AI Designed 16 Working Viruses From Scratch, and the Model That Did It Is Already Public
- David Borish
- 23 hours ago
- 5 min read
A team at Stanford University and the Arc Institute has done something no one had documented before: they asked an AI model to write a complete viral genome, letter by letter, and watched it produce a virus that worked. The study, led by Stanford bioengineering researcher Samuel King and chemical engineering professor Brian Hie, was published Thursday in the journal Science. Of 302 AI-designed genomes the team synthesized and tested, 16 turned out to be viable bacteriophages, viruses that infect bacteria rather than humans, capable of infecting and killing E. coli.
The achievement sits at an uncomfortable intersection. It is a genuine advance toward using AI to fight antibiotic-resistant infections. It is also, by the authors' own account, a demonstration that the barrier between computational sequence generation and a living, replicating organism has gotten thinner than most people assumed.
From Text Prediction to Genome Writing
The tool behind the result is Evo, a genome language model built the same way large language models are built, except its vocabulary is the four letters of DNA instead of words. Evo 1 was trained on 2.7 million genomes spanning bacteria, archaea, and phages. Its successor, Evo 2, scaled that training to trillions of nucleotides pulled from across the tree of life. Where a text model learns which words tend to follow other words, Evo learns which genetic sequences tend to occur together in nature, and by extension, which sequences might function together in something new.
For this study, the team fine-tuned both models on 14,266 genomes from the Microviridae family of small, single-stranded DNA viruses, then gave them a starting point: ΦX174, a bacteriophage that has been a standard laboratory tool since the 1970s and carries a genome of under 6,000 base pairs. That small size made it a tractable test case. A human genome runs to roughly 3 billion base pairs. Even E. coli's own genome is roughly a thousand times larger than ΦX174's. The researchers wanted to test whether a model could generate an entire phage genome end to end, rather than stitch together fragments of existing ones.
King built the screening framework that turned thousands of raw AI outputs into a workable shortlist, filtering candidates by genome structure and by comparison to traits known from ΦX174 and its relatives before any of them reached a lab bench.
What Happened When the Designs Met Bacteria
The team synthesized 302 of the AI-generated genomes as physical DNA and inserted them into E. coli cells to see which would produce functioning phages. Sixteen did. Those 16 diverged substantially from any phage genome found in nature, and several outperformed ΦX174 itself. One, designated Evo-Φ36, contained a functional truncated protein that had not worked when researchers tried to engineer the same truncation into wild-type ΦX174 through conventional methods. In other words, the model found a working solution that had eluded manual design.
The more practically significant result came when the team combined several AI-designed phages into a cocktail and tested it against E. coli strains that had evolved resistance to natural ΦX174. The cocktail overcame that resistance. Phage therapy, using viruses to kill targeted bacteria, has been explored for decades as an alternative to antibiotics, but bacterial resistance to any single phage develops quickly. A model that can generate large numbers of genuinely novel candidates on demand addresses one of the field's persistent bottlenecks.
The Same Tool That Built This Is Open to Everyone
Evo 2 is released as open source, including its training code, model parameters, and training data. Hie and King's team has said this openness is deliberate, arguing that researchers need access to these tools to study dangerous natural pathogens and to build safety checks directly into the design process, checks that don't exist when pathogens evolve on their own. Hie has acknowledged that modified versions of the tool could be misused.
The safeguard the team points to is a filter applied at the training stage: Evo 2's training data excludes human-infecting viruses. That exclusion is a data curation choice rather than an architectural limit on what the underlying model could learn if retrained. Outside analysis of the earlier preprint version of this work, published by Asimov Press, noted that a sufficiently motivated party could in principle fine-tune an open version of Evo on human viral sequences.
HIV's genome runs to about 10,000 bases and a coronavirus genome to about 30,000, neither dramatically larger than the phage genomes Evo was already generating. The same analysis pointed to what still stands between a phage result and a human pathogen: data availability and the sheer physical scale of synthesizing and assembling a genome three orders of magnitude larger than ΦX174's.
The paper's authors addressed this directly rather than leaving it to outside commentary. They wrote that generating new phage genomes with AI raises biosafety, biocontainment, and biosecurity considerations that require active discussion of governance, policy, and misuse mitigation, and recommended that any group doing whole-genome design work consult safety and security professionals throughout the project, from the earliest design stage through publication.
The Governance Question Nobody Has Closed
Reaction to the paper has centered less on the phage result itself, which poses no direct threat to humans, and more on what it demonstrates about the trajectory. Biosecurity researchers who reviewed the study argued that the technical capability to compose viral genomes with generative AI has now been shown to work, while the policy infrastructure to govern that capability has not kept pace. Proposals circulating in response include a legal requirement for DNA-synthesis companies to screen every order and customer against known threat sequences, and new detection methods specifically tuned to catch AI-generated genetic designs, which can differ in subtle statistical ways from natural sequences and may slip past screening tools built for the latter.
This is the pattern that tends to repeat with frontier AI capabilities: a result demonstrated first in a constrained, controlled setting, in this case a small bacteriophage genome tested against a single bacterial species in a university lab, becomes the proof of concept that gets scaled, generalized, and eventually deployed against harder problems the original experiment never touched. The ΦX174 result was chosen for its small, tractable size, rather than because it represented the ceiling of what these models can do. Whether that trajectory bends toward treatments for drug-resistant infections or toward something more dangerous will depend largely on decisions made outside the lab, in DNA-synthesis screening rules and model-release policies.
What Comes Next
King, now a postdoctoral researcher, has said the team intends to keep building out the phage program as a tool against antibiotic-resistant infections, which the World Health Organization has flagged as one of the top global public health threats. The next concrete developments are more likely to come from regulators and synthesis providers than from further lab results. No AI model in public release has been trained to design a virus that infects people, and the exclusion of human-viral sequences from Evo's training data still holds as of publication. Whether that holds as open-source versions of these models proliferate and get fine-tuned by other groups is the question the paper's authors, and now a wider community of biosecurity researchers, have put on the table without a settled answer.
David Borish writes long-form analysis on frontier AI research and technology policy at davidborish.com. He is the author of the forthcoming book The Tony Hawk Paradox, which examines how capabilities proven in controlled or simulated environments consistently transfer into broader real-world systems.
