Artificial intelligence (AI) is transforming the practice of biological discovery. Among the most powerful tools driving this change are protein language models (pLMs)—large models trained on vast collections of natural protein sequences (Xiao et al., 2025). These tools offer unprecedented speed and scope for understanding biological systems, predicting properties like protein fitness (Chen et al., 2023; Meier et al., 2021; Vieira et al., 2024; Zhang et al., 2024), and even generating novel proteins entirely (Ruffolo and Madani, 2024; Hsu et al., 2022). In the recent fight against SARS-CoV-2 pandemic, pLMs help predicting viral fitness (Wang et al., 2024; Yu et al., 2025; Ito et al., 2024) and immune escape (Wang et al., 2023), accelerate the development of vaccines and therapeutics (Hie et al., 2024; Jiang et al., 2024; Shanker et al., 2024) and anticipate viral evolution (Huot et al., 2025b,c).

However, the true transformative power, and potential risks, emerge not from pLMs in isolation, but from their integration with wet lab platforms and active learning close feedback loops. This convergence, which we term Intelligent Automated Biology (IAB), couples model-guided sequence design with robotic synthesis and experimental feedback, creating a high-throughput loop that iteratively refines biological function. Such systems promise major advances in therapeutic discovery, enzyme design, and pandemic preparedness. Yet they also reshape the landscape of biosecurity by enabling optimization of viral traits or other high-risk functions with diminishing human oversight.

Rather than portraying IAB as a singular threat, our goal is to examine how its technical trajectory alters the biosecurity framework. The integration of predictive modeling, active learning, and automated experimentation yields three interlocking effects. First, the exploration of protein fitness landscapes is dramatically accelerated: active learning allows the efficient identification of functional mutations from minimal data (Jiang et al., 2024; Huot et al., 2025b; Yang et al., 2025). Second, laboratory throughput expands by orders of magnitude, with automated platforms capable of testing thousands of variants per day (Zhang et al., 2025; Yu et al., 2023). Finally, these tools collectively lower the expertise required to perform sophisticated protein engineering, widening access to capabilities once restricted to specialized laboratories.

In this Perspective, we map the current progress in fitness optimization with pLMs and critically assess how these approaches are being applied to viral evolution and integrated with automated laboratory workflows. We then propose a capability-oriented framework for evaluating integrated AI–biology systems and outline emerging directions for pLM-specific safeguards.

pLMs are not just predictive tools; they are increasingly integrated into active protein engineering workflows, dramatically accelerating the pace and changing the nature of biological design. This integration manifests in several key applications.

The core challenge presented by the convergence of AI and biotechnology lies in its inherent dual-use nature: technologies developed with beneficial intent, such as improving human health or combating pandemics, can often be repurposed to cause harm. pLM substantially amplifies this dilemma by accelerating design cycles, lowering knowledge barriers, and enabling automation at unprecedented scales. To effectively discuss and manage these risks, it is helpful to categorize the capabilities enabled by IAB and assess their associated risk levels.

We propose a framework categorizing IAB capabilities into five levels, reflecting escalating potential for misuse as pLM integration deepens (Table 1). This framework builds upon initial concepts and incorporates insights from recent literature on AI capabilities and biosecurity risks.

This table illustrates that while Level 2 already poses a threat by enabling designing viral proteins that escape antibody binding, the most substantial risks emerge from the DBTL cycle coupled with physical automation. Level 5 enabling rapid, automated, and potentially remote execution of complex bioengineering tasks,¹ maximizing both the potential for benefit and the potential for misuse. For each level we classified, concrete examples are provided—and concerningly, full AI-biology automation integration at Level 5 has already been observed in 2025. A key rationale for this tiered framework is that it enables the development of proportionate safeguards tailored to each IAB capability level.The specific design and implementation of such tiered safeguards, while outside the scope of this work, represents a critical direction for future policy development and technical research for IAB.

To better quantify the acceleration enabled by this integration, we estimated the speed to obtain a functional variant (“hit”) using wet-lab hit rates on an 85-amino-acid peptide (Jawaid et al., 2023). Hit rate is defined as the fraction of tested sequences that exhibit the desired function. Combining these hit rates with representative experimental throughput values, we find that AI-guided, automated pipelines (Level 5) can yield thousands of hits per day—several orders of magnitude more than traditional, manual, non-AI-guided approaches (Figure 3). This illustrates how full-stack automation not only increases capability but compresses timelines, potentially outpacing the safety checks traditionally used to govern wet-lab experimentation.

