic tool feeding into a dashed vetting gate, which forks toward two unlabeled boxes, Group A and Group B, with a note that which group passes through is this question's own answer.
Typed schematic, not captured output.
8. What kind of change does the 2024-2025 bio-uplift narrative describe?Explain
A three-point timeline labeled 2024, April 2025 and 2025 trial with a rising arrow marked concern rising, no values given, and a dashed box asking what shape this change takes.
Typed schematic, not captured output.
9. What made the November 2025 Chinese-linked campaign different from earlier AI help with cyberattacks?Explain
A box describing 2024-and-earlier AI cyber help as a code-snippet suggestion run by a human, next to a dashed box for the November 2025 campaign asking what is different, with no mechanism shown.
Typed schematic, not captured output.
10. Why has nuclear uplift stayed bounded compared with bio, chem and cyber?Explain
A box noting bio, chem and cyber each have a 2025 state that changed from 2024, next to a box noting nuclear's 2025 state is the same as 2024, limited, with a dashed box asking why the two differ.
Real values from main.py's DOMAINS table.
11. Why does vision capability weaken the old "information is necessary but not sufficient" defense in chem/bio?Explain
A box describing the 2024 chem/bio defense as info necessary but not sufficient, an arrow to 2025, and a dashed box reading vision-enabled models, defense weakened, why, with no mechanism shown.
Typed schematic, not captured output.
12. Why does an expert get more out of a model than a novice does?Explain
A novice and an expert both arrow into the same model box, with the novice's output a small box and the expert's output a larger box, with a dashed box asking why the two results differ in size.
Typed schematic, not captured output.
13. Why does the lesson treat the 4-6 human intervention points in the cyber campaign as the bottleneck?Explain
The four-stage agentic chain with a note that 4-6 human steps are scattered through it, a dashed box asking why these are the bottleneck.
Typed schematic, not captured output.
14. In the cross-domain synthesis table, which domain lists real-time wet-lab correction as its inflection?Apply
A four-row table with bio, chem, cyber and nuclear labelled on the left, each row's 2025-state and inflection both covered by the same blank dashed box, so no domain's figures are shown here.
Domain names only; the figures in the options are this question's own answer, not shown here.
15. In the November 2025 campaign, 80-90% of the work was automated. Roughly what share was left to the human operators?Apply
A bar chart showing 80-90% automated and a dashed question-mark segment for the rest, next to a dashed box asking what the human share equals.
Both numbers as given; not evaluated in this picture.
16. A lab publishes a nuclear information benchmark on which its model scores very high. What does the lesson's threat model predict about practical help to a novice?Apply
A single tall bar labeled benchmark score, very high, next to a dashed box asking the practical help to a novice, with no answer shown.
Score as given; the practical effect is this question's own answer.
17. A 2024 chemistry assessment said novices stay blocked because they cannot run protocols without hands-on expert guidance. A 2025 model now flags errors in live wet-lab video. Which assumption in the old assessment no longer holds?Analyze
A box stating the 2024 assessment that novices stay blocked without hands-on guidance, next to a box stating that a 2025 model flags errors in live wet-lab video, with a dashed box asking which assumption breaks.
Both facts as given in the stem.
18. A team's chemistry model gives novices a 3x gain on information questions, and expert red-teamers find it also doubles a skilled chemist's throughput on protocol optimization. The team proposes shipping with input filters and refusals tuned on the novice study. What is the best response?Analyze
A box for the novice's 3x information-question gain and a box for the expert red-team's 2x protocol-optimization throughput, above a box describing a proposed plan of filters and refusals tuned on the novice study only, with a dashed box asking for the best response.
All three facts as given in the stem.
19. A lab evaluates a bio model only on written information questions, finds mild uplift, and ships it. The 2025 bio trial measured something else. What does the lab's evaluation miss?Analyze
A pipeline from written info questions only to mild uplift found to shipped, next to a dashed box for the 2025 trial reading measured, question mark, with a dashed box asking what the lab's evaluation misses.
The lab's path is given; what the 2025 trial measured is left blank.
20. You ship a cyber-capable agentic model and want defenders to benefit without giving attackers the same access. Which design fits the lesson's ideas?Design
A box labeled cyber-capable agentic model with arrows to a defenders box and an attackers box, both wanting access, with a dashed box asking which design serves one without arming the other, and no specific design shown.
No specific design is shown here.
21. You must write a safety case for a cyber-capable frontier model. Which evidence set bounds both novice and expert uplift?Design
A box labeled safety case for a cyber-capable frontier model with two dashed boxes beneath it, novice uplift and expert-absolute uplift, both left as question marks.
Both coverage zones left blank.
22. You are planning 2027 defenses and can monitor only a few things. Given the lesson's picture, where do defenses still have something to grip?Design
Four unlabeled dashed boxes on a row, each marked with a question mark, with a dashed box below asking which slots matter most for 2027 monitoring.
All four slots left blank.

