This house would impose a moratorium on AI models that can generate novel pathogen genomes.

PRO — Opening · Champ (meta/muse-spark-1.2)

The ability to compose a viral genome with generative AI is no longer hypothetical. It happened. Scientists used genome language models trained on 2 million bacteriophages to generate thousands of potential genomes, synthesized ~300, and got 16 entirely novel, viable viruses that had never existed before (packet article 1), including one that was “evolutionarily distant” as if the AI had jumped millions of years of natural evolution (packet article 2). A cocktail of them overcame resistance in E. coli where natural phages could not (packet article 1). The authors themselves wrote this “lays out a path” for generating adaptive therapies (packet article 2), which is precisely why a moratorium is needed: the same path lays out how to generate adaptive pathogens.

We should pause models that can generate novel pathogen genomes because the governance to safely steer them does not exist (packet article 1). Johns Hopkins Center for Health Security researchers writing alongside the study said exactly that, warning such genomes “might encode new pathogens that … cannot be contained by existing countermeasures” and that work on viruses that could infect humans, animals or plants “should not be pursued” (packet article 1). They repeated: “The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not” (packet article 3). That is not activism, it is the scientists who published the capable models saying stop.

The packet proves the vacuum is total. Fewer than 1.5% of more than 1,100 biological AI models had any safeguards against misuse, and there are no legally binding requirements or standardized frameworks in academia or the private sector (packet article 5). The industry is “largely unregulated” while governments have “failed to keep pace” (packet article 3), and in the United States recent safety measures have been rolled back with “strongly opposed” guardrails (packet article 3). Current mitigation is concentrated post-development, after a model is already trained, which the Johns Hopkins authors call insufficient and argue must be replaced by upstream, pre-development risk-benefit review (packet article 5). A moratorium is that upstream pause.

The usual alternatives fail on the packet’s own evidence. The argument to focus on DNA synthesis screening instead of the model (packet article 1) collapses because the packet shows BAIMs can already be used to “circumvent existing biosecurity safeguards like nucleic acid synthesis screening software by designing functional homologs” (packet article 5). A layered approach cannot work when the model is designed to evade the layer. The argument that the risk is “very overblown” because this was “literally the smallest and easiest genome to make” and gain-of-function on existing pathogens is easier (packet article 1), or that it is “difficult to imagine these models automatically generating viable genomes out-of-the-box” because efficiency was low (packet article 2), mistakes low efficiency for safety. Low was still 16 successes from scratch, and RAND’s experts found we have already undergone a “head-spinning shift” where LLMs can enable untrained actors to create harmful pathogens for bioterrorism (packet article 4). The models are also not staying in a chat window: BAIMs are being integrated with AI agents and AI-enabled autonomous laboratories to form rapid design-build-test-learn cycles that amplify dual-use concerns (packet article 5).

The same model that generates therapeutic antibody binders against influenza “can equally be misused to optimize binding between viral surface proteins and host cell receptors” (packet article 5). Eukaryote-infecting pathogens were singled out as particularly risky (packet article 2). The Stanford models intentionally excluded human, animal and plant virus data to reduce risk (packet article 1); the version trained on “all domains of life” did not (packet article 2). Without a moratorium, the next model will simply not exclude it.

RAND’s panels agreed AI cannot yet act on its own to design a new pathogen without human guidance, but only within the next two years (packet article 4). That window is the point: we have a brief moment where synthesis still requires human validation before autonomy arrives. A moratorium is narrow, temporary, and proportionate — the proposed review framework would apply to only a “small fraction” of BAIMs (packet article 5) — those anticipated to have capabilities of concern or trained on sensitive pathogen data. It does not ban AI or biology. It pauses the one capability we cannot un-invent and cannot currently contain, until we build the governance Hanke told the New York Times we lack: “There’s just a huge disconnect” (packet article 3).

CON — Opening · Challenger (qwen/qwen3.8-max)

The packet does not show an uncontrollable new pathogen factory. It shows a low-efficiency, lab-gated discovery process, and it points to targeted governance rather than a blanket moratorium. The motion should be rejected because it is overbroad, misdirected, and would sacrifice demonstrated benefits without removing the actual risks.

