AI Designed 285 Synthetic Virus Genomes. 16 Worked. Johns Hopkins Says No One's Governing What Just Happened.

Stanford and Arc Institute researchers had two genome language models, Evo 1 and Evo 2, design complete bacteriophage genomes from scratch. They synthesized 285 of the designs. Sixteen came back as functional, working viruses — a 5.6% hit rate, reported everywhere as "the first fully AI-generated virus." In the same issue of the journal that published the result, two Johns Hopkins biosecurity researchers put the part the headlines skipped in writing: "the ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not." No press release said that part out loud.

What Evo actually did

"Generative design of bacteriophages with genome language models" (King, Driscoll, Li, Guo, Merchant, Brixi, Wilkinson, Hie, Science, DOI 10.1126/science.aec2657, published August 6, 2026) is the first time a generative model has designed a complete viral genome, rather than a single protein or gene, and had that design come back alive in a dish. The models are Evo 1 and Evo 2, built at the Arc Institute on an architecture called StripedHyena 2, and trained not on text but on raw DNA sequence — Evo 2 alone on roughly 9.3 trillion base pairs drawn from 128,000 genomes spanning bacteria, viruses, plants, and animals. The team used ΦX174, a well-studied bacteriophage with a compact, 5,386-base genome, as the design template, and asked the models to generate full genome sequences with a specified host range rather than filling in a single gene.

The safety framing sits inside the method, not bolted on afterward: the Arc Institute's own writeup states that Evo's training data deliberately excludes viruses that infect humans, animals, or plants, which the team says prevents the models from generating pathogen sequences by construction, not just by policy. Every design in the study targeted non-pathogenic bacterial hosts, and the wet-lab work ran in a secure facility. That exclusion is a real, verifiable engineering choice, and it is the reason this particular paper is about phage therapy candidates and not something scarier. It is also, as the next section covers, exactly the boundary the commentary accompanying the paper argues nothing outside the lab is currently built to enforce.

The number the headlines skipped

Evo generated on the order of 700,000 candidate genomes computationally. Researchers synthesized 285 of them and tested each one against E. coli. Sixteen came back functional — they infected and killed the bacteria, some of them outperforming the natural ΦX174 template, and a cocktail of the 16 overcame two phage-resistant strains that had evolved resistance to the original. Sixteen working viruses from 285 attempts is a 5.6% success rate. That is a genuinely useful hit rate for a design task with no prior art to tune against — and it is also, on its own, not the number that supports "AI designs viruses" as a general capability claim. Most attempts didn't work.

The novelty of the winners is the second complication. The 16 functional genomes carried between 67 and 392 mutations apiece relative to their nearest natural relative — one design, Evo-Φ2147, carried 392 mutations and only 93.0% nucleotide identity to its closest known relative, distant enough that it would qualify as a different species under some taxonomic schemes. Thirteen of the 16 contained mutations that don't appear in any known natural sequence at all. But that also means three of the sixteen "AI-designed" successes stayed close enough to characterized natural diversity that calling them novel is a stretch. Cryo-electron microscopy on one design did confirm something genuinely new at the structural level — the capsid incorporated an evolutionarily distant DNA-packaging protein not seen in the natural template — so the paper's strongest evidence for real novelty is structural, not just a mutation count. Read against the "first fully AI-generated virus" framing running in most coverage, the accurate version is narrower: a design pipeline that works about 1 time in 18, whose most interesting successes borrow real structural biology from elsewhere in the natural world rather than inventing it from nothing.

The commentary in the same issue

Science ran "AI-designed viral genomes" (Inglesby, Hanke, Science 393, 563–564, DOI 10.1126/science.aej8512, August 6, 2026), a perspective piece by Thomas V. Inglesby and Moritz S. Hanke of the Johns Hopkins Center for Health Security, in the same issue as the King et al. paper — not a delayed reaction, a coordinated companion piece the journal published alongside the result. Their argument is narrow and specific, not alarmist: the training-data exclusion that keeps this particular study confined to non-pathogenic phages is a research-team choice, not a legal requirement, and nothing downstream of that choice currently checks whether it was followed. The US policy restricting high-risk life-sciences work targets gain-of-function experiments on natural pathogens in a wet lab. A model generating a genome on a screen, before any synthesis happens, falls outside that definition entirely.

Inglesby and Hanke propose two specific, checkable fixes rather than a general call for caution: a legal requirement that DNA-synthesis providers screen both the sequence they are printing and the identity of the person ordering it, and new detection tools tuned specifically to recognize AI-generated genomic sequences, which don't carry the same statistical fingerprints as evolved natural ones. Neither fix exists yet in binding form. The sentence worth sitting with is the one in their own words: "The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not." That is a statement from biosecurity specialists inside the same publication event as the capability claim, not outside critics reacting to a press release days later.

What this means for reproducible, local-first science

MegaBrain BioScience doesn't design genomes, and nothing here is a claim about where any commercial research tool stands relative to this paper. What the phage result and its own companion commentary add up to is a rule worth applying to every "AI does X for the first time" claim in this beat, not just this one: ask for the denominator, not just the headline number. Sixteen working viruses is real. Sixteen out of 285 attempts, with three of the sixteen staying close to a natural relative, is the same fact stated honestly, and it changes what you can responsibly conclude from it. The same discipline applies to the safety story — a training-data exclusion is a real and verifiable engineering safeguard, and it is also, by the authors' own account in the same journal issue, not the same thing as a governance system that can check whether that safeguard was actually followed once a design pipeline like this one is running somewhere you can't see it. A workbench that exports a reproducibility record for every run doesn't settle a biosecurity policy question. It does mean that when a claim like this one lands, the training exclusions, the synthesis-order paper trail, and the hit-rate math behind it are things you can actually go check, instead of numbers you have to take on faith from a press release.