Engineered pandemics

Engineered pandemics are outbreaks caused by a pathogen that has been deliberately modified, deliberately built from a published sequence, or deliberately released, rather than one that crossed into humans from an animal reservoir. No such event is known to have happened. The category is nonetheless treated as one of the more plausible routes to a global catastrophe, for three reasons that are structural rather than speculative: the agent replicates on its own, the enabling knowledge is published and cannot be recalled, and the cost of the underlying techniques has fallen by orders of magnitude while the number of people able to use them has risen.

§What would make a pathogen pandemic-capable

Natural selection optimises pathogens for transmission, not for lethality, and the two usually trade against each other: an agent that incapacitates its host quickly spreads less. The combinations that concern biosecurity analysts are the ones evolution rarely assembles and an engineer might. Long presymptomatic infectiousness paired with high case fatality is the standard example. Resistance to existing vaccines and antivirals is another, and it is the one that turns a manageable agent into an unmanageable one without changing its biology much.

Whether such a combination can actually be built is not established. What has been shown is narrower and still significant: that a specific barrier to mammalian airborne transmission can be crossed deliberately. Two laboratories in 2011 and 2012 produced avian H5N1 influenza variants that spread between ferrets by respiratory droplet, identifying a small number of amino acid substitutions that sufficed.¹ The transmissible viruses were not more lethal in that model, and they remained sensitive to oseltamivir. The result nonetheless established that the property most relevant to pandemic potential is engineerable, and it did so in the open literature.

Mortality in respiratory pandemics also concentrates steeply by age, tracking the decline in immune function described under Immunosenescence, which means the burden of any such event would fall on the same population that most other risk analysis in this wiki treats as the beneficiary of longer life.

§The record so far

1. 1972
   Biological Weapons Convention
   The first treaty banning an entire class of weapons opens for signature. It contains no verification mechanism, and the Soviet Union ran a large offensive programme while a party to it.
2. 1979
   Sverdlovsk
   An aerosol of anthrax spores escapes from a Soviet military microbiology facility, killing at least 66 people. The Soviet government attributed the deaths to contaminated meat until 1992.
3. 1984
   The Dalles
   Members of an Oregon commune contaminate restaurant salad bars with Salmonella, sickening at least 751 people. It remains the largest bioterrorist attack in US history and used a food-borne organism, not a transmissible one.
4. 2001
   Anthrax letters
   Spores mailed within the United States kill five people and infect seventeen. The FBI concluded the material originated in a US biodefence laboratory.
5. 2002
   Poliovirus assembled from mail-order DNA
   A team reconstructs infectious poliovirus from published sequence and commercially ordered fragments, showing a virus can be rebuilt without a natural sample.
6. 2011–2012
   H5N1 transmissibility
   Ferret-transmissible avian influenza variants are made in two laboratories. A US advisory board recommends redacting the methods, then reverses; the papers appear in full.
7. 2018
   Horsepox
   A Canadian group synthesises horsepox virus, a relative of smallpox, from chemically synthesised DNA fragments at modest cost.
8. 2025
   US pause on dangerous gain-of-function work
   An executive order halts federally funded research that would make a pathogen more transmissible or harder to counter, superseding the previous year's oversight policy.

Two patterns run through this record. The deadly events came from state facilities: the Sverdlovsk aerosol killed at least 66 people,² and the 2001 letters used material the FBI traced to a US biodefence laboratory. The largest non-state attack on record made at least 751 people ill and killed nobody,³ and the other serious attempt was technically limited: the Aum Shinrikyo cult sprayed an anthrax preparation over Tokyo without producing a single case, having cultured a vaccine strain. Against that, the capability those attempts lacked is exactly the capability that has since become cheap.

§The routes

State programmes. These have produced the only demonstrated mass-casualty capability. The Biological Weapons Convention prohibits them,⁴ and the Soviet Union ran one of the largest on record while a party to it, which is documented history rather than inference.

Non-state actors. The historical base rate of success is zero and the historical base rate of attempts is not. Analysts who take this route seriously argue that the relevant question is not how many groups want to cause mass casualties but how much skill the least skilled of them now needs. The amateur culture surveyed under Biohacking and grinders is usually invoked here, although its documented output is closer to insulin production and self-administered CRISPR constructs than to anything pathogenic.

Laboratory accident. Laboratory-acquired infections are documented regularly, and the origin of the COVID-19 pandemic remains genuinely unresolved in mainstream scientific opinion, with both zoonotic and research-related hypotheses still argued by serious people. Whichever is correct, the dispute itself has done more to shape biosafety policy than any deliberate-release scenario.

Research on enhanced pathogens. The category the H5N1 episode created, covered in full under Dual-use research of concern, is the one place where the risk is generated by people trying to reduce it.