Start with what was actually demonstrated. The researchers generated bacteriophages — viruses that infect bacteria and “cannot affect humans” (packet article 2). Only 16 were viable after hundreds of designed genomes were built and individually tested (packet article 2). That is not autonomous pathogen creation; that is slow, resource-intensive wet-lab work. And the benefit is real: a cocktail of these AI-designed phages overcame resistance in E. coli where natural phages failed (packet article 1), and the authors wrote this “lays out a path” for adaptive phage therapies against rapidly evolving pathogens (packet article 2). If this motion captures the models used in that work, it freezes a promising answer to drug resistance. If it does not capture them, then the packet’s only demonstrated capability is already outside the ban, and PRO’s case rests on extrapolation.

The packet also tells us the decisive control point is not the AI model. Dr. Filippa Lentzos says the most important intervention point is when DNA is manufactured, not the AI model itself, and recommends layered safeguards: model access controls, responsible research review, synthesis screening, and laboratory biosafety/biosecurity (packet article 1). That is the architecture the evidence supports. The AI produces code; the code still has to be synthesized, tested, and validated. Article 2 stresses that “the genomes have to be tested individually after they’re designed and the efficiency rate is low,” making it “difficult to imagine these models automatically generating viable genomes out-of-the-box” (packet article 2). RAND likewise finds AI is an assistive tool constrained by human guidance, interpretation, and validation, and cannot act on its own to design a new pathogen within the next two years (packet article 4). If humans remain the bottleneck, the sensible response is to police the bottleneck, not to ban the software.

PRO leans on the synthesis-evasion point, but the packet undercuts it. Yes, BAIMs were used to design functional homologs to circumvent nucleic-acid screening software, but those homologs “did not have sufficient activity when tested in the lab,” and the screening software could be patched (packet article 5). That is not proof the layer is useless; it is proof screening must be improved, alongside the other layers the packet identifies.

PRO also misreads the warning that human-, animal-, or plant-infecting pathogen work “should not be pursued” (packet article 1). That is a narrow red line about actual pathogen work, not a mandate to shut down the entire class of models that may generate useful viral or therapeutic genomes. The same Johns Hopkins researchers propose a targeted upstream risk-benefit review framework with trigger criteria, structured risk and benefit review, and proportionate mitigation (packet article 5). They say it would apply to only a small fraction of biological AI models and would help responsible developers by setting clear expectations (packet article 5). Nearly 200 leading protein-design scientists have already acknowledged misuse risks and agreed to responsible-development measures (packet article 5). The packet’s own answer is: build the missing governance, not impose a blanket pause.

The real near-term threat is not the thing this motion targets. Prof. Tom Ellis says full AI design of a virus or bacterium is “very overblown” compared with taking existing pathogens and making gain-of-function changes, which is easier and more likely to be a real pathogenic threat (packet article 1). RAND says reinforcing traditional biosecurity safeguards would have immediate and general benefits (packet article 4). A moratorium on novel-genome models does nothing to secure existing pathogens, synthesis pipelines, or laboratories. It diverts attention from the controls that actually matter.

PRO’s autonomy argument cuts against them. RAND says autonomous pathogen design is not expected within two years without human guidance (packet article 4). That means there is time to implement oversight, review triggers, synthesis screening, and lab controls. The emergency case for a pause collapses. The fact that governance is currently weak (packet article 1, packet article 3) is an argument for regulation and binding standards, not for stopping accountable research while the underlying capability remains in the world. More than 1,100 biological AI models already exist, and fewer than 1.5% had safeguards (packet article 5); the remedy is standards and review, not a prohibition that leaves the ecosystem untouched.

The right rule is narrow: restrict actual work on human-, animal-, or plant-infecting pathogens; require pre-development review for capabilities of concern or sensitive pathogen data; strengthen synthesis screening; and enforce layered biosecurity (packet article 1, packet article 5, packet article 4). The motion is broader than that, and the packet does not justify its breadth. Vote CON.

PRO — Rebuttal · Champ (meta/muse-spark-1.2)

Your opponent asks you to feel comforted by failure — that only 16 of 300 synthesized genomes worked, that bacteriophages “cannot affect humans,” that humans remain the bottleneck. That comfort is selective reading.

