AI Is Learning to Evade DNA Synthesis Screening — the "Biology Zero-Day" and the Push for Mandatory Rules

1. The premise: an "Amazon of DNA" and one unavoidable chokepoint

Researchers enter the base sequence of the gene they want, order it online, and receive synthesized DNA as a plasmid. Twist Bioscience's chief scientific officer has described the company as the "Amazon of DNA," with prices from 7 to 9 cents per base and shipping in as little as two to four days. Because a dangerous design cannot become real without someone synthesizing and shipping it, commercial synthesis is the chokepoint.

Two layers operate there: sequence screening and customer screening. The International Gene Synthesis Consortium's Harmonized Screening Protocol v3.0 screens orders of 200 base pairs or more against a Regulated Pathogen Database (US select agents, the Australia Group list, EU dual-use items) and uses six-frame translation to catch codon-optimized evasion. A hit above threshold triggers human review, and the customer's identity, affiliation, and stated purpose are checked.

2. What happened: Microsoft's "Paraphrase" attack

While preparing for an October 2022 biosecurity workshop, Microsoft's Eric Horvitz and Bruce Wittmann asked a simple question: could today's AI protein design tools rewrite a toxin's sequence so that it evades detection while keeping its structure, and potentially its function? The answer was yes. Using generative protein models, including Microsoft's own EvoDiff, they produced 76,089 variants of 72 proteins of concern — including well-known toxins such as ricin — and found that screening software could not reliably detect them.

The crucial caveat is that this was entirely a computer simulation. No toxin protein was produced and no pathogen was designed; structural similarity was predicted, not experimentally confirmed. Even so, it broke the assumption the whole defense rested on: that a dangerous sequence looks like a known dangerous sequence.

3. Why it slips through: the structural weakness of sequence search

Function follows three-dimensional structure, and the amino-acid sequences that fold into a given structure are enormously redundant. An AI can move a sequence far away in sequence space while leaving the fold — and therefore the biological activity — intact. Because the screening pipeline judges sequence similarity, a design that resembles nothing in a reference database simply does not raise a flag.

Microsoft framed the flaw as a zero day for biology: as with an unknown software vulnerability, an evasion path can exist before defenders know to patch it. MIT Technology Review noted that while some targeted toxins are publicly known, the team withheld which proteins it redesigned and parts of its code.

4. Ten quiet months, and the candid admission that the patch is incomplete

Before publishing, Microsoft alerted the US government and software makers, then worked confidentially for about ten months with screening-tool developers, the IGSC, and synthesis providers Twist and IDT, applying cybersecurity incident-response practices to run a structured red-team exercise. The results appeared in Science (Wittmann et al., 2025, Science 390, 82–87), and the improved tools were distributed to synthesis companies worldwide. IBBIS called it a precedent for responsible red-teaming of synthesis screening.

The practitioners themselves are measured. Adam Clore, director of technology R&D at IDT, puts it plainly: "The patch is incomplete, and the state of the art is changing. But this isn't a one-and-done thing. It's the start of even more testing. We're in something of an arms race." UC Berkeley's Michael Cohen goes further, arguing the challenge was weak, that patched tools still miss a lot, and that biosecurity should ultimately be built into AI systems themselves rather than resting on this chokepoint. Clore counters that US DNA manufacturing is concentrated in a few companies that work closely with government, keeping synthesis a practical point of control. The debate is unresolved.

The publication also modeled a new norm for information hazards. Because stakeholders disagreed sharply on disclosure, IBBIS and Microsoft adopted a tiered-access policy: some data moved into the paper, while code and datasets are released only after independent third-party review. It is, as far as is known, the first time a leading scientific article has formally endorsed tiered access to manage biological information hazards.

5. The tip of the iceberg: four more known gaps besides AI

AI-designed evasion is not a standalone weakness. It compounds with structural gaps that remain simultaneously open.

