Loading
Old version — revision 2
This is a fixed snapshot of Dual-use research of concern, saved by Import. It is not edited and it is not updated; the article may have changed since.
Edit summary: Re-import of content/dual-use-research.md — the file changed after the initial import. Not an edit.
Read the current versionWhat this revision changedAll 2 revisions
Life-science research that produces knowledge or tools with legitimate purposes but foreseeable potential for catastrophic misuse, and the oversight regimes built around it.
Dual-use research of concern, or DURC, is life-science research conducted for legitimate purposes that could reasonably be anticipated to yield knowledge, methods, or materials directly applicable to causing large-scale harm. The category was formalised in US policy in the 2000s, following a National Research Council report that identified a short list of experiments of concern.1 It covers a narrow slice of biology: work that increases a pathogen's transmissibility, virulence, host range, or resistance to countermeasures, or that renders a dangerous agent easier to produce. The category is the clearest case in which the same result is both a public good and a hazard, and every available response is a trade-off rather than a solution.
Biological risk differs from other technological risk in three ways that shape the governance problem.
The information itself carries the hazard. A method published in a journal cannot be recalled, is available identically to everyone who reads it, and does not degrade. What stands between knowledge and misuse is tacit skill and materials, and both of those barriers have fallen.
Capability is dual by construction. Understanding what makes an influenza virus transmissible between mammals is the same knowledge that would allow one to be made transmissible. Surveillance, vaccine design, and countermeasure development all require it, and no version of the research produces only the defensive half.
Self-replication. Unlike chemical or radiological agents, a pathogen released once can propagate beyond the point of release. For that reason biological risk features in the taxonomies discussed under Existential risk, and engineered pandemics are usually named as the most plausible near-term route to a global catastrophe. The same property drives concern about the self-spreading constructs described in Gene drives and about the chirally inverted organisms in Mirror life. It also separates real biological hazard from the self-replicating machines imagined in Grey goo, which never existed.
Nick Bostrom's typology of information hazards supplies the vocabulary the field now uses. On that account the harm can come from the specific data, from the demonstration that something is possible, or merely from directing attention to a vulnerability.2
The 2011 episode is the field's reference case because it raised every unresolved question at once: whether a journal should publish methods, who decides, whether redaction is feasible when dozens of laboratories can reproduce the work, and whether a voluntary moratorium accomplishes anything beyond delay. The papers were published and no misuse followed, an outcome both camps read as confirming their position.
Assessments of how likely deliberate misuse is turn on three questions that are routinely merged.
Capability has clearly increased. Gene synthesis is a commercial service; sequences for most known pathogens are in public databases; the reverse-genetics methods for reconstructing RNA viruses are taught in graduate programmes, and the editing tools described in CRISPR–Cas9 made targeted modification of a genome a routine laboratory operation. The whole-genome construction methods surveyed in Synthetic genomes were developed for microbial engineering and apply without modification to viral genomes. The 2018 horsepox work was performed by a small academic team at a reported cost of about a hundred thousand dollars.
Intent has the least evidence behind it. Historical bioweapons programmes were state-run, expensive, and largely unsuccessful at producing usable weapons, and the small number of non-state attempts caused limited casualties. There is no observed case of a modern actor using published dual-use research to cause mass harm. Analysts disagree sharply over whether that record reflects a genuine difficulty or a period of good fortune.
Accident is the neglected term, and the one with a documented record. Laboratory-acquired infections and containment failures have occurred repeatedly in high-containment facilities across multiple countries, including with smallpox and with influenza strains. An assessment of research risk that considers only malice leaves out the more frequent pathway.
What the debate cannot resolveThe costs of restricting research are diffuse and counterfactual, consisting of vaccines not developed and variants not anticipated, and the benefits are counterfactual as well. Neither side can produce the comparison that would settle the question, which is why two decades of argument have not converged.
Machine learning is the newest input, and it has changed the analysis in one specific respect rather than across the board.
A 2022 paper reported that a drug-discovery model built to avoid toxicity could be inverted to seek it, generating tens of thousands of candidate toxic molecules in under six hours.3 The molecules were never synthesised, and synthesis remains the hard step, but the demonstration moved the bottleneck: design is no longer the scarce part.