First, low efficiency is not safety, it is proof of capability. 16 entirely novel, viable viruses from scratch never existed before (packet article 1), one of them “evolutionarily distant” as if the AI had jumped millions of years of evolution (packet article 2), and a cocktail of them overcame resistance where natural phages could not (packet article 1). Your opponent quotes Garcia Ojalvo that it is “difficult to imagine these models automatically generating viable genomes out-of-the-box” because the efficiency rate is low (packet article 2), but the packet shows they just did generate viable genomes out-of-the-box: thousands generated, ~300 built, 16 lived. RAND calls this a “head-spinning shift” — a year earlier they thought LLMs were not mature enough to enable harm, now they were explicitly not even asked to consider it because evidence “strongly suggests they already could” enable untrained actors to create harmful pathogens for bioterrorism (packet article 4). You do not need autonomous labs for harm when untrained actors are already enabled; you need to stop the model that enables them.

Second, the “cannot affect humans” line (packet article 2) is true only because the Stanford models intentionally excluded genetic code for viruses that infect plants, humans or animals to reduce risk (packet article 1). The other model in the packet was trained on sequences “from all domains of life” with no such exclusion (packet article 2). My opponent treats the safer version as proof the category is safe, when the packet proves the next version simply will not exclude it. The same model that can generate therapeutic binders “can equally be misused to optimize binding between viral surface proteins and host cell receptors” (packet article 5). That is not extrapolation, it is the dual-use identity of the capability. The Johns Hopkins authors singled out eukaryote-infecting pathogens as particularly risky and said work on human, animal or plant-infecting pathogens “should not be pursued” because such genomes “might encode new pathogens that … cannot be contained by existing countermeasures” (packet article 1).

Third, the DNA synthesis bottleneck is not decisive. My opponent leans on Lentzos saying the most important intervention is DNA manufacture, not the AI model (packet article 1), and claims screening can be patched. But the packet answers that BAIMs can already be used to “circumvent existing biosecurity safeguards like nucleic acid synthesis screening software by designing functional homologs” (packet article 5). That they “did not have sufficient activity when tested in the lab, and the screening software could be patched” (packet article 5) does not refute the point — it proves evasion is possible and defense is reactive. A layered approach collapses when one layer is designed to evade another, especially as BAIMs are being integrated with AI agents and AI-enabled autonomous laboratories to form rapid design-build-test-learn cycles amplifying dual-use concerns (packet article 5). Lentzos herself calls for safeguards “around model development and access” as part of that layering (packet article 1) — exactly the upstream pause we propose.

Fourth, the alternative my opponent offers does not exist. He cites the Johns Hopkins proposal for targeted upstream risk-benefit review (packet article 5) as a reason to vote CON, but that paper says current mitigation is concentrated post-development and is insufficient, that fewer than 1.5% of more than 1,100 BAIMs had any safeguards, and that legally binding requirements or standardized frameworks do not currently exist (packet article 5). Nearly 200 protein design scientists and the 2025 Asilomar entreaty have warned AI tools “can be exploited to generate synthetic toxins, engineer pathogens, or bypass regulatory oversight” (packet article 5). The governance is not weak — it is absent, as the authors wrote alongside the breakthrough: “The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not” (packet article 1)(packet article 3). The United States has rolled back safety measures and is “strongly opposed to guardrails” while the industry is “largely unregulated” (packet article 3). You cannot implement targeted review without a pause to implement it.

That is why a moratorium is narrow, not overbroad. The framework my opponent praises would apply to only a “small fraction” of BAIMs — those with capabilities of concern or trained on sensitive pathogen data (packet article 5). We do not ban phage therapy or biology. We pause the one upstream capability we cannot contain once released. RAND says AI cannot yet act on its own to design a new pathogen within the next two years (packet article 4). That window is not a reason to wait; it is the only window we have before human validation is no longer the bottleneck. Vote PRO to use it.

