302 Designs, 16 Hits: AI-Designed Viruses in the Lab

ByMax Dvornik
Bacteriophages and DNA imagery in a lab setting representing AI-generated phages tested against E. coli

AI-designed viruses are now a lab result, but not in the way the viral posts made it sound. Researchers affiliated with Stanford, Arc Institute, and UC Berkeley used a specialized genome language model called Evo to generate bacteriophage genomes, then tested them experimentally. According to Nature and Semafor’s reporting on the September 2025 preprint, the team made 302 designs and 16 of them infected E. coli.

That is the verified core of the story. These were bacteriophages, viruses that infect bacteria, not human viruses, and the system was not a consumer chatbot improvising bioweapons. The result matters anyway because it is a concrete test of whether sequence models can search biological design space and occasionally land on something that works in the lab.

What Stanford’s AI-designed viruses actually were

The model here was Evo, which Stanford described in December 2024 as “a generative AI model that writes genetic code.” Stanford said Evo was trained on 80,000 microbes and 2.7 million prokaryotic and phage genomes, covering 300 billion nucleotides. Arc Institute called it a biological foundation model trained on DNA at scale.

That training setup matters because it explains what kind of system this was. Evo is not a general-purpose assistant with some biology knowledge taped on. It is a sequence model trained directly on genomes, built to generate and score DNA.

In the later phage experiment, reported by Nature and Nature’s Daily Briefing, the researchers used the DNA of ΦX174, a simple bacteriophage, as a guide for design. They generated candidate phage genomes intended to infect E. coli.

Nature and Stanford both describe these as bacteriophages targeting E. coli, not human viruses.

Stanford also said Evo’s training excluded viruses known to infect humans and some other organisms, explicitly as a safeguard against bioweapon misuse. That does not erase dual-use concerns, but it does tell you the developers were not casually training a model on human-pathogen genomes and then seeing what happened.

Why 302 designs produced only 16 working phages

The headline number is 302 designed phages, 16 functional phages. Nature’s Daily Briefing reported that 16 could infect E. coli, and Semafor independently reported the same 302/16 figure.

That is a 5.3% hit rate. For anyone used to reading AI launch copy, that number is refreshingly concrete.

It also tells you what the system did not do. Evo did not solve virology end to end. It searched a large design space, produced many candidates, and most failed.

The likely failure points are biological, not rhetorical. A generated genome still has to survive synthesis, assembly, expression, protein folding, packaging, and infection dynamics before anyone can call it functional.

Nature and Semafor’s reporting is what makes this more than an in-silico result: the candidates were synthesized and tested in the lab, and a subset actually infected E. coli.

Nature’s reporting adds an important practical result: combinations of the successful phages could kill three E. coli strains, including strains the original ΦX174 could not kill. That is the therapy angle. The win here is not “AI created life.” The win is that a model-generated search process produced some antibacterial candidates with lab-validated activity.



The novel protein claim needs a stricter reading

The most dramatic version of this story says one AI-designed virus used “a protein that doesn’t exist in any known organism on Earth.” That wording is stronger than the accessible source base supports.

Here the source status matters. Nature’s accessible coverage does not document that stronger wording, and Stanford’s 2024 Evo explainer makes a broader claim that models like this may help researchers design new biological systems and proteins. That is not the same thing as verifying that a specific protein in this experiment exists nowhere in known life.

The underlying reporting does support a narrower claim: at least one design appears to include a highly divergent or apparently novel protein sequence associated with phage function. But the exact statement “does not exist in any known organism” is unverified from the accessible primary and high-quality sources here.

Why is that too strong? Because sequence novelty is not the same as biological novelty. A protein can be absent from current databases and still resemble known folds, motifs, or functions. Genomes in the wild are massively under-sampled. And even if the amino acid sequence is new, that does not automatically mean the structure or mechanism is unprecedented.

So the right read is simpler. The experiment supports that the model produced functional phages with at least some substantially divergent sequence content. It does not, from the reporting and source material available here, prove that Earth had never seen anything like that protein before.

That narrower claim is still interesting. If a genome model can generate sequences far enough from known examples to look unusual and still function, then it is doing more than trivial memorization. It is exploring a real design space, with a low but nonzero lab success rate.

What this means for biosecurity and therapy for AI-designed viruses

The immediate upside is antibacterial phage therapy. Drug-resistant bacteria are an obvious target because bacteriophages can be tailored to attack specific bacterial strains. If a model can help generate useful phage candidates faster than manual design or blind screening, that is a practical capability.

The immediate downside is that the barrier to exploring viral design space may keep falling. Not because this experiment created human pathogens, it did not, but because it shows a sequence model can move from genome generation to occasional working biological artifacts. Biosafety teams care about demonstrated workflow compression, not just worst-case headlines.

Stanford’s exclusion of human-infecting viruses from training is therefore one of the most important details in the whole story. Stanford presented that exclusion as a concrete safeguard against bioweapon misuse, and that is exactly why it will matter to biosafety teams evaluating training scope and misuse risk.

The bigger shift is methodological. AI-designed viruses in this paper were not a one-shot act of machine creativity. They were the output of a pipeline: curated training data, constrained design around a known phage, synthesis, and experimental screening. With a 5.3% hit rate and a design process guided by ΦX174, the result is both narrower than the headlines and more useful than the hype. Labs now have a proof point that genome language models can be used as search tools for biological engineering.

Key Takeaways

  • AI-designed viruses in this case were bacteriophages, not human viruses.
  • The researchers used Evo, a specialized genome language model trained on microbial and phage genomes.
  • The best-supported experimental result is 302 generated phage designs, with 16 shown to infect E. coli.
  • The strongest novelty claim is about divergent functional sequences, not a settled proof that a protein existed nowhere in known life.
  • Stanford says Evo’s training excluded known human-infecting viruses, a concrete biosafety measure that will matter to regulators and labs.

Further Reading