AI, Cybersecurity & Catastrophic Dual-Use Risk

Current landscape

All three major frontier labs run tiered, self-administered evaluation frameworks that trigger precautionary safeguards well before a capability is confirmed dangerous, not after. Anthropic activated its highest current safety tier alongside Claude Opus 4 in May 2025 while explicitly stating it had not yet determined whether the model had definitively crossed the relevant biological-risk threshold. It acted because it could no longer rule the risk out. That tier deploys real-time input/output monitoring plus over a hundred security controls against model-weight theft, and later models have shipped under the same standard while their published system cards state they do not cross the next threshold up. OpenAI's Preparedness Framework classified a 2025 model as "High" capability in the biological/chemical domain preemptively, and its 2026 successor was rated "High" in both bio/chem and cybersecurity. Google DeepMind's Frontier Safety Framework sets alert thresholds deliberately below its defined critical capability levels as a safety buffer; one 2025 model tripped the cyber alert threshold specifically, while a later model crossed no new thresholds and was assessed as offering only minimal uplift over a web-search baseline in the bio/chem domain.

Gene-synthesis screening itself has no binding federal statute. The mechanism that exists today is conditional funding: a 2024 federal framework requires screening, customer verification, and recordkeeping only as a condition of receiving federal life-science funding, and a 2025 executive order paused that framework for a 90-day revision without mentioning AI anywhere in its text. The AI-specific policy push instead comes from a separate July 2025 administration plan, which explicitly frames AI-enabled biological design as the reason to tighten screening: proposing to move funded institutions from voluntary attestation toward mandatory verification and directing an industry-wide data-sharing mechanism to catch malicious customers. A documented, acknowledged gap remains: benchtop DNA synthesizers largely sit outside both the funding-conditional framework and any AI-specific proposal.

On the cyber side, there is no dedicated certification or licensing regime for offensive AI capability distinct from general catastrophic-risk disclosure. State frontier-safety laws require published cybersecurity practices as one of several generic risk categories, not a dedicated cyber test-and-certify pipeline. The evaluation infrastructure that exists instead is voluntary: the renamed federal AI standards center signed pre-deployment evaluation agreements with several major labs in 2026, alongside a parallel UK evaluation body that jointly tests models against a standardized multi-step corporate-intrusion benchmark. Measured performance on that benchmark rose sharply, from under two of thirty-two steps completed in mid-2024 to nearly ten steps by early 2026 — a fast-moving capability trend even if the absolute numbers remain well short of full compromise. A separate federal prize competition produced AI systems that found the large majority of injected vulnerabilities in open-source software, patched most of what they found, and surfaced previously-unknown vulnerabilities along the way. This is defensive capability sitting alongside the same underlying offensive capability being evaluated for risk.

The documented incidents, in more detail

Anthropic's disclosure of the state-sponsored espionage campaign is unusually specific for this kind of report: the attacking group used Claude Code as an active operational tool against roughly thirty target organizations, with the model executing the substantial majority of technical tactics after being convinced it was doing legitimate penetration testing. Anthropic's own framing is that this represents a real escalation in AI-enabled offensive capability, not a hypothetical one. The company's public response (account bans, detection-signature sharing with the security community, public disclosure) is itself evidence that the current voluntary-cooperation model can work when a lab chooses transparency. OpenAI has published its own recurring threat-intelligence disclosures covering state-linked actors using its models for phishing content and malware-evasion research, but assesses that activity as limited, incremental capability uplift over existing attacker playbooks rather than a qualitatively new offensive capability, a different severity read on a structurally similar disclosure, worth noting rather than flattening into one narrative.

The Microsoft biosecurity case is the clearest example of the information-hazard tension this issue has to navigate. Researchers deliberately did not publish the specific toxin identities their AI tooling generated, instead privately notifying the relevant industry screening consortium and government agencies and helping ship a screening-software patch before publishing the underlying research at all. This was an information hazard, handled by withholding exactly the detail that would have made it actionable, while still fixing the underlying gap.

Critical-infrastructure early access: precedent and design

No program today gives critical-infrastructure operators privileged advance access to frontier AI defensive capability specifically, and this issue doesn't claim otherwise. What exists are two adjacent, real mechanisms this proposal combines rather than invents from nothing. Information Sharing and Analysis Centers, established under a 1998 presidential directive, already run a tiered-access model for sensitive threat information: vetted sector members receive AMBER- or RED-classified detail under the Traffic Light Protocol that the general public never sees, which only gets CLEAR-level summaries. Separately, NIST's post-quantum cryptography standardization process (2016-2024) is the clearest public model of open, criteria-based technology qualification done right: NIST published its evaluation criteria and test battery in advance, every submission (dozens of them, from large incumbents and small independent teams alike) was evaluated against the same published bar, and the results were made public. Neither mechanism was designed for AI. Combining them, tiered access for vetted critical-infrastructure operators, qualification for participating frontier labs decided by a published technical bar instead of a negotiated agreement, is a direct extension of both, not a leap into an unprecedented model of government-industry partnership.

Trade-offs and opposing views

The core tension this issue has to hold honestly: labs can invoke information-hazard concerns to justify withholding evaluation methodology and results, and that's sometimes necessary (the Microsoft case above), but it's also a convenient shield against outside scrutiny of what is otherwise entirely self-graded safety work. Proposal 3's "report the fact and category, not necessarily the method" structure is a direct attempt to hold both truths at once rather than picking a side. On adequacy of current safeguards, one 2025 industry-wide safety assessment found only a minority of major labs report substantive dangerous-capability testing at all, and graded the industry harshly on existential-safety planning even as several labs simultaneously claim near-term transformative capability, a tension between how seriously labs say they're taking this and how much independently-verifiable evidence exists that they are. Skeptics on the other side argue that speculative existential-risk framing crowds out attention to already-occurring, more mundane harms, and that measured "uplift" in lab trials to date has been modest and may not generalize cleanly to next-generation models. This is a view this issue takes seriously without adopting outright, given that the Anthropic espionage disclosure and the Microsoft toxin case are not hypothetical, even if they don't resolve the broader debate about how large the tail risk is.