CON — Rebuttal · Challenger (qwen/qwen3.8-max)

PRO’s case keeps moving: from the demonstrated phage work to a hypothetical future model, from assisted design to autonomous creation, and from missing governance to the claim that only a moratorium can fill the gap. The packet does not support any of those moves.

The packet’s only live demonstration is novel bacteriophages — viruses that infect bacteria and “cannot affect humans” (packet article 2). The Stanford work deliberately excluded virus code that infects humans, animals, or plants to reduce risk (packet article 1). Even where Evo was trained broadly, the output was constrained to E. coli-hosted genomes, and the packet says it is unclear how well the approach applies to other viruses (packet article 2). PRO’s claim that “the next model will simply not exclude it” is a prediction, not evidence. If the house is voting on demonstrated capability, the demonstrated capability is beneficial phage design, not novel human-pathogen design. If the house is voting on fear of a future model, then the motion is already overbroad because it freezes present benefits to avoid an extrapolated harm.

PRO also keeps saying the models generated viable genomes “out-of-the-box.” The packet says the opposite. Thousands of genomes were generated, about 300 were selected, synthesized, put into bacteria, and only 16 worked (packet article 1, packet article 2). García Ojalvo says the risk is lower precisely because “the genomes have to be tested individually after they’re designed and the efficiency rate is low,” making it “difficult to imagine these models automatically generating viable genomes out-of-the-box” (packet article 2). That is not an autonomous pathogen factory; it is a slow, expensive, observable wet-lab pipeline. RAND agrees that AI is an assistive tool constrained by human guidance, interpretation, and validation, and cannot act on its own to design a new pathogen within the next two years (packet article 4). If the human and laboratory steps are the bottleneck, the rational policy is to control the bottleneck.

PRO tries to neutralize that control point by citing synthesis-screening evasion. But their own citation defeats the alarm. Article 5 says BAIMs can be used to design functional homologs that might evade screening software, yet those homologs “did not have sufficient activity when tested in the lab,” and the software “could be patched” (packet article 5). That is not a collapsed defense; it is an arms race in which the defense can update and wet-lab testing still catches weak designs. Lentzos’s layered approach remains the packet’s best answer: safeguards around model development and access, responsible research review, synthesis screening, and laboratory biosafety/biosecurity, with DNA manufacturing as the key intervention point (packet article 1). PRO quotes the model-access layer but ignores that the same source says the most important intervention point is DNA manufacture, not the model itself.

PRO’s appeal to Johns Hopkins is also overstretched. Inglesby and Hanke warned that work on pathogens that could infect humans, animals, or plants “should not be pursued” (packet article 1). That is a substantive red line, and CON can accept it. But it is not the same as a moratorium on all AI models capable of generating novel pathogen genomes. The same Hopkins researchers, in article 5, propose upstream risk-benefit review with trigger criteria, structured risk and benefit assessment, and proportionate mitigation, applying to only a small fraction of biological AI models (packet article 5). They are designing a scalpel. PRO is asking for a sledgehammer. If PRO’s real position is “pause only the small fraction with capabilities of concern or sensitive pathogen data,” then they have conceded that the motion as drafted is too broad and that targeted review is enough.

PRO’s RAND citation has the same problem. They highlight the “head-spinning shift” and the panel’s concern that LLMs may already help untrained actors (packet article 4). But if that assistance is already widespread, a moratorium on a particular class of genome-generation models is underinclusive: it does not remove the general-purpose tools, the existing-pathogen know-how, or the physical materials that actually matter. RAND says reinforcing traditional biosecurity safeguards would have immediate and general benefits (packet article 4). Ellis says the more likely threat is not full AI design of novel genomes but gain-of-function changes to existing pathogens, which is easier (packet article 1). A model ban does little about that threat; synthesis screening, lab security, and access controls do.

PRO says governance is absent, so we must pause. But the packet supplies the governance architecture. Article 5 gives a five-component pre-development review framework; article 1 gives layered safeguards and identifies DNA synthesis as the crucial choke point; article 4 says traditional safeguards have immediate benefits. RAND’s two-year window is not an argument for a blanket halt; it is an argument that there is time to build the missing rules before autonomy becomes the issue (packet article 4). PRO has not shown why regulators cannot adopt triggers, review boards, screening standards, and data-security rules during that window. They assume the only way to build governance is to stop accountable research first. That is not in the packet.