A critical factor contributing to this assessment difficulty is the “evaluation bottleneck” (Pannu et al., 2025). AI-Bio models at Capability Level 3 and above can generate novel protein sequences, but accurately predicting their real-world function—especially their potential harmfulness—remains an open challenge. Definitive functional validation often requires synthesizing the DNA and expressing the protein in a wet lab.

However, if the AI-designed entity possesses hazardous properties, this evaluation step becomes inherently dangerous. This stands in contrast to evaluating text generated by large language models (LLMs) in the medical or virology domain, where outputs remain directly interpretable by humans and standardized benchmarks exist to assess risks (Chen et al., 2025; Gotting et al., 2025). The inability to safely and reliably assess the biological function of IAB outputs poses a fundamental obstacle to timely risk detection and mitigation. Without robust, trustworthy pLM risk evaluation tools and benchmarks, we risk not knowing the true danger posed by a new IAB or a specific protein design until it has been physically instantiated—potentially too late to prevent harm.

On the biosecurity side, traditional regulatory measures are globally insufficient for addressing AI-specific risks. Established frameworks, such as the U.S. Policy on Dual Use Research of Concern (DURC) (U.S. Department of Health and Human Services, Administration for Strategic Preparedness and Response, ASPR), rely on static lists of specific agents and experimental manipulations that fail to capture the versatile nature of tools like pLMs. As such, it does not account for the dual-use potential of IAB (Undheim, 2024). This disconnect extends to other major players: while China's 2020 Biosecurity Law elevates the issue to a national security priority, it remains heavily focused on physical containment rather than algorithmic risks (Min et al., 2025). Meanwhile, in Latin America, governance is hindered by limited institutional awareness and a lack of policy harmonization (Flores-Coronado et al., 2025).

One of the most widely used approaches in biosecurity—DNA synthesis screening (SecureDNA, 2025; Baum et al., 2024) aims to prevent the acquisition of matches to regulated pathogens or known hazardous sequences (DiEuliis et al., 2017). Yet red-teaming has exposed severe vulnerabilities: an MIT experiment demonstrated how order splitting and camouflaging allowed synthetic fragments capable of reconstructing the 1918 influenza virus to be purchased from many providers. In that test, 93% of U.S. vendors and 100% of international vendors delivered the disputed fragments. Moreover, a separate adversarial exercise by Microsoft scientists underscored the same risk of evasion (Wittmann et al., 2025). Also, generative models can design entirely novel protein sequences (Dauparas et al., 2022) or potentially generate sequences designed to evade detection (Lu et al., 2023).

On the training methodology side, no established safeguard frameworks exist for pLMs. To address this gap, we explore early-stage technical approaches—adapted from the LLM safety literature—that may help reduce the risk of generating dangerous biological sequences. Broadly, these approaches can be categorized into training-time guardrails, which modify the model's learning process to discourage the generation of harmful content; and inference-time guardrails, which filter or steer model outputs at the point of generation. One fundamental training-time strategy is likelihood suppression, which aims to discourage the model from assigning high probability to harmful sequences (Figure 4). This can be formalized by modifying the training objective to penalize the likelihood of pathogenic sequences:

where L represents the likelihood of any sequence and λ controls the strength of the suppression (Ko et al., 2024). However, this approach is not without drawbacks, as safeguards that alter the loss function can be difficult to adopt due to their negative effects on beneficial model uses (Dong et al., 2025). A more adaptive approach to implementing such training-time penalization, or more broadly steering the model toward safer outputs during training, is Reinforcement Learning from Human Feedback (RLHF) (Ouyang et al., 2022; Bai et al., 2022). While no end-to-end implementation of RLHF for pLM safety has been empirically demonstrated, we sketch a conceptual mapping here as a foundation for crucial future research and development in this area. In this context, the pLM acts as a policy generating sequences, while a separate reward model (RM)—potentially trained on datasets of viral protein sequences, structures, and functions—evaluates their potential harmfulness. The pLM can then be fine-tuned using RL algorithms like Proximal Policy Optimization (PPO) (Schulman et al., 2017) to minimize the generation of dangerous sequences. This approach represents an advanced method for instilling safety considerations during the model training phase. Recent work has demonstrated the feasibility of using RL techniques on pLMs for preference optimizations and fine-tuning (Karimi et al., 2024; Stocco et al., 2024; Mistani and Mysore, 2024; Liu et al., 2025; Blalock et al., 2025), suggesting these methods could be adapted for safety purposes. Developing RM for pLM safety could face difficulties, including precisely defining the harmfulness score and obtaining sufficient labeled protein data for it. RLHF for pLMs can inherit issues from LLMs such as reward hacking.

