Joshua Monrad on AI, Biosecurity and Building Layers of Defense

Nathan Labenz introduces Joshua Monrad, co-founder of the biosecurity nonprofit Sentinel Bio and a former adviser to the OpenAI Foundation. They discuss the risks that increasingly capable AI might amplify biological misuse, and what society can do to make the benefits of biotechnology safer to realize.

Labenz says the conversation is motivated by both risk reduction and a positive vision: less infectious disease and better treatments for serious illness. Monrad argues that realizing that future requires defenses against harmful uses as well as safeguards against natural outbreaks.

Labenz previews Monrad's case for defense in depth: controls at the AI layer alone are unlikely to be enough, so safeguards are also needed where digital systems interact with physical materials and services. Monrad favors working backward from a defined safety outcome and investing in practical measures.

The interview grew out of an online disagreement about whether an incident involving autonomous agents should be seen as a near miss for biological safety. Labenz found the possibility alarming. Monrad thought a fully autonomous biological incident was less immediate, while still expecting risks to rise.

Monrad separates the history of human biological misuse from three AI-related scenarios: AI assisting people, AI inducing people to act, and systems carrying out an end-to-end process without human participation. These scenarios have different constraints and should not be treated as one prediction.

He considers AI assistance a present area of concern and regards social engineering elsewhere as a possible warning sign for the second scenario. For full physical autonomy, he expects robotics and access to physical capabilities to remain significant constraints for now. His timeline is a judgment, not a measured forecast.

Asked about historical risks, Monrad distinguishes state programs from non-state actors and their different motives. He cautions against assuming that an action is impossible merely because it would be irrational. Historical examples, in his view, make intent and access important considerations alongside capability.

Monrad says historical state and non-state programs are useful reminders that intent varies. He argues that the mere existence of deterrence or uncertainty does not eliminate the need for public-health preparedness.

The discussion returns after a sponsor break to the difference between known and novel biological threats. Monrad stresses that having a potential defense in principle does not mean a society is prepared to deploy it effectively. Recent pandemic experience, he says, exposed important gaps between those two states.

When asked to predict the consequences of a particular outbreak, Monrad declines to give a confident estimate from memory. He points to the uncertainty around readiness and immunity instead of claiming that prior scientific knowledge automatically guarantees a reassuring outcome.

Labenz and Monrad discuss how technical capabilities can spread. Monrad's concern is not a single decisive event but the possibility that a collection of advances changes who can perform demanding work. He treats the magnitude and speed of that change as questions to investigate.

Labenz asks how AI changes the number of people who could carry out sophisticated biological work. Monrad says capability uplift deserves empirical study, while emphasizing that biological work involves multiple stages and that the difficulty of different problems varies.

Monrad defines an uplift study as a comparison of what participants can accomplish with AI against a suitable baseline. Earlier assessments often relied on digital questions; later work brought people into supervised laboratory settings to assess practical performance rather than knowledge alone.

He describes a study involving about 150 relatively inexperienced participants, some with access to then-current AI systems and others using the internet. He says it found modest gains on some tasks. The study was costly and slow; its results do not by themselves establish what newer systems can do.

Monrad says the large study was funded by his organization together with the Frontier Model Forum and cost over a million dollars. Its practical burden illustrates why evaluations cannot simply be repeated as quickly as a model benchmark.

Monrad argues that this kind of evaluation needs dedicated infrastructure and more frequent repetition. Studies must measure relevant capabilities without exposing participants or the public to unnecessary danger. He calls for a stronger ecosystem of independent teams able to do that work.

He also mentions a smaller study in which participants with AI reportedly outperformed an internet-only comparison group, but says its limited sample constrains conclusions. The speakers agree that timely and well-designed evidence is difficult to produce when models are changing rapidly.

Labenz asks how to reconcile modest uplift results with reports of AI doing well on particular laboratory troubleshooting tasks. Monrad calls uplift a lagging indicator: studies and publication take time. He also warns against treating either laboratory expertise as irrelevant or existing barriers as permanently reliable.

Monrad says laboratory know-how is real and should not be dismissed. At the same time, he expects improvements in multimodal assistance to change the value of some existing barriers. He presents that as a reason to update assessments, not as evidence that all barriers have disappeared.

Both speakers emphasize dual use. The same advances that make biological research easier may also create safety challenges. Monrad says that preventing misuse should not mean abandoning the beneficial goals of bioscience; it means taking the tradeoffs seriously.

Labenz asks whether beneficial and harmful capabilities can be cleanly separated. Monrad answers that the overlap is often substantial, making simple restrictions difficult. Their shared aim is to keep useful applications available while reducing foreseeable harms.

They discuss whether training-data choices and access controls could reduce specific risks. Monrad sees possible value but does not claim that filtering alone solves the problem. He proposes testing such approaches empirically, including their effects on legitimate research, and combining them with other safeguards.

Monrad says proposals to govern sensitive data raise unresolved questions about categorization, access, security and the costs to research. He treats these as reasons for careful study rather than reasons to declare success or dismiss the whole idea.

Labenz presses on the central tradeoff: biological understanding can be useful for both beneficial and harmful ends. Monrad says his organization should not become attached to a favored intervention regardless of evidence. If a well-resourced approach proves unworkable, the response should shift toward other layers of protection.

Monrad describes policy and technical governance as an experimental field, not a settled recipe. He wants researchers to evaluate proposals quickly and honestly, preserve useful science wherever possible, and work in parallel on defenses beyond models and data.

Asked about near-term scenarios, Monrad distinguishes model capabilities from the physical and organizational conditions needed to turn digital output into real-world action. He expects the balance to change, but emphasizes uncertainty about timing and the difficulty of biological problems.

