Former White House biosecurity official: AI accord misses the trigger that matters

The White House Accord on Superintelligence, signed Tuesday by President Trump and leaders of some of the nation's largest AI companies, is a voluntary pledge to strengthen internal controls around risks including biosecurity. But the former White House biosecurity official who helped steer pandemic response warns that the accord misses the trigger that matters: it leaves companies largely responsible for deciding what safeguards should look like and when a risk has become serious enough to act.

The official's standard comes from a 2023 Situation Room call. When H5N1 influenza infected a father and killed his daughter in a remote Cambodian village, the national security adviser asked whether to brief President Biden immediately. The official said wait, because the team had agreed in advance on a trigger: sustained human-to-human transmission. Surveillance data from nearby emergency rooms showed cases were not unexpectedly high, so no presidential alert was needed. That pre-agreed trigger did two jobs: it kept the team from dismissing a real emergency and from escalating one that wasn't.

The same discipline is absent from AI biosecurity, the official argues. Bill Gates is warning Americans that AI crossed thresholds this year, including bio-attack capability, with the most concerning threshold being whether an AI can design a bioterrorism weapon capable of killing millions. Last week, Anthropic's chief executive urged the U.N. Security Council to back a ban on using AI to make biological weapons, after Anthropic disclosed five cases of biological misuse of its models, including a researcher studying how H5N1 adapts to mammals and causes illness beyond the respiratory tract. The company banned the accounts.

The backdrop is a virus that is already on the radar. There is almost no population immunity to H5N1, roughly half of human cases are fatal, and the virus does not yet spread efficiently between people. Not yet. In the official's words, someone was asking an AI model how that line gets crossed. Most people reading such disclosures conclude either that AI has made biological weapons frighteningly accessible or that safeguards worked. The official argues neither tells us what we need: Gates is right that a line was crossed, but nothing followed because no one had decided in advance what crossing it should set off.

The distinction that matters is between design and physical capability. A model that can write a research protocol to create a pathogen is not a person who can create it; you still need synthesized DNA, equipment, and a lab with four walls to grow a virus. AI has not yet dissolved those barriers, and that is exactly where mitigation is still possible. The official's proposed fix is trigger-action discipline: a specific observable trigger paired with a specific action, agreed before an emergency arrives.

The essay names three triggers to watch. First, evidence that someone without advanced biological expertise used AI to overcome experimental problems that previously required expert judgment; that calls for independent evaluators to red-team AI models before deployment, not voluntary company disclosures. Second, an AI-generated sequence of concern being ordered from a synthesis provider or run through an automated laboratory; that requires watermarking and tracing tools for biological design systems, as the Bipartisan Commission on Biodefense has recommended. Third, proof that AI has substantially reduced the hands-on experience needed for dangerous biological work; DNA synthesis providers, cloud laboratories, and benchtop synthesizers are where digital capability becomes physical, and screening there should be expanded. A bipartisan Senate bill on this has not moved since January.

None of these triggers is simply "AI answered a dangerous biological question." Each would signal that the barrier separating AI-generated knowledge from physical lab capability is beginning to erode, and each has an action paired with it. The official argues pre-defined thresholds are not alarmism; they are what allowed a calm response to the Cambodian H5N1 cases. Without them, every ambiguous warning becomes something to panic about or one more thing we have already lived through.

The White House accord is an important acknowledgment that biosecurity belongs at the center of the AI safety conversation, the official writes. But internal controls are only part of the answer. The next step is to settle two things: what evidence would show that AI has helped a dangerous capability cross into the physical world, and what we will do when it does. "Not yet" is useful information, the official concludes, but it is not a plan.