Phase 18 · Lesson 30 of 30

Dual-Use Risk — Cyber, Bio, Chem, Nuclear Uplift

The 2026 dual-use picture, domain by domain. Bio/chem: Lesson 17 covers WMDP; Anthropic's bioweapon-acquisition trial (2.53x uplift) and OpenAI's April 2025 Preparedness Framework v2 warning ("on the cusp of meaningfully helping novices create known biological threats") mark the inflection point. Cyber (November 2025 Anthropic report): Chinese-linked state actors used Claude's agentic coding tool to automate up to 90% of a cyberattack campaign, with human intervention only in 4-6 steps; OpenAI "trusted access" pilot gives vetted security organisations capability access for defensive dual-use work. Chem/bio execution gap erosion: the classic defense was "information access alone is insufficient." Vision-enabled frontier models (GPT-5.2, Gemini 3 Pro, Claude Opus 4.5, Grok 4.1) can observe wet-lab video and provide real-time correction. December 2025: OpenAI demonstrated GPT-5 iterating on wet-lab experiments, achieving 79x efficiency improvement via AI-driven protocol optimization. Novice-vs-expert pattern: AI provides greater relative uplift to novices but greater absolute capability to experts.

Lesson 30 of 30Learn~75 minutesnone

Before this: Lesson 17 of Phase 18 (WMDP), lesson 18 of Phase 18 (safety frameworks), lesson 28 of Phase 18 (ecosystem)

On this page

Learning Objectives

  • Describe the 2024-2025 bio-uplift narrative: "mild uplift" -> "on the cusp" -> "2.53x uplift insufficient to rule out ASL-3."
  • Describe the November 2025 Anthropic cyber report: Chinese-linked automation at up to 90% of a cyberattack campaign.
  • Describe the chem/bio execution-gap erosion: vision-enabled real-time correction of wet-lab experiments.
  • State the novice-relative vs expert-absolute asymmetry and its implication for safety-case construction.

The Problem

Lesson 17 is the measurement methodology. Lesson 30 is the 2026 state of the measurement. The picture shifted materially between 2024 and late 2025: three of the four domains crossed a threshold that the 2024 frameworks did not anticipate.

The Concept

Bio/chem uplift narrative

Three phases (repeated from Lesson 17 for coherence):

  1. 2024 "mild uplift." Early Preparedness/RSP evaluations reported small novice advantages over internet search.
  2. April 2025 "on the cusp." OpenAI PF v2 warned models were "on the cusp of meaningfully helping novices create known biological threats."
  3. 2025 Anthropic bioweapon-acquisition trial. Controlled novice study; 2.53x uplift on acquisition-phase tasks; insufficient to rule out ASL-3.

The shift is qualitative: "mild" evolved into "plausibly enabling" within eighteen months, even without a capability breakthrough.

Chem/bio execution-gap erosion

Historic defense: information is necessary but not sufficient; the skill of executing the protocol blocks novices. 2025 frontier models with vision break this defense partially:

  • Real-time protocol correction. GPT-5.2, Gemini 3 Pro, Claude Opus 4.5, Grok 4.1 can observe wet-lab video and flag errors mid-procedure.
  • December 2025 OpenAI demonstration. GPT-5 iterating on wet-lab experiments achieves 79x efficiency improvement via protocol optimization.

The implication: execution-skill-as-defense is eroding. Procurement and equipment gaps remain, but the tacit-knowledge gap is narrowing.

Cyber uplift (November 2025)

Anthropic's November 2025 report: Chinese-linked state actors used Claude's agentic coding tool to automate 80-90% of a cyberattack campaign. Human intervention was required in only 4-6 steps.

Implications:

  • Agentic coding is the attack-automation primitive. Previous AI cyber assistance was bounded at code-snippet level; agentic workflows integrate reconnaissance, exploitation, post-exploitation, and exfiltration.
  • The 4-6 human steps are the bottleneck; future capability gains would reduce that count.
  • Defensive dual-use: OpenAI's "trusted access" pilot provides vetted security organisations (established incident-response firms, government) with capability access for defense. Asymmetry in access favors defenders if the pilot scales.

