The headlines said AI had designed viruses. That is true. But the number behind it got written up far less often, and the number is more interesting than the headline.
The model wrote 302 genomes. Seventeen of them could not be synthesised at all. Of the remaining 285, the overwhelming majority could not do the one thing any virus has to do, which is get inside a bacterium and kill it. In the end 16 came alive, meaning they went from raw DNA sequence to a virus that actually kills bacteria.
what they actually did
A group at Stanford published a paper in Science in which a genome language model wrote complete bacteriophage genomes. A bacteriophage is a virus that only attacks bacteria and has no interest in us.
The model is Evo 2, trained on a dataset containing more than two million bacteriophage genomes. But they did not stop there for this experiment. They narrowed the model onto the specific target by fine-tuning it on roughly 15,000 genomes from the relatives of the very phage they wanted to build.
That phage is ΦX174, one of the most studied viruses in the history of biology. Its genome is 5,400 letters long and holds 11 genes. For comparison, an ordinary bacterial genome runs to millions of letters.
They then layered computational constraints and quality filters over the model's output to raise the odds that a sequence would work. That produced 302 candidates, and out of those 302, sixteen became real phages that kill a laboratory strain of bacteria.
follow the numbers
Stop and look at that ratio. 16 out of 302, roughly five percent.
And consider where that five percent came from: a model trained on two million similar genomes, then fine-tuned on fifteen thousand close relatives of the exact target, then filtered, aimed at the smallest and best-understood phage available, with eleven genes.
This is neither worthless nor what the headline says. A machine wrote a working viral genome, but in the narrowest and most brightly lit corner of the possible space, the place where it had been given the most guidance available.
somebody went and measured it
This is where it gets interesting to me.
A team from the Johns Hopkins Center for Health Security and Oxford went and evaluated those same phages, but not by asking whether they worked. Everybody knew that already. Their question was how novel these genomes actually are, and how much more efficient the model is than the simpler alternatives.
So they separated two things. One is evolutionary novelty: how far these sequences sit from natural genomes in sequence similarity and in the tree of life. The other is design efficiency: how much better the model is at finding a viable sequence than a simple generator would be.
Their comparison points are two old techniques any lab knows: random mutagenesis, and serial passage, which means handing the virus to bacteria generation after generation until it adapts on its own.
two findings that have to be read together
The first finding favours the model and matters. The likelihood the model assigns to a sequence predicts well whether that sequence will be viable in the lab. So the model has taken up something about the functional constraints of a genome that goes beyond biological rules of thumb, and that is a serious result on its own. It does not know how a protein folds; it has learned from two million examples which arrangements survive in nature and which do not.
The second finding turns the whole story around. That efficiency comes largely from the model staying close to things it has already seen, rather than searching new space. The outputs sit next to natural genomes on the evolutionary tree.
So the model is efficient because it is cautious. The very thing that gives it its efficiency takes away its novelty.
And the evaluators' own conclusion follows: Evo 2's ability to create a hazard from nothing warrants low to moderate biosecurity concern.
so where is the worry
Exactly where the evaluators put their finger, and it deserves to be taken seriously.
This result was obtained for a small phage with eleven genes that had thousands of close relatives in the training data, and whether the same behaviour holds for larger viruses or less constrained architectures is an open question. So the paper is not saying there is no danger. It is saying that this particular case does not show much danger, and that we do not yet know about the other cases.
The distance between those two sentences is large, and headlines usually pick one of them.
why anyone wants a designed phage
There is some context here that gets lost in the coverage.
Phage therapy has more than a century of history and has always run into one problem: any given phage usually kills only a narrow range of bacteria, sometimes only a few specific strains. So for every patient and every strain you have to find the right phage, and that makes the whole thing hard commercially and clinically.
If a phage can be designed rather than hunted out of sewage and soil, that problem goes away. And in an era when antibiotic resistance gets worse every year, that is not a small incentive. The lead researcher himself says collaborators have already asked to use the model to build phages against disease-causing bacteria rather than a laboratory strain.
what engineers should take from it
This is the same lesson the last two pieces here carried in a different shape.
What the evaluating team did was not to find a new result. What they did was supply a baseline. Until you ask "compared to what", sixteen living phages look like magic. Put them next to random mutagenesis and serial passage, and you can see how much of it is the model's achievement and how much was already achievable.
In the previous piece I wrote that a success rate on its own shows you nothing. This is a step further: a success rate without a baseline can actively mislead you, because the number looks large and nobody asks what the same job scored the old way.
I have seen the same in our own work. In BLZN.AI, which carries a trading strategy through to live execution, no number means anything on its own until it is placed next to the simplest possible thing. If your elaborate strategy does not beat buy-and-hold, its elaborateness is pure cost.
and a note on method
There is a small thing here worth noticing.
The original paper appeared in Science with a commentary published alongside it the same day. The security evaluation, though, is an independent preprint that arrived months later and from somewhere else entirely.
Which is to say the mechanism worked. One group did a piece of work, a different group whose incentives were not the same went and measured it, and that measurement showed something the first paper had not put forward. That is the thing to look for when you read a paper: not only what the author says, but who independently went and checked it.
what has changed
Until yesterday, writing a complete living genome with a machine was a claim. Now there are sixteen real specimens killing bacteria in a dish.
But what has been shown is not that a model can invent new life. What has been shown is that a model is very good at telling whether a sequence looks like a real virus, and that this judgement can be turned into generation, provided you do not stray far from what it has already seen.
The distance between those two things is what the coming years will be argued over.