AI agents rebuilt parts of biological AI tools for under $20, UK institute finds

The UK AI Security Institute says AI coding agents reproduced selected functions of some biological AI tools from limited public information, with successful attempts on simpler tools costing between $4 and $20. The finding challenges the idea that withholding a tool’s code, on its own, is enough to control access to its capabilities.

UK AI Security Institute Watch analysis

What happened

AISI developed ReproBAIT with SecureBio to test whether AI agents could build functional replicas of biological AI tools using supplied training data and limited descriptions of their design. The evaluation covered three tools of varying complexity, including a closed-source molecular-design tool, and tested whether agents received only an abstract or a full paper.

The institute says several agents succeeded in reproducing selected functions of some tools. Attempts to rebuild the more complex RFdiffusion3 did not succeed and cost between $102 and $301. Giving agents the full paper rather than just the abstract did not consistently improve results. AISI also found evidence consistent with some memorisation of published material, but says its diagnostics are imperfect and cannot establish how much memorisation contributed.

Why it matters

For developers of biological AI tools, keeping code private may offer less protection than expected if agents can recreate some functions from public descriptions and the relevant data. AISI says controlling access to underlying biological data may merit further investigation as a way to manage misuse risks. That is a research direction, not proof that data controls are a complete solution.

The results are about selected functions, not full replicas of every tool or their complete capabilities. That distinction matters: an alarming-sounding headline should not turn a limited evaluation into a claim that every closed biological model can now be copied on demand.

Our read

This is a meaningful AI security result because it tests a practical assumption about how biological tools can be protected. It also points to a harder question than whether to publish code: what information and data are needed to reproduce a capability in the first place?

AISI’s findings make the case for evaluating safeguards against what capable agents can reconstruct, rather than treating code withholding as a safety guarantee. The limits are part of the story, not a reason to ignore it.

What to watch

• Whether future evaluations test more biological tools and clarify how results vary with access to data.
• Whether data governance proves useful in practice, and what trade-offs it brings for legitimate research.
• How much agent performance on publicly described tools depends on information remembered from training.

Discussion spark: If AI agents can reconstruct selected biological-tool functions from public descriptions, should developers focus more on controlling access to training data, or does that create too high a barrier for legitimate research?

not affiliated with or endorsed by UK AI Security Institute