The defensive side of this work starts with reading compiled code you are allowed to analyze. The reverse engineering track in Phase 13 teaches it on programs you build yourself, with static analysis only: an ELF reader in Lesson 13.32, disassembly in Lesson 13.33, lifting to pseudocode in Lesson 13.34, and an evidence ledger that keeps observed facts apart from inferred ones in Lesson 13.35. The Inside a Decompiler machine shows the full pipeline on one function. An agent that does this work needs the same ledger, because a confident decompilation can still rest on a guess.

Nuclear

The least-analyzed of the four CBRN domains in public documentation. The threat model is different: fissile-material acquisition dominates the difficulty, not information. AI uplift on the information layer provides limited novice uplift in practice. No 2024-2025 major-lab report identifies a nuclear-specific threshold crossing.

Novice-relative vs expert-absolute

A pattern across all four domains:

  • Novice-relative uplift. High. Multiplicative. Per Anthropic 2025 bio, 2.53x.
  • Expert-absolute capability. High ceiling. An expert extracts more than a novice because the expert knows what to ask and how to interpret.

Implication for safety cases: addressing only novice uplift (via input filters, refusals, uncertainty) is insufficient for expert-absolute control. Additional measures required: elicitation-hardening, capability unlearning (Lesson 17), and control protocols (Lesson 10).

Cross-domain synthesis

Domain 2024 2025 Inflection
Bio mild uplift 2.53x uplift, ASL-3 approach acquisition-phase automation
Chem mild uplift execution-gap erosion via vision real-time wet-lab correction
Cyber code assistance 80-90% campaign automation agentic coding
Nuclear limited limited material-access bottleneck holds

Three domains crossed thresholds. One remains bounded by non-informational barriers.

Where this fits in Phase 18

Lesson 30 is the capstone: the current dual-use picture that every prior lesson contributes to measuring, limiting, or governing. Lessons 17-18 give the measurement and frameworks; Lessons 12-16 give the evaluation tooling; Lessons 24-25 give the regulatory and disclosure layer; Lesson 28 gives the research ecosystem. Lesson 30 is where the evidence lands.

an-uplift-asymmetry

Use It

No code. Read the Anthropic November 2025 cyber report, OpenAI's Preparedness Framework v2 April 2025 update, and the Council on Strategic Risks 2025 AI x Bio wrapup.

Ship It

This lesson produces outputs/skill-dual-use-triage.md. Given a 2026 capability claim or incident report, it triages across the four domains and identifies whether the claim affects novice-relative uplift, expert-absolute capability, or both.

Exercises

  1. Read Anthropic's November 2025 cyber report. Enumerate the 4-6 human-intervention steps and argue which would be first to automate in a next-generation model.

  2. The chem/bio execution gap is eroding via vision. Design an evaluation that measures tacit-knowledge uplift without crossing ITAR/EAR boundaries.

  3. Nuclear uplift appears bounded by material access. Argue for and against the position that a future AI breakthrough could shift this bottleneck.

  4. Construct a safety case (Lesson 18 three-pillar) for a cyber-capable frontier model that bounds both novice and expert uplift.

  5. Pick one of the four domains and write a one-paragraph 2027 forecast based on the 2024-2025 trajectory. Identify the evidence that would falsify your forecast.

Key Terms

Term What people say What it actually means
Uplift "AI helps attackers" Increase in attacker capability attributable to AI assistance
Novice-relative uplift "multiplicative" How much AI helps a novice vs status-quo
Expert-absolute capability "ceiling" Maximum capability an expert can extract from the model
Execution gap "doing vs knowing" Historical defense: tacit wet-lab skill blocks novices
Agentic coding "autonomous attacks" Multi-step autonomous cyber-task execution
Acquisition phase "pre-synthesis steps" Procurement, equipment, permit stages of a bio threat
Trusted access "defender-only pilot" OpenAI 2025 program giving vetted defenders capability access

Further Reading

Check yourself

Quick quiz

  1. How did the 2024-2025 bio-uplift narrative evolve?

    1. It stayed unchanged across 2024-2025
    2. From 'severe uplift' to 'no measurable uplift'
    3. From 'mild uplift' (2024) to 'on the cusp of meaningfully helping novices create known biological threats' (April 2025) to '2.53x uplift insufficient to rule out ASL-3' (Anthropic 2025)
    4. From 'no uplift' to 'mild uplift'
    Show the answer

