Withholding code may not be enough to control access to a biological AI capability. AISI and SecureBio report October 26 that coding agents reproduced selected functions of two tools in the ReproBAIT benchmark. No attempt fully succeeded on the most complex of the three targets within the allotted budget.
The agents followed explicit instructions inside isolated environments without internet access. Training data was supplied. Researchers measured individual functions on held-out test data, not complete equivalence to the original tools.
The success figures also need context: headline results represent the best of three attempts. Prior exposure to published papers or code may explain some results, but the contribution of memorisation remains unresolved.
The preprint first appeared October 14. The new posts raise a safety question: which controls remain effective when software functions can be reconstructed from public descriptions? The authors call for more investigation of data governance. The test establishes neither unauthorised access nor real-world biological harm.