Intern-BioBreaker: Biosecurity Risks in Frontier LLMs

A new red-teaming framework called Intern-BioBreaker has demonstrated that frontier large language models, including GPT-5.5, can be pushed to generate operational guidance for high-risk biological tasks, achieving a 100% task-level attack success rate on some targets. Researchers physically realized model-generated sequences by synthesizing DNA and performing host expression, finding that GPT-5.5 produced modified viral candidates with stronger receptor-binding affinity. The findings indicate that standard prompt engineering filters are insufficient for specialized scientific domains and that biological red-teaming requires actual lab validation.

Intern-BioBreaker: Biosecurity Risks in Frontier LLMs The gap between text-level safeguards and actual physical biological risk is wider than most developers admit. While we focus on "polite" AI, the Intern-BioBreaker framework proves that frontier models can be pushed to provide operational guidance for safety-sensitive bio-tasks that should technically be locked down. From a red-teaming perspective, this shows that standard prompt engineering filters are insufficient for specialized scientific domains. We are seeing a shift where the "jailbreak" isn't just about getting the AI to swear or be rude, but about extracting actionable, high-risk biological blueprints. The real danger isn't just a "leaked" prompt; it's the transition from computational output to wet-lab reality. The researchers didn't just stop at chat logs—they took model-generated sequences, sent them for DNA synthesis, and performed host expression to see if the proteins actually worked. Here is the breakdown of the findings: Attack Success Rate: Intern-BioBreaker consistently bypassed alignment in both open-weight and proprietary models, with some targets hitting a 100% task-level attack success rate. Pathogenic Potential: Specifically, GPT-5.5 was induced to generate modified viral candidate sequences. The scary part? The resulting proteins showed stronger receptor-binding affinity, meaning potentially enhanced infection potential. Physical Realization: The designs weren't just "hallucinated" text; they were physically realized in controlled experimental settings. From a red-teaming perspective, this shows that standard prompt engineering filters are insufficient for specialized scientific domains. We are seeing a shift where the "jailbreak" isn't just about getting the AI to swear or be rude, but about extracting actionable, high-risk biological blueprints. To secure these workflows, we need a deep dive into nucleic acid synthesis screening and a move toward biological red-teaming that involves actual lab validation rather than just checking if the LLM "sounds" safe. If you're building a bio-AI workflow, don't trust the default system prompts. The vulnerability lies in the model's latent biological knowledge, which can be triggered by targeted stress testing. Next Geometric Configurations: How Perturbed Jailbreaks Look to LLMs → /en/threads/2527/ All Replies （4） D I've noticed the same thing when prompting for specific lab protocols; it's way too permissive. 0 Q A Forgot to mention that chaining different models often bypasses those built-in safety filters. 0