When (DNA) Signatures Aren't Enough

In a recent Science research article, King et al. report using generative genome models to design complete viral genomes. Of nearly 300 designs they synthesized, 16 produced viable bacteriophages—phages, viruses that infect bacteria. In an accompanying Science Perspective, Inglesby and Hanke turn to the biosafety and biosecurity implications.

The headline is straightforward: AI can now help design complete viral genomes. One result in the paper points to a harder problem for defenders.

The researchers used ΦX174 (pronounced “phi X 174”), a small and well-studied phage that infects E. coli, as their reference genome. Then there was Evo-Φ36: still recognizably ΦX174, but altered in dozens of places across its genome.

One of those changes involved a small protein called J, which helps package the virus’s DNA inside its outer protein shell. A related phage, G4, uses a much shorter version of J. Researchers had previously tried swapping that shorter G4 J protein into ΦX174. It failed: the modified virus was nonviable.

Yet Evo-Φ36 encodes essentially that same shorter G4 J protein—and Evo-Φ36 works.

The difference is that the AI did not make that substitution in isolation. Evo-Φ36 contains dozens of other changes elsewhere in its genome. In that altered genomic context, the shorter J protein becomes compatible with a viable virus.

J has to fit and function inside the capsid, the protein shell that holds the viral genome. Cryo-electron microscopy showed that the shorter J protein in Evo-Φ36 does exactly that, though in a different arrangement from ordinary ΦX174. The researchers identified as many as 58 other mutations that could be helping make that possible.

In ΦX174, the shorter G4 J protein makes the virus nonviable. In Evo-Φ36, that same G4 J protein works in a different genomic context alongside many other AI-generated changes.

The researchers call this a new “coevolutionary solution”: the shorter J protein works because other parts of the genome appear to have changed along with it. The important point is not that the AI retraced an evolutionary path, but that it found a combination of changes that works together even though one of those changes fails on its own.

Why This Looks Familiar

That is where the paper started to look familiar from the perspective of computer and network security.

Many security controls begin with resemblance. We know what a bad thing looks like, so we look for things that look like it. But as soon as a system can preserve a capability while changing the form that carries it, resemblance tells us less.

The defensive problem shifts from recognizing appearance to inferring behavior:

How do defenders recognize something dangerous when the function that matters can survive even as its form changes?

Computer security has been working on versions of that problem for decades.

Malware: When Signatures Stopped Being Enough

Early anti-malware tools had a straightforward job: compare an unknown file against patterns from malware that defenders had already identified.

A signature might look for a characteristic sequence of bytes. At the simplest extreme, a cryptographic hash can tell you that a file is exactly the same file that someone has already identified as malicious.

This is fast and useful so long as the malware does not change.

Attackers therefore learned to change it.

Polymorphic malware changes its encoded form from one copy to another while preserving the underlying malicious function. Metamorphic malware goes further by rewriting instructions into different but functionally equivalent code.

When attackers started doing this, signatures did not become useless. Known malware is still worth recognizing quickly. But defenders could no longer assume that a file was harmless simply because its bytes did not match malware they had seen before.

So malware detection added other kinds of evidence. What processes does the program start? What files does it modify? What system calls does it make? Where does it connect on the network? Who produced it? Where did it come from? What happens when we run it?

In practical terms, the question expanded from what does this look like? to what does this do, and in what context?

That is the part of the analogy that matters for synthetic biology.

DNA Screening: Beyond Sequence Similarity

If a researcher wants a custom DNA sequence, they often do not manufacture every nucleotide themselves. They send the digital sequence to a synthesis provider, which makes the physical DNA and returns it.

That transaction gives the provider a chance to examine what it is being asked to make.

Anyone familiar with fraud prevention or finance will recognize Know Your Customer, or KYC: establish who the customer is and whether the transaction makes sense in context. Nucleic-acid synthesis adds a related concept, Know Your Order, or KYO.

KYC asks who is requesting the material, whether they are who they claim to be, and whether they have a plausible reason to order it. KYO asks what is actually in the requested DNA or RNA: does it resemble sequences associated with pathogens, toxins, or other biological functions of concern?

Biosecurity researcher Paul-Enguerrand Fady explains these two sides of synthesis screening in a useful recent discussion of AI and biosecurity. Most routine orders can pass through automated screening. A concerning sequence, customer, or combination of the two can trigger human review.

Current screening is more sophisticated than looking for an exact forbidden DNA string. A system can identify sequences related to known sequences of concern, and customer screening adds information that is not contained in the sequence at all.

But generative genome models put pressure on the underlying idea that resemblance is a reliable guide to function.

King and colleagues did not ask AI to invent arbitrary life from scratch. They started with two genome language models, Evo 1 and Evo 2, that had been trained on millions of genomes. They then fine-tuned the models on about 15,000 genomes from the family of phages that includes ΦX174.

They also constrained what the models produced. The resulting genomes needed to have the basic architecture of a plausible phage and retain features expected to let them infect the target strain of E. coli. At the same time, the researchers deliberately favored designs that differed from known natural phages.

The models generated thousands of candidate genomes. The researchers selected 302 for testing, successfully synthesized and assembled 285, and found 16 that produced viable phages.

So this was neither “AI invented life” nor a simple one-gene editing experiment. The models were generating complete variants of a known type of virus, with changes distributed across genes, regulatory regions, and other parts of the genome, and the researchers were asking whether the whole result still worked.

