For the First Time, an AI Designed a Complete Working Virus. The Safety Net Built to Catch It Misses.

Stanford University and the Arc Institute have put 16 working bacteriophages on the scientific record. A peer-reviewed [paper in Science](https://news.stanford.edu/stories/2026/08/evo-2-ai-tool-e-coli-killer-bacteriophages) reports that an AI designed each viral genome from scratch, with no close relative in any biological database, and that all 16 killed E. coli in a lab dish when synthesized and introduced to the bacteria.

The same day, a Johns Hopkins biosecurity team said the defensive layer the biotech industry relies on to catch dangerous DNA orders cannot see sequences of this kind.

The achievement is the first peer-reviewed demonstration of generative AI designing complete, functional viral genomes. The viruses in question are bacteriophages — viruses that infect bacteria, not human cells. They were drawn from the Microviridae family, the same family as ΦX174, the first DNA-based genome ever fully sequenced (by Frederick Sanger in 1977). The narrowness matters: the working products target a single bacterial host, and the paper is not a claim about human-pathogen design.

The model is Evo 2, a genome language model built on the same conceptual architecture as GPT-style text models but trained on DNA. It uses a hybrid design called StripedHyena 2, which combines transformer layers with state space models, a class of sequence-processing networks that scale efficiently across very long contexts. The model was trained on 9.3 trillion nucleotides drawn from more than 128,000 whole genomes spanning all three domains of life. It can read sequences up to 1 million base pairs long at single-nucleotide resolution, a length long enough to swallow a small bacterial genome in one pass.

For this experiment, the team fine-tuned Evo 2 on roughly 14,000 Microviridae genomes. The model then proposed new viral sequences, which were synthesized and tested against E. coli. Sixteen of the proposed genomes produced working phages. The paper lists Brian Hie and Samuel King as the lead authors.

[Coverage in Ars Technica](https://arstechnica.com/science/2026/08/large-genome-models-used-to-design-new-viruses/) and [Chemical & Engineering News](https://cen.acs.org/biological-chemistry/genomics/ai-program-designs-new-bacteriophages/104/web/2026/08) frames the result against the industry's screening layer. The standard pipeline, used by gene synthesis companies and academic cores, looks for matches between an ordered sequence and entries in databases of known pathogens or regulated toxin genes. It is a defense designed to catch sequences that look like biology we already know. A model trained on the full breadth of life and asked to generate new sequences can produce ones that look like nothing in those databases, and therefore nothing the screen is checking for.

The Johns Hopkins warning makes that mismatch explicit. The team's point is not that Evo 2 is dangerous, and not that the paper's authors did anything wrong. It is that the defensive layer the industry assumed was catching dangerous sequences was built on the assumption that dangerous sequences would resemble known biology. A generative model inverts that assumption. The screen, the Hopkins team argues, needs a new class of detection, one aimed at the patterns an AI uses to write new sequences, not the patterns nature already used.

Technical documentation for Evo 2, including the NVIDIA BioNeMo model card, is referenced in the Bioengineer.org coverage. A related U.S. policy artifact, S.3741 — the Biosecurity Modernization and Innovation Act of 2026, is in the congressional pipeline, though its text was not the basis for any claim here.

The next decision sits with a small set of institutions. The sequence-screening vendors, the providers that order DNA on behalf of researchers, the journals that handle AI-authored genome releases, and the funders who pay for both. Each one is being asked, in effect, to decide whether to treat AI-generated sequences as a new class of reviewable artifact, a category that needs its own checks audited on its own cadence, or to wait for the gap to produce a case the field recognizes as a failure. The Science paper is the first item on that agenda; the Johns Hopkins warning is the second, on the same day.