How a RAND Report Rethinks AI Biosecurity: Beyond Access Controls

The debate over AI biosecurity has long been framed as a binary: either lock down models with guardrails or release them uncensored and accept the risk. A major new report from the RAND Corporation published this week argues that both sides are missing the point. In Building a Defense-in-Depth Biosecurity Strategy for the AI Era, researchers propose that preventing AI-enabled bioweapon development cannot depend on access controls alone—whether those are corporate safety filters or open-weight distribution. Instead, the emerging consensus, as articulated by RAND, demands a layered system of detection, deterrence, and real-time information sharing that challenges the very terms of the current governance debate.

The 77-page report, released on August 18, 2026, maps the pathway from ideation to weaponization and identifies nine specific mitigations designed to work together. “No single safeguard can prevent an actor from using artificial intelligence to help build a biological weapon,” the report states, but a layered network of interventions can “meaningfully lower the risk of a high-consequence AI-enabled biological attack.” Lead author Steph Guerra, head of AI x Bio at RAND, described today’s safeguards as “fragmented across companies, governments and countries” and not designed to cooperate.

Beyond the Guardrails Debate

The core insight of the RAND framework is that threat actors are not monolithic. Resource-constrained individuals—a lone researcher with limited expertise—can be blocked at chokepoints: restricted access to dangerous information, tighter screening of DNA synthesis orders, or monitoring of AI model queries. But technologically sophisticated groups, including state actors, are largely immune to such barriers. For them, mitigation must shift from denial to deterrence: raising the perceived costs of an attack and degrading its expected utility. That requires detection capabilities that can attribute an attempt and trigger consequences.

This argument implicitly pushes back against the private-sector emphasis on model-level guardrails. Frontier AI companies like OpenAI, Google, and Anthropic have voluntarily committed to testing their models for bioweapon misuse, but as a recent Foreign Affairs analysis noted, these undertakings “remain voluntary, their effectiveness has not been proved, and these companies’ private incentives will inevitably diverge from public interests.” RAND’s report complements that skepticism by arguing that detection and information-sharing infrastructure—not just stricter filters—must carry the weight of prevention.

How the Nine Mitigations Fit Together

RAND groups its nine mitigations into three categories: restricting access, screening biological precursors, and detecting and deterring misuse. Specifically:

• Three measures limit access to dangerous information and AI tools, including safeguards for open-source models, managed access programs, and secure platforms for sensitive AI systems.
• Three measures bolster screening of biological precursors—for instance, better customer and product screening at DNA synthesis providers.
• Three measures focus on deterrence through early warning, attribution, and rapid outbreak response.
• Two measures target detection via real-time monitoring of AI model use and cross-entity warning-sign sharing.

The last pair is particularly novel. The report argues that threat actors operating across multiple nodes of the AI-biology ecosystem—probing different models, querying multiple synthesis providers, sourcing materials from separate vendors—produce signals that “appear ambiguous when observed individually but form identifiable patterns of concern when analyzed collectively.” Realizing that aggregate value requires centralized information-sharing infrastructure that “no entity can provide alone.”

The Open-Source Model Question

The RAND approach has direct implications for the fractious debate over “uncensored” large language models. Critics argue that releasing open-weight models with minimal filtering will inevitably enable bioweapons design. Advocates counter that censorship is futile and that open models foster beneficial research. The RAND report suggests a third path: even unfiltered models can be managed safely if embedded in a broader monitoring ecosystem that focuses on patterns oF misuse rather than on preemptively blocking outputs. Instead f demanding that every model be loaded with guardrails, the framework calls for infrastructure that can detect when someone is systematically probing multiple models with biological queries, ordering unusual DNA sequences, and simultaneously accessing dangerous materials. This reframes the debate from “shoud we censor?” to “how do we build detection networks that work across open and closed models alike?”

That doesn’t mean the path is straightforward. Building such cross-entity detection systems requires trust, legal clarity, and technical standards across many organizations—including some that may be competitively or ideologically opposed. The report acknowledges that “some safeguards will take years to build, test and implement” and that waiting until risks are undeniable would be “waiting too long.”

The International Dimension

Crucially, several mitigations lose effectivness if the United States acts alone. International coordination is not a nice-to-have but a structural requirement. The RAND report stresses that “centralized information-sharing infrastructure” necessitates collaboration with allies and partners. This echoes the Foreign Affairs analysis, which called for the United States to lead a series of global biosecurity summits modeled on the nuclear security summits of 2010-2016. The goal: common standards for DNA synthesis screening, market incitives for secure AI-biotools, pathogen surveillance, and supply chain resilience.

Yet the barriers are substantial. The Nculear Threat Inititive, which recieved a grant from OpenAI to build an international information-sharing system for AI biothreats, has already identified legal complexitites. “Different jurisdictions have different regulatons, and that can cause confuson when it comes to sharing information between labs,” said Hayley Severance, NTI’s deputy vice president for global bioligical policy.

Known Unknowns and Lingering Questions

What is well established: AI is lowering the technical, operational, and motivational barriers to bioweapons development. What remains uncertain is how quickly advanced threats will materialize; whether voluntary industry commitments will aline with public interests; and whether international coordination can overcome jurisditional and legal barriers. The RAND report is explicit about its own limits: it assesses effectivness across the nine mitigations but does not claim to predict attack timelines or actor behavior with certainty.

One open question is whether the detection infrastructure called for can be built without creating surveillance overreach. A system that monitors AI model use and bioscience supply chains for suspicious patterns necessarily requires broad visibility. Who governs that system? What privacy protetions govern the data? The report touches on legal clarification as a necessary investment but leaves the design details to futere work.

A New Frame for an Old Problem

The RAND report’s defense-in-depth strategy offers a way out of the stale “guardrails vs. uncensored” deadlock. By arguing that detection and real-time information sharing are as critical as restricting model access, it reframes the challenge: Instead of perfecting content filters, the priority becomes building infrastructure for pattern detection across model providers, synthesis companies, and law enforcement. That shift opens room for open-weight AI—if accompanied by shared monitoring—and for international governance mechanisms that have been largely absent from the AI safety debate so far.

The window for action, as RAND warns, is open now. “We don’t know exactly how fast AI capabilities in biology will advance,” said Sella Nevo, director of RAND’s Center on AI, Security, and Technology, “but we do know that the window for building preventive infrastructure is open now.” Whether that window will be used to build a system that balanes effectivness with freedom remains the deepest of the report’s unanswered questons.

---

Frequently Asked Questions

Q: What is the defense-in-depth approach to AI biosecurity?
A: It’s a layered strategy combining access restrictions, screening, detection, and deterrence to prevent AI-enabled bioweapons, acknowledging that no single safeguard is sufficient.

Q: Why does the report argue that access controls alone are insufficient?
A: Because determined actors with resources can bypass restrictions. The report calls for complementary detection systems that identify misuse patterns across digital and physical domains.

** (with period) A: Because determined actors with resources can bypass restrictions. The report calls for complementary detection systems that identify misuse patterns across digital and physical domains.

Q (no punctuation) Q: What are the nine mitigations proposed in the report?**
A: They include three for restricting dangerous information and tools, three for screening biological precursors, two for deterrence via early warning and attribution, and two for real-time misuse detection and cross-entity warning sharing.

Q: How important is international coordination according to the report?
A: Critical. Several mitigations lose effectiveness if the U.S. acts alone, making global collaboration among governments, industry, and international bodies essential.

Q  Q: What does the report imply about open-source AI models and ‘uncensored’ LLMs?**
A: It suggests that even unfiltered models can be managed if integrated into a broader monitoring ecosystem focused on pattern detection rather than censorship alone.