Use It

There is no code to build. Read Anthropic's November 2025 cyber report, OpenAI's April 2025 Preparedness Framework v2 update, and the Council on Strategic Risks 2025 AI x Bio wrapup.

Ship It

This lesson produces outputs/skill-dual-use-triage.md. Give it a 2026 capability claim or incident report and it triages the claim across the four domains, then says whether it affects novice-relative uplift, expert-absolute capability, or both.

Check: Ship It0/1
1. Using the dual-use triage approach, a report finds novices complete acquisition-phase bio tasks about 2.5x as often with a model as with search, and says nothing about experts. What should the triage conclude?Apply
A bar pair for novices with and without a model, about 2.5x apart, next to a dashed box noting experts were not measured, with a dashed box asking what the triage concludes.
Both facts as given in the stem.
Author's Note

I'd run main.py first, mostly to see how little it is. It is a stdlib script with a hand-entered list of four dicts, one per domain, and it prints each domain's 2024 state, 2025 state, inflection, and remaining bottleneck. Nothing is measured and nothing is fetched, so the output is only as good as the claims typed into it. That is why I'd check each row against the primary sources in Use It before repeating any of it.

The field I'd read most closely is the remaining bottleneck. The script lists pathogen procurement and biosafety equipment for bio, precursor procurement and specialized equipment for chem, the 4-6 human intervention steps for cyber, and fissile-material acquisition for nuclear. Those are where defenses still have something to grip, and they are the part of the picture most likely to change first.

If I were extending it, I'd add a column for whether each claim bears on novice-relative uplift, expert-absolute capability, or both. That is the question the triage skill asks, and the table does not answer it yet.

Exercises

  1. Read Anthropic's November 2025 cyber report. Enumerate the 4-6 human-intervention steps and argue which would be first to automate in a next-generation model.

  2. The chem/bio execution gap is eroding via vision. Design an evaluation that measures tacit-knowledge uplift without crossing ITAR/EAR boundaries.

  3. Nuclear uplift appears bounded by material access. Argue for and against the position that a future AI breakthrough could shift this bottleneck.

  4. Construct a safety case (Lesson 18 three-pillar) for a cyber-capable frontier model that bounds both novice and expert uplift.

  5. Pick one of the four domains and write a one-paragraph 2027 forecast based on the 2024-2025 trajectory. Identify the evidence that would falsify your forecast.

Key Terms

TermWhat people sayWhat it actually means
Uplift"AI helps attackers"Increase in attacker capability attributable to AI assistance
Novice-relative uplift"multiplicative"How much AI helps a novice vs status-quo
Expert-absolute capability"ceiling"Maximum capability an expert can extract from the model
Execution gap"doing vs knowing"Historical defense: tacit wet-lab skill blocks novices
Agentic coding"autonomous attacks"Multi-step autonomous cyber-task execution
Acquisition phase"pre-synthesis steps"Procurement, equipment, permit stages of a bio threat
Trusted access"defender-only pilot"OpenAI 2025 program giving vetted defenders capability access

Further Reading

Code

Ships With