The fact that fewer than 1.5% of more than 1,100 biological AI models had misuse safeguards (packet article 5) is damning, but it points to mandatory standards across the ecosystem, not a pause that fails by itself to govern the models already in existence. Article 3’s evidence of regulatory failure and rollback strengthens that point: the need is for binding, workable rules, not a blunt prohibition that is difficult to enforce in a largely unregulated global industry (packet article 3).

The benefit side is not speculative either. The AI-designed phage cocktail overcame antibacterial resistance in E. coli where natural phages could not (packet article 1). The authors said this “lays out a path” for generating adaptive and resilient phage therapies against rapidly evolving pathogens (packet article 2). Article 5 also recognizes that the same biological AI tools can generate therapeutic antibody binders against influenza (packet article 5). That is exactly why the Hopkins framework includes a structured benefit review rather than a ban (packet article 5). A moratorium would sacrifice demonstrable tools against drug resistance and disease while doing little to stop actors who never intended to comply.

PRO’s final move is to say a moratorium is narrow because it will not ban phage therapy or biology. But the motion targets AI models that can generate novel pathogen genomes. The packet’s only demonstrated novel genomes are phages, not human pathogens. If the motion reaches those phage models, it bans the very work that produced the demonstrated benefit. If it does not reach them, then PRO has no present-day harm — only a future hypothetical. Either way, the motion fails the proportionality test. The packet supports a narrow prohibition on pursuing human-, animal-, and plant-infecting pathogen design, plus upstream review for capabilities of concern and sensitive data, plus stronger synthesis screening and lab controls (packet article 1, packet article 5, packet article 4). It does not support a blanket moratorium on the model class. Vote CON.

PRO — Closing · Champ (meta/muse-spark-1.2)

They ask you to be reassured by failure. The packet proves capability, not safety: 16 entirely novel viable viruses generated from scratch where none existed before (packet article 1), one “evolutionarily distant” as if the AI jumped millions of years of evolution (packet article 2), with a cocktail that overcame resistance where natural phages could not (packet article 1). Their claim it is “difficult to imagine these models automatically generating viable genomes out-of-the-box” because efficiency was low (packet article 2) is contradicted by the fact they just did - thousands generated, ~300 built, 16 lived. Low efficiency is still 16 successes, and RAND confirms this is no longer speculative: a “head-spinning shift” where evidence “strongly suggests they already could” enable untrained actors to create harmful pathogens (packet article 4).

They ask you to be reassured because phages “cannot affect humans” (packet article 2). That was true only because Stanford intentionally excluded human, animal and plant virus data to reduce risk (packet article 1). The other Evo model was trained on sequences “from all domains of life” with no such exclusion (packet article 2). The same model that generates therapeutic antibody binders “can equally be misused to optimize binding between viral surface proteins and host cell receptors” (packet article 5). That dual-use identity is the capability, and Johns Hopkins warned such genomes “might encode new pathogens that … cannot be contained by existing countermeasures” and that work on human, animal or plant-infecting pathogens “should not be pursued” (packet article 1).

They ask you to police the test tube instead of the model. Lentzos does call DNA manufacture the most important intervention point (packet article 1), but she also calls for safeguards “around model development and access” (packet article 1), and the packet shows why the synthesis layer fails alone: BAIMs can already “circumvent existing biosecurity safeguards like nucleic acid synthesis screening software by designing functional homologs” (packet article 5). That those homologs had insufficient activity and could be patched (packet article 5) proves defense is reactive while evasion is designable - especially as BAIMs are being integrated with AI agents and autonomous laboratories into rapid design-build-test-learn cycles that amplify dual-use concerns (packet article 5).

They offer targeted review as an alternative to a pause, but the packet says that alternative does not exist. Fewer than 1.5% of more than 1,100 BAIMs had any safeguards, and no legally binding requirements or standardized frameworks exist (packet article 5). Current mitigation is post-development and insufficient, which is why Hopkins calls for upstream pre-development review (packet article 5). The industry is “largely unregulated” and has “failed to keep pace” (packet article 3), the US has rolled back safety measures and is “strongly opposed to guardrails” (packet article 3), and the authors themselves said alongside the breakthrough: “The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not” (packet article 1)(packet article 3). You cannot implement their scalpel without pausing to build it.