Protein design models raise a sharper version of the problem. In 2025 researchers reported that AI-generated variants of known toxin sequences could evade the sequence-screening software used by commercial DNA synthesis providers, with patches developed and distributed before publication. What makes the episode notable is the response rather than the vulnerability. It followed a coordinated-disclosure model borrowed from computer security, the first such process in biosecurity.
Frontier AI developers began applying elevated deployment safeguards to their models on biological-weapons-relevant capability grounds from 2025, and biosecurity evaluations are now a standard component of frontier model assessment. Whether those safeguards constrain a determined user or only raise the effort required is not publicly established, and comparable models are available in open-weight form from other developers without similar restrictions. Artificial general intelligence treats the broader capability question.
Controls operate at four points, and they get weaker further down the list.
Physical containment, meaning biosafety levels, negative pressure and personnel training, is mature and well specified, and it addresses accidents rather than misuse. Genetic containment is the newer variant. The synthetic auxotrophy built into the strains described in Genetic code expansion and recoding leaves an escaped organism unable to survive outside a supplemented medium, a stronger guarantee than a physical barrier, though one that applies only to engineered organisms and not to natural pathogens.
Synthesis screening is the most-discussed intervention. Members of the International Gene Synthesis Consortium, formed in 2009, screen order sequences against lists of agents of concern and verify customer legitimacy. Coverage is voluntary and incomplete, the screening can be defeated by ordering fragments from multiple providers, and benchtop synthesisers put the capability in sites that no consortium reaches. The US required screening for federally funded work under a 2023 executive order that was revoked in January 2025, leaving the status of the associated framework unclear as of 2026.
Funding-stage review lets a funder decline work before it is done, and it is the only intervention that acts before the information exists. The US paused federal funding for certain gain-of-function influenza and coronavirus work from 2014 to 2017, replaced the pause with a review framework, and in 2024 issued a unified policy covering both DURC and research on pathogens with enhanced pandemic potential. An executive order in May 2025 further restricted federal support for dangerous gain-of-function research. All of these measures bind federally funded work in one country.
Publication review is the last control and the weakest. Journals have no investigative capacity, editors are not biosecurity analysts, and by the time a manuscript arrives the work has been done and discussed at conferences.
The Biological Weapons Convention, in force since 1975, prohibits development, production, and stockpiling of biological weapons and has near-universal membership. It has no verification mechanism, since negotiations on a compliance protocol collapsed in 2001 and have not been revived. Its implementation support unit is very small. There is no international body that inspects laboratories, no reporting obligation for dual-use experiments, and no forum with authority to stop a specific project.
What exists instead is national policy of varying rigour, institutional review committees, and the professional norms inherited from the Asilomar Conference on Recombinant DNA. That model assumes the relevant actors care about standing among peers, and the He Jiankui affair demonstrated its limits. The same structural weakness runs through Governance of human genome editing: the enforceable layer is domestic law, and it reaches only those who submit to it.
The field's characteristic policy proposal concerns sequencing rather than prohibition. Differential technological development argues for advancing detection, countermeasures, and protective capability ahead of the research that creates the hazard. That ordering avoids the objection that a blanket Precautionary principle would also block the work needed to respond to natural outbreaks.
The open problem is what happens as the capability spreads. The controls described above are designed for a world in which dangerous work requires institutional resources: a laboratory, a funder, a supplier. Benchtop synthesis, contract research organisations, and design tools that run on a laptop each erode that assumption. Proposals for what should replace it run from licensing of synthesis equipment to the surveillance architectures contemplated in the vulnerable-world literature, and they are either insufficient or, as their own authors concede, worse than the problem.
reportNational Research Council. Biotechnology Research in an Age of Terrorism. National Academies Press, 2004.↩The source of the original list of experiments of concern; it is advice to US policymakers and carried no legal force of its own.
paperBostrom, N. "Information Hazards: A Typology of Potential Harms from Knowledge." Review of Contemporary Philosophy, 2011. ↩
paperUrbina, F., Lentzos, F., Invernizzi, C., Ekins, S. "Dual use of artificial-intelligence-powered drug discovery." Nature Machine Intelligence, 2022.↩None of the generated molecules were synthesised or assayed, so the paper reports a design capability rather than demonstrated toxicity.