Assistance from AI systems. Students without laboratory training, working with chatbots for an hour, were able to elicit candidate pandemic pathogens, reverse-genetics routes to obtaining them, and the names of synthesis providers unlikely to screen orders.⁵ A red-team study run at RAND the following year found no statistically significant difference in the viability of biological attack plans produced with and without large language models.⁶ Both results are usually cited as though they settle the question; neither does. The design capability demonstrated in protein and sequence design work such as AI protein design is a separate concern from the tutoring capability these two studies measured.

§Plausibility

There is no frequency to extrapolate from, so every estimate is a judgement. Toby Ord's stated credence in The Precipice puts engineered pandemics among the largest anthropogenic existential risks of this century, above natural pandemics by a wide margin, and he presents the figure as his own credence rather than a calculation.⁷ Kevin Esvelt has argued that within about a decade tens of thousands of people will have the knowledge to cause a pandemic single-handedly, which is a claim about the diffusion of capability rather than about intent.⁸ Neither figure is a measurement, and the wider field of Existential risk analysis contains no agreed method for producing one. What can be said without a number is that the risk sits in the same structural class as the self-spreading constructs of gene drives and the hypothetical organisms of Mirror life, and that it is the closest real analogue to the hypothetical Bostrom uses in the vulnerable world hypothesis, a technology cheap enough to be widely available and destructive enough that a single user matters.

Is capability the binding constraint?

One camp holds that tacit laboratory skill, working materials, and the difficulty of aerosolisation remain formidable, and points to the RAND null result and to the consistent failure of non-state attempts. The other holds that these barriers are exactly the ones automation, protocol publication, and contract research organisations are dismantling, and that a red-team exercise with a fixed scenario cannot measure a capability that has not been reached yet. The disagreement is about the shape of a trend, not about any observed event, and it is unlikely to be resolved by evidence before the fact.

§Mitigation

The standard framing separates three lines of defence. Delay covers everything that slows the spread of capability: screening synthetic DNA orders against hazardous sequences, which is voluntary in most jurisdictions and performed by a subset of providers; withholding methods that would enhance transmissibility; and export controls. Detect covers surveillance designed to identify an unknown agent rather than a known one, principally metagenomic sequencing of wastewater and travel hubs, on the reasoning that a stealth pathogen would be recognised too late by clinical reporting. Defend covers stockpiled protective equipment, air treatment, and rapid countermeasure platforms.⁸

The third line is where the most has changed. The vaccine timeline achieved in 2020 using lipid nanoparticle delivery was unprecedented and would still have been far too slow against a pathogen with a long presymptomatic phase. That asymmetry is the argument for weighting detection and physical protection over medical countermeasures, and it is a rare case where the cheapest interventions are also the most robust.

§Governance

The Biological Weapons Convention prohibits development, production and stockpiling, has broad membership, and cannot verify anything. Six years of negotiation toward a verification protocol collapsed in 2001 when the United States rejected the draft, and no binding successor has been attempted since. What exists instead is a patchwork of national oversight policies, institutional review, journal norms, and voluntary industry screening, none of which binds a determined state and all of which depend on the compliance of the people they govern. It is a weaker regime than the one described under Governance of human genome editing, and for the same underlying reason: the equipment is ordinary and the jurisdictions are many. Engineered biocontainment of the kind proposed for Genetic code expansion and recoding is one of the few technical rather than legal answers on offer, and it applies to laboratory strains rather than to a pathogen someone intends to release.

The United States has moved twice in quick succession: a unified oversight policy for dual-use research and pandemic-potential pathogens in 2024, then Executive Order 14292 in 2025, which paused federally funded work meeting a definition of dangerous gain-of-function research and directed a replacement policy.⁹ The pattern of rapid reversal is itself the governance problem in miniature. A field in which the rules change with an administration cannot support the long-term coordination that the sequencing argument and the Asilomar precedent both assume, and unilateral restriction moves work rather than stopping it.

§Open problems

Attribution is the deepest one. A deliberate release that resembled a natural spillover would be difficult to distinguish from one, which weakens deterrence in a way that has no analogue in nuclear security. Openness is the second: nearly every measure that reduces misuse risk also slows the research that produces countermeasures, and the precautionary framing does not resolve the trade because both sides of it are safety arguments. The third is unglamorous. The mitigations with the best expected value are stockpiles, ventilation, and sequencing infrastructure, none of which produces a publication or a product, and all of which are funded accordingly.

§See also

• Dual-use research of concern
• Existential risk
• Mirror life
• Gene drives
• Differential technological development
• Immunosenescence
• Synthetic genomes
• Asilomar Conference on Recombinant DNA

§References