Coding agents rebuilt parts of biological AI tools from research papers. The missing safeguard may be data access

An organisation might withhold the source code for a specialised biological model while still publishing a scientific paper about what it does. How much protection does that decision actually provide if another AI can write a replacement? The UK's AI Security Institute has published a new evaluation called ReproBAIT, designed to test that question. It did not ask whether a general-purpose assistant could instantly produce a working biotechnology company. It gave coding agents constrained information, training data and limited computing resources, then assessed whether they could reproduce selected functions of existing research tools. The results complicate familiar distinctions between open and closed scientific software.[1]

ReproBAIT stands for Reproducing Biological AI Tools. The Institute's Chem-Bio researchers and collaborators designed controlled tests around published systems of different complexity, including protein-design models and a closed-source molecular design system. Agents operated in isolated environments without internet access. Their outputs were assessed against held-out data and the original tools' defined performance metrics. This design provides evidence about code-building under particular information conditions; it does not establish general competence to run a complete laboratory, validate a biological intervention or reproduce every function of the target tools.[1]

A narrow target can be easier than a complete tool

The public methodological explanation distinguishes two information settings: providing only the published abstract or providing the full manuscript and supplementary material. For open-source tools, the researchers also included a code-available comparison. Importantly, agents were supplied with relevant training data. In real product governance, withholding a model's weights, software and training inputs can present three distinct obstacles. A finding that some functionality can be rebuilt with training data does not tell us how easily that data could be obtained when it is not publicly available.[2]

The researchers tested four leading coding agents and reported the best of three attempts for each condition. On a protein-design task measured by sequence recovery, the strongest attempted reproduction approached the original's performance: the best reported fidelity was 96.5 percent in the full-paper setting. The institute stresses that this was fidelity on a particular benchmark metric, not parity across the full research system. A separate molecular-design test used a chemical-validity score that was already near saturation, making comparisons on that one measure especially prone to overstating overall equivalence.[2]

The experiment also found a hard boundary

For the most complex system, RFdiffusion3, none of the agents achieved a successful reproduction within the specified time and compute budget. This negative result is important because it prevents a simple story that AI can now rebuild any science software from a manuscript. Complexity, computational requirements and the specific function being tested all influenced outcomes. Some simpler successful reproductions took four hours and less than $20 in the researchers' cost accounting; attempts on the complex model used substantially higher budgets without meeting the success criterion.[2]

The team investigated whether agents might recall portions of publicly available code from their earlier training rather than infer everything from an abstract or paper. Their diagnostics provided moderate evidence consistent with memorisation for one established open-source tool, but those checks cannot establish precisely how much of an implementation was remembered. Providing the full paper did not consistently improve results compared with shorter public descriptions. That observation should be read cautiously: it may reflect prior exposure, task characteristics, or weaknesses in how information settings were separated, not proof that detailed method publication is irrelevant.[1][2]

An uncomfortable choice for scientific openness

Research fields depend on publication, replication and the ability of peers to challenge methods. At the same time, biological AI systems can be dual-use, supporting valuable discovery while raising legitimate safety concerns. ReproBAIT does not recommend a blanket prohibition on technical papers. It suggests that access-control strategies need to be evaluated against actual reconstructability rather than assuming that a private repository creates durable protection. In particular, restricting access to unique and potentially sensitive training data may offer different defensive properties from withholding implementation code alone.[1]

The evidence also informs commercial strategy. If a software company's proprietary advantage is simply that no one else has written a particular implementation, coding agents may reduce the difficulty of building a functionally similar component when the relevant task, training data and benchmarks are public. But a mature product also consists of curated data, validated quality, reliable deployment, user workflows, regulatory compliance and customer trust. Rebuilding one measured function says relatively little about those additional requirements. The study is a warning against confusing code secrecy with a comprehensive barrier to entry.[1]

For policymakers, the useful next question is not only whether AI agents can reproduce an existing tool, but which safeguards remain effective as those agents improve. That requires testing across tool complexity, data availability, compute budgets and independent attempts, while avoiding publication of unnecessarily operational misuse details. ReproBAIT's controlled results make the question measurable. They do not collapse it into a universal claim that either scientific openness or private software is safe or unsafe in every circumstance.[1]

Report an error or suggest a correction