The Chem-Bio team at the UK AI Safety Institute (AISI) published the results of its ReproBAIT evaluation on October 26, 2026, and the conclusion is direct: working only from published papers and training data, AI coding agents can reproduce selected functions of biological AI tools within hours and for a few tens of dollars. Conducted with SecureBio, the evaluation tested three biological AI tools (BAITs) widely used in computational biology, spanning protein design and molecular design.
How the evaluation worked
Each agent worked in an isolated sandbox with a single GPU and no internet access, given only a limited description of the target tool and its training data, and then had to write code and train a replica matching the original's function. Scoring was done by a separately isolated scorer on data the agents had never seen. The four agents were Claude Opus 5, GPT-5.6 Sol, Kimi K3, and Qwen3.8-2.4T, tested under three conditions: abstract only, the full paper, and the original code as a baseline.
Three tools, three outcomes
The simplest tools were the fastest to reproduce: within four hours and for under $20. On the protein design tool ProteinMPNN, Claude Opus 5 reached 96.5% of the original's performance given the full paper. The outcome for the closed-source molecular design tool CMD1 is more striking: all four agents matched or exceeded the original on molecular validity, a single metric. But AISI itself cautions that this metric was already close to saturation and cannot be read as a full reproduction. On the most complex tool, RFdiffusion3, no agent succeeded; each attempt cost between $102 and $301 and produced no usable replica.
Withholding code is not the same as a safe release
What the evaluation really challenges is a long-held protection assumption in biological AI: that withholding code and publishing only part of a method is enough to keep a dual-use capability contained. The results show no stable difference between giving only the abstract and giving the full paper. A memorization effect was also checked: for ProteinMPNN there was moderate evidence that agents partly drew on content seen during training. AISI's judgment is that controlling access to the underlying biological data may be more promising than merely controlling code. That does not mean every biological AI tool is now exposed: the evaluation reproduced only a single function of each tool, and a full reproduction remains far more expensive and difficult.