First, short oligonucleotide fragments. Orders under 200 base pairs are not reliably screened, so splitting an order can bypass detection. In an FBI-overseen red-team experiment (Edison et al., Nature Communications), 36 of 38 commercial providers — including 12 of 13 IGSC members — shipped 1918 influenza fragments. Industry has pushed back, noting the method uses legal camouflaged fragments that are innocuous in isolation; how large the real gap is remains contested.

Second, benchtop synthesizers, which bypass centralized screening when synthesis happens on site. Third, cell-free expression systems: freeze-dried cell lysates can produce proteins, toxins, and even whole phages from a template, outside customer verification. Fourth, capacity outside the consortium: IGSC members report roughly 80% of global gene synthesis capacity, but the remainder follows national rules and individual practices rather than one harmonized, auditable standard. And fifth, AI-designed sequences. IBBIS's Global DNA Synthesis Map reports that screening remains voluntary, inconsistent, and globally fragmented, with companies and intermediaries that simply do not screen order sequences.

6. How far regulation has moved — and the deadline left hanging

In the United States, the OSTP released a Framework for Nucleic Acid Synthesis Screening on April 29, 2024, attaching it as a procurement condition to federally funded life-sciences research: self-attestation, sequence screening, customer screening, reporting, three-year record retention, and information security. It took effect for purchases on or after April 26, 2025. Then Executive Order 14292, "Improving the Safety and Security of Biological Research," signed May 5, 2025, directed OSTP to revise or replace the framework within 90 days, effectively pausing implementation. As of October 2026 no replacement has been published, and university research-support pages still say they are awaiting new guidance.

Congress is trying to fill the vacuum. On January 29, 2026, Senators Tom Cotton and Amy Klobuchar introduced the bipartisan Biosecurity Modernization and Innovation Act of 2026 (S. 3741), which would direct the Secretary of Commerce to require gene synthesis providers to screen orders and customers, and establish a biotechnology governance sandbox at NIST. On September 14, 2026, Representatives August Pfluger and Chrissy Houlahan introduced a House companion extending requirements to manufacturers of benchtop synthesis equipment. Twist, IDT, Ginkgo Bioworks, and others support the effort, but none of it has been enacted.

One contested detail is the plan to narrow the screening window from 200 to 50 base pairs by October 13, 2026. That requirement came from the 2024 framework, which is itself under revision, so whether it still carries force is unclear. The institutional gap — a deadline left hanging — is itself the current state of affairs.

7. Where defenses are heading: from detection to provenance

The defensive mindset is shifting from after-the-fact detection to pre-emptive assurance. Google DeepMind introduced SynthID Bio, which embeds a watermark directly into AI-generated protein sequences and structures without degrading their function; a synthesis provider with the key can verify that a watermark is present and corresponds to the customer's claim. It is a biological analogue of the watermark on a banknote — not a barrier by itself, but an assurance signal that complements existing screening. NTI frames it as part of a layered defense alongside IBBIS's Common Mechanism and the BioTrust know-your-customer model.

Political pressure is rising too. In June 2026, an open letter at screendna.org called on US lawmakers to make screening and recordkeeping of synthetic nucleic acid orders mandatory. Signatories include Google DeepMind's Demis Hassabis, OpenAI's Sam Altman, Anthropic's Dario Amodei, Microsoft AI's Mustafa Suleyman, Microsoft's Eric Horvitz, Nobel laureate David Baker, and Twist CEO Emily Leproust. Amodei warned separately that if knowledge barriers erode, "effectively anyone becomes a PhD-level virologist" able to learn the steps for designing, synthesizing, and releasing a bioweapon.

In Japan, discussion exists but integrated AI-and-biosecurity institution design lags. Screening at the "ordering stage" of synthetic nucleic acids has been raised as a topic by lawmakers, and the growth strategy approved on July 21, 2026 lists synthetic biology among 17 strategic fields. With the global DNA synthesis market projected to grow from $5.95 billion in 2026 to $24.06 billion by 2034, the risk of remaining a country without an order-stage screening regime is not small.