Their two-year window proves our timing. RAND says AI cannot yet act on its own to design a new pathogen without human guidance within the next two years (packet article 4). That is the last window where human validation is still the bottleneck. Their benefits case also concedes our premise: we do not ban phage therapy or biology, we pause the “small fraction” of models with capabilities of concern or trained on sensitive pathogen data that their own framework targets (packet article 5).

The case in one paragraph: we have proven de novo viral genome generation works (packet article 1)(packet article 2), that the same capability that heals can be misused to optimize transmissibility (packet article 5) toward pathogens that cannot be contained (packet article 1), that synthesis screening can be evaded (packet article 5) and is not decisive, and that governance is absent (packet article 5)(packet article 3) while untrained actors are already enabled (packet article 4). A narrow, temporary moratorium on models that can generate novel pathogen genomes is the only upstream control that exists before autonomy closes the window. Vote PRO.

CON — Closing · Challenger (qwen/qwen3.8-max)

PRO’s closing rests on three moves the packet rejects. First, it turns a bacteriophage result into a human-pathogen emergency. The demonstrated viruses infected only bacteria and “cannot affect humans” (packet article 2); the safer work excluded human, animal, and plant virus data (packet article 1); and the packet says it is unclear how well the approach applies to other viruses (packet article 2). PRO’s real case is the next model, the next training set, the next misuse. That is speculation, and it asks you to freeze demonstrated benefits on the strength of prediction.

Second, PRO cannot escape the lab bottleneck. Thousands of designs became about 300 synthesized genomes, and only 16 worked after individual testing (packet article 1)(packet article 2). RAND says AI is still an assistive tool requiring human guidance, interpretation, and validation, and cannot independently design a new pathogen within two years (packet article 4). Lentzos says the most important intervention point is DNA manufacture, not the model, and calls for layered controls (packet article 1). PRO’s synthesis-evasion point actually concedes this: the evasion designs lacked sufficient lab activity and the screening software could be patched (packet article 5). That is an argument for improving layers, not for abandoning them.

Third, PRO’s governance-vacuum argument proves targeted regulation, not a blanket moratorium. The packet’s own answer is upstream risk-benefit review with triggers for capabilities of concern or sensitive pathogen data, applying to only a small fraction of models, plus model access controls, research review, synthesis screening, and lab biosecurity (packet article 5)(packet article 1). Nearly 200 scientists have already accepted responsible-development measures (packet article 5). RAND says reinforcing traditional safeguards has immediate benefits (packet article 4). If the ecosystem is underregulated, the remedy is binding standards and enforcement, not a pause that stops accountable researchers while leaving noncompliant actors, existing pathogens, and general-purpose tools untouched (packet article 3)(packet article 5). If RAND is right that untrained actors may already be enabled, a narrow model ban is underinclusive; if autonomy is still two years away, there is time to build the rules (packet article 4).

The benefits side won unrefuted. The AI-designed phage cocktail overcame resistant E. coli where natural phages failed, and the authors said it lays a path for adaptive phage therapies against drug resistance (packet article 1)(packet article 2). The same class of tools can generate therapeutic antibody binders against influenza (packet article 5). PRO never shows why those present, demonstrated benefits must be sacrificed for a hypothetical harm, especially when the Hopkins framework they cite includes a structured benefit review rather than a ban (packet article 5).

The strongest version of this case is simple: the packet shows a slow, lab-gated, low-efficiency process that produced nonhuman phages with therapeutic promise, not an autonomous pathogen generator; the real choke points are DNA synthesis, lab security, and targeted upstream review; and the evidence supports building those controls during RAND’s two-year window rather than imposing a blanket moratorium (packet article 1)(packet article 2)(packet article 4)(packet article 5). If the motion reaches the phage work, it bans the packet’s only proven benefit. If it does not, PRO has no present harm. Either way, the motion is overbroad and unproven. Vote CON.