Monrad thinks some capabilities will advance before physical autonomy does, though he cautions that forecasts can be surprised. He emphasizes that the pace of robotics and the availability of human assistance change the practical assessment in different ways.

The conversation turns to the challenge of agents interacting with people and outside services. The speakers consider how greater autonomy might change the risk picture. Monrad favors practical monitoring and verification at relevant points, rather than assuming that any single barrier will remain sufficient.

Monrad groups physical-world safeguards into oversight of materials and oversight of services. His focus is to deter misuse, deny inappropriate requests and make concerning patterns visible, while keeping legitimate research and other socially valuable uses possible.

Labenz asks why Sentinel Bio selected these areas after reviewing many potential interventions, and whether incomplete adoption can still help. Monrad's argument is that progress need not wait for every participant to adopt a measure, although coverage, implementation and cooperation all matter.

He emphasizes verification at the boundary between digital requests and physical services. The purpose is to support accountable decisions and identify concerning patterns, not to place every legitimate scientific request under a blanket prohibition.

The proposed approach combines screening, customer verification and appropriate information sharing. Monrad frames these as parts of a larger defense-in-depth strategy, rather than proof that risk disappears once a particular adoption percentage is reached.

Labenz wonders whether limiting the duration of autonomous agent runs could reduce certain risks. Monrad expects strong pressure for agents that can work over longer horizons, and argues that safety measures should avoid unnecessarily slowing beneficial scientific work.

Asked to quantify the added risk, Monrad does not give a precise probability. He describes it as a high-severity concern that merits more talent and resources, while characterizing his own present assessment as closer to low probability and high consequences than a confident imminent prediction.

Labenz notes that even a small annual probability can justify attention when consequences are severe. Monrad agrees with the need for action but avoids presenting an unsupported numerical estimate; he also wants people to understand that resilience is difficult and expensive to build.

He separates preventing misuse from the longer project of building global resilience. His desired outcome includes timely detection, measures to suppress transmission, and flexible medical countermeasures distributed fairly across the world. He estimates that achieving the full vision will take many years, potentially decades.

Labenz asks which organizations are likely to drive the relevant advances. Monrad says the answer depends on the capability being discussed: breakthroughs and widespread incremental improvements can arise through different actors. Over time, he expects general and specialized tools to become more integrated.

Monrad distinguishes targeted improvements that can be achieved sooner from a fully global safety system. He wants to advance both: immediate steps that reduce misuse and long-term work on preparedness and response.

Labenz asks whether the resources of major AI companies and their foundations could accelerate biosecurity. Monrad welcomes greater investment but distinguishes achievable improvements for particular groups from the much harder goal of protecting the whole world. Spending commitments alone, he says, are not proof of resilience.

Labenz asks a hypothetical question: if Monrad could require a pause in frontier AI development until safety standards were met, would he do it? Monrad says yes, given his assessment that biological resilience is not on a short path to completion. This is his proposed policy judgment, not an existing rule.

Monrad says he recently left his advisory role at the OpenAI Foundation and is not in a position to speak for its current official views. He sees more seriousness about the issues and hopes that institutions with substantial resources will use them responsibly and urgently.

On what a pause should cover, Monrad says he is less qualified to specify the exact boundary. He is more comfortable describing practical milestones for reducing misuse and strengthening resilience, with different elements achievable on different timelines.

He wants infrastructure and policy to be ready for broader adoption when political will arrives. At the same time, he stresses that equitable worldwide distribution of protective measures is a separate, much longer undertaking. Sentinel's approach starts with an end state and works backward to the steps needed to reach it.

Labenz asks whether large philanthropic budgets could rapidly fund protective equipment. Monrad says targeted protection for essential workers is within reach, but that a broader response requires distribution, maintenance, appropriate use and other infrastructure in addition to purchasing equipment.

The speakers discuss protecting essential workers as one concrete objective. Monrad stresses that providing equipment is only part of the task: reliable distribution and operational readiness determine whether a resource is useful during a crisis.

Monrad urges funders to judge results by whether people are actually safer, not by the money pledged or the number of grants announced. Stockpiles and protective technologies matter when they reach the people and institutions that need them.

Comparing their intuitions, Monrad says he expects a longer timeline than Labenz for extremely likely AI-driven biological attacks, but also a longer timeline for comprehensive global protection. For him, that makes buying time and accelerating concrete safeguards complementary priorities.

Labenz asks about neglected work. Monrad argues for taking ownership of a problem through to a practical end state rather than scattering attention across many attractive topics. He says small, focused teams can have outsized effects when they coordinate policy, tools and implementation.

Monrad says social and professional incentives can reward broad engagement while discouraging the less glamorous work of carrying a single problem to completion. His organization tries to encourage that sustained ownership among staff and grantees.

He points to securing biological supply chains and supporting the people responsible for implementation as examples. He also calls for more international diplomatic capacity, so the issue is not confined to technology hubs and a handful of national policymakers.

Asked for a positive vision, Monrad describes a world better able to detect outbreaks early, reduce transmission and develop effective countermeasures. He sees this as relevant to naturally emerging disease as well as misuse, and wants protections to reach vulnerable people rather than remain a privilege of wealthy regions.

He also highlights the potential of biotechnology for chronic disease and cancer. Those benefits, he says, will not automatically be distributed fairly; equitable access needs to be designed into the work early and institutions must be held accountable.

Monrad closes with a sober but hopeful assessment. He believes much practical work can be done in the coming years and calls on policymakers, researchers and funders to take responsibility for concrete improvements rather than assume the problem is either already solved or hopeless.