Alternatively, safeguards can be implemented as inference-time guardrails, a strategy most effective for proprietary commercial models where providers embed protections at the API level. In contrast, these external guardrails are less robust for open-source models, as attackers can bypass them by modifying the code directly (Dong et al., 2025).

These methods typically do not alter the underlying model weights but instead apply checks, filters, or steering mechanisms during or after the generation process. This can involve pre-generation constraint conditioning, where generation is guided away from risky regions of the sequence space using techniques like control tokens or latent variable manipulation. A specific example of an inference-time filter is the embedding-space rejection radius (Rebedea et al., 2023) (Figure 4). This method blocks the output of generated sequences whose embeddings are found to be too close to those of known harmful proteins. During inference, a generated sequence's embedding would be compared against a curated database of harmful protein embeddings (e.g., using cosine similarity or Euclidean distance). If a sequence falls within a predefined rejection radius of a known harmful protein, its output is blocked or flagged.

Developing robust and generalizable safeguards, however, will also require standardized benchmarks to evaluate model capabilities in high-risk domains such as viral fitness prediction. To support this, we propose a zero-shot benchmark example (Table 2) built from publicly available viral mutational scanning datasets, which quantify fitness across thousands of viral protein variants. These could enable assessments of whether a pLM can predict viral properties, offering an empirical basis to evaluate dual-use risk, particularly for open-weight models. We acknowledge that the development of such benchmarks might be prone to being misused for designing new viruses; therefore, efforts are needed to widen the evaluation-genration gap–that is, making it harder to generate harmful viruses but easier to detect them. Furthermore, future work should expand on this foundation to develop a more comprehensive dataset.

While our discussion centers on built-in pLM safeguards, we recognize that comprehensive IAB risk mitigation requires a multi-layered defense strategy. We focus primarily on pLM-specific safeguards for several key reasons. First, pLMs represent a critical and currently under-defended chokepoint in the IAB pipeline—while other layers like DNA synthesis screening and laboratory oversight have established (though imperfect) safeguards. Second, pLM safeguards offer broad coverage across multiple downstream applications, potentially preventing harmful sequences from being generated regardless of the specific experimental platform used. However, effective IAB governance requires safeguards across all system components from laboratory-level to model-level.

Integrating AI, particularly pLMs, with automated experimental biology platforms marks a significant technological leap. The specific biosecurity implications depend critically on the application of the IAB system. For instance, capabilities advanced for exploring small biomolecules or designing novel therapeutic antibodies pose a vastly different and lower relative risk than systems applied to exploring the immune escape of pandemic pathogen variants. The most acute risks emerge when IAB systems are used to rapidly explore complex biological landscapes to optimize high-risk functions, such as viral fitness or immune evasion, in pathogens of concern. Specifically, malicious actors could generate and release multiple variants that escape antibody-based population immunity. Even with intact T-cell immunity, the serial release of such functional, immune-evasive variants could drive repeated global waves of infection and substantial mortality.

Existing AI and biosecurity frameworks fall short of managing these IAB-specific risks. The path forward lies in developing pLM safeguards that can differentiate between these applications—enabling continued innovation in low-risk domains while implementing stringent controls for high-risk uses. Training-time safeguards like likelihood suppression can be calibrated to specifically penalize pathogenic sequences while preserving performance on therapeutic targets. Similarly, inference-time guardrails can implement application-specific screening, blocking outputs in high-risk domains while permitting beneficial uses. Additionally, safety frameworks and safeguards for pLMs should be easy to update, so newly identified weapons-relevant capabilities can be quickly restricted, especially as AI-Bio tools becoming more powerful.

Rather than constraining all IAB development, the goal should be advancing capability selectively while reducing risks differentially. Safeguards could advance on two fronts: (i) the safety of the model itself, by integrating technical controls at the training-time and at inference-time guardrails discussed in Section 5, and (ii) the DNA-synthesis infrastructure where screening must move beyond today's homology-match filters, and be expanded to function-aware or structure-aware methods that use pLMs themselves as screening tools. Unlike LLMs, pLM outputs can be synthesized into real biological threats. Risk must therefore be assessed across the entire pipeline, from design to synthesis, with enforceable safeguards.