    C. From 'mild uplift' (2024) to 'on the cusp of meaningfully helping novices create known biological threats' (April 2025) to '2.53x uplift insufficient to rule out ASL-3' (Anthropic 2025)

  2. What did Anthropic's November 2025 cyber threat report find?

    1. Frontier models refused all cyber tasks
    2. Open-source models exceeded frontier capability
    3. Chinese-linked state actors used Claude's agentic coding tool to automate 80-90% of a cyberattack campaign, with human intervention only in 4-6 steps
    4. Cyberattacks remained entirely manual
    Show the answer

    C. Chinese-linked state actors used Claude's agentic coding tool to automate 80-90% of a cyberattack campaign, with human intervention only in 4-6 steps

  3. How are vision-enabled frontier models eroding the chem/bio execution gap?

    1. By increasing context length only
    2. By replacing all lab equipment with virtual simulators
    3. By observing wet-lab video and providing real-time protocol correction; OpenAI's December 2025 demonstration showed GPT-5 iterating on wet-lab experiments at 79x efficiency improvement via AI-driven protocol optimization
    4. By generating fake protocols
    Show the answer

    C. By observing wet-lab video and providing real-time protocol correction; OpenAI's December 2025 demonstration showed GPT-5 iterating on wet-lab experiments at 79x efficiency improvement via AI-driven protocol optimization

  4. Why has nuclear-domain uplift remained bounded relative to bio/chem/cyber?

    1. Frontier models refuse to discuss physics
    2. All nuclear information has been removed from training data
    3. Nuclear is the easiest domain to attack with AI
    4. The threat model is dominated by fissile-material acquisition (a non-informational, procurement-and-equipment bottleneck), so AI uplift on the information layer provides limited novice uplift in practice
    Show the answer

    D. The threat model is dominated by fissile-material acquisition (a non-informational, procurement-and-equipment bottleneck), so AI uplift on the information layer provides limited novice uplift in practice

  5. What does the novice-relative vs expert-absolute asymmetry imply for safety cases?

    1. Addressing only novice uplift (input filters, refusals, uncertainty) is insufficient for expert-absolute control; additional measures like elicitation-hardening, capability unlearning, and control protocols are needed
    2. Both are perfectly addressed by RLHF
    3. Expert-absolute capability is automatically zero
    4. Only novice uplift matters
    Show the answer

    A. Addressing only novice uplift (input filters, refusals, uncertainty) is insufficient for expert-absolute control; additional measures like elicitation-hardening, capability unlearning, and control protocols are needed

  6. What is OpenAI's 'trusted access' pilot in the cyber dual-use context?

    1. A patch for CVE-2025-32711
    2. Granting vetted security organisations (incident-response firms, government) capability access for defensive dual-use work, creating an access asymmetry that favours defenders if it scales
    3. An open-source release of GPT-5
    4. Closing all API access
    Show the answer

    B. Granting vetted security organisations (incident-response firms, government) capability access for defensive dual-use work, creating an access asymmetry that favours defenders if it scales

Questions people ask

Can AI help hackers?

It can. Reports from AI companies describe criminals and government-backed groups using coding assistants to write malware, scan for weak points and automate parts of attacks. Providers respond by detecting abuse, banning accounts and tightening safeguards.

What does uplift mean in AI safety?

Uplift is how much an AI tool improves someone's ability to do a task compared with using only the internet and normal resources. Safety tests measure uplift for dangerous tasks to decide whether a model needs stronger restrictions.

Run the code Read it on GitHub

Next phase: Phase 19, Capstone ProjectsCapstone 01 — Terminal-Native Coding AgentPrevious: Moderation Systems — OpenAI, Perspective, Llama Guard

Lessons from AI Engineering from Scratch by Rohit Ghumare and contributors, MIT license. Notes for owners by Lozo. License

Next step

Rather have it built for you?

Reading is optional. Tell me what's stuck and I'll build it into the business you already run.

Tell me what's stuck
  • A real conversation, not a pitch
  • You keep your accounts
  • Nothing sends without your yes