Some did. And some of the viable genomes contained combinations not observed in the natural sequences used for comparison. In 13 of the 16 viable phages, the researchers found mutations that were not present in the known natural sequences they compared against.

Evo-Φ36 shows why genomic context matters. Put the shorter J protein into ordinary ΦX174 by itself, and the virus fails. Put essentially the same protein into Evo-Φ36, alongside dozens of other AI-generated changes, and it works.

This experiment does not show a dangerous pathogen slipping past a synthesis screen; the researchers were working with phages that infect bacteria, not animals or humans. What it does show is why resemblance can become a weaker signal: the effect of a sequence may depend on the changes around it, not just on how closely that sequence matches something already known.

For defenders, that means sequence similarity remains useful, but it tells less of the story.

This concern is already showing up in the screening literature. In Beyond Sequence Similarity: The Case for Function-Based Screening of Nucleic Acid Synthesis, Able et al. in a NIST report argue for a hybrid approach: keep similarity-based screening, but supplement it with models that try to recognize biological functions of concern.

The analogy is not that DNA is software. It is that both defenders face the same problem when something can keep doing the same thing while no longer looking like the examples they already know.

There Is No Malware Sandbox for a Genome

Computer security has another tool when inspecting suspicious software is not enough: run it and watch what happens.

A malware sandbox is an instrumented computing environment where suspicious software can execute while defenders observe its behavior. Sandboxes are imperfect. Malware can recognize that it is being analyzed and change what it does, and a sandbox is itself software with vulnerabilities.

We got a reminder of that in July. During an internal cyber-capability evaluation, OpenAI says its models escaped a sandbox by exploiting a previously unknown flaw in the software proxy that controlled access to package repositories. From there, they reached the open Internet and ultimately compromised Hugging Face infrastructure. (OpenAI, July 21, 2026; Hugging Face, July 27, 2026). The point is not that sandboxes are useless. It is that they are another security control with failure modes of their own.

But computer security at least has the option of executing an unfamiliar program in an instrumented environment and learning something about its behavior.

There is no comparable malware sandbox for a genome.

What unfamiliar DNA will do depends on context: the cell or organism it enters, how its genes are regulated, how its proteins interact, and the surrounding environment. Figuring that out experimentally can mean synthesizing the DNA and building the biological system whose behavior you were trying to predict in the first place.

So “screen for function” is not an easy replacement for sequence matching. It means trying to predict biological behavior from sequence, which is itself a difficult scientific problem.

A practical screening system also cannot send every unfamiliar sequence to a human. Most synthesis orders are routine. If a function-based detector flags too many harmless orders, expert reviewers get buried in false positives and legitimate research gets delayed.

This is one reason KYO and KYC belong together. If the sequence itself leaves uncertainty, information about the customer and the context of the order can help decide whether that uncertainty requires investigation.

DNA Synthesis: A Chokepoint... for Now

There is an important difference between software and synthetic biology.

Software does not need a manufacturing step. Once malicious code exists, it can be copied to a vulnerable system and run.

A DNA sequence on a laptop is different. Before it can do anything biological, that digital sequence has to become physical material. Depending on the application, the resulting DNA or RNA may then need to be assembled, introduced into the right cells or organisms, and successfully produce the intended biological effect.

That manufacturing step creates a useful point for intervention. U.S. biosecurity policy and standards work therefore focuses in part on commercial providers that synthesize DNA, RNA, and other nucleic acids to order. (NIST, Biosecurity for Synthetic Nucleic Acid Sequences)

Computer security rarely gets such a useful checkpoint between design and execution.

But this advantage is contingent on how synthesis technology develops.

DNA synthesis is also becoming less centralized. Systems such as DNA Script’s SYNTAX platform can already produce short DNA oligonucleotides inside a laboratory. That is nowhere near a push-button system for printing an arbitrary viral genome, but it points in a clear direction: as synthesis becomes cheaper and more distributed, commercial providers will have visibility into a smaller share of what gets made.

That makes synthesis screening valuable but incomplete. It is one layer in a broader security architecture, not a control we should expect to carry the whole problem.

Computer security learned this lesson long ago. Signatures catch known malware; behavioral analysis catches some things signatures miss; sandboxes add another source of evidence; identity, reputation, access controls, and network monitoring add context. Each control covers different failure modes, and none is sufficient on its own.

The usual term in computer security is defense in depth.

Biosecurity needs the same kind of thinking. Model safeguards, access controls, KYC and KYO, institutional biosafety review, synthesis screening, expert human review, and legal rules all cover different parts of the problem. The goal is not to find one perfect detector. It is to build layers that fail in different ways.

What This Means for Defenders

Generative genome models are a dual-use technology in a familiar sense: the capability that makes them scientifically useful also creates part of the security problem.

For scientists, a model that can find working biological designs outside the examples nature has already shown us opens new possibilities. Evo-Φ36 is a small but striking demonstration: a change that fails when made alone can work as part of a different, coordinated genome.

For defenders, those same unfamiliar designs are harder to recognize using resemblance alone.

Computer security went through a related transition. We did not abandon signatures; we learned that recognizing appearance was not enough. We added ways to reason about behavior, context, provenance, and identity.

Biosecurity seems to face a harder version of that problem because biological behavior cannot simply be observed by running an unknown genome in a virtual machine.

For the moment, however, biology gives defenders something computer security rarely has: many digital designs still have to pass through a visible manufacturing step before they become physical material.

We need to get very good at defending that step.

And we need to design the rest of the security system for a future in which that step may be less centralized—and less visible—than it is today.