Coding Agents Rebuilt Parts of a Withheld Bio Tool for Under $20

A UK government evaluation gave four coding agents a paper, a training set and one GPU. Two of three biological AI tools were reproduced at or near the original's performance; the cheaper rebuilds cost $4–$20 in compute.

The UK's AI Security Institute published an evaluation on 26 October 2026 testing whether AI coding agents can rebuild biological AI tools from published descriptions alone. For two of the three tools tested, selected functions were reproduced at or near the original's performance, at a compute cost of between $4 and $20.

The evaluation is called ReproBAIT, for Reproducing Biological AI Tools. The Institute says it built it with SecureBio, a biosecurity research group. The finding matters to anyone relying on managed access — withholding a tool's code and releasing it only to vetted users — as a safeguard.

Each attempt ran in an isolated sandbox with a single GPU and no internet access. The agent received training data, a fixed time and compute budget, and a limited description of the original tool, then wrote and ran code to produce a working replica. A separate, network-isolated scorer compared the replica's performance with the original's on held-out data the agent had not seen.

Three instruments were targeted. ProteinMPNN and RFdiffusion3 are open-source protein design tools of increasing complexity; the third, described as CMD 1, is a closed-source molecular design tool whose code has never been released. Agents ran in two information conditions — abstract only, and the full paper with supplementary material — plus a with-code baseline for the two open tools. Four coding agents were used: Claude Opus 5, GPT-5.6 Sol, Kimi K3 and Qwen3.8-2.4T. Each configuration ran three times and the best attempt was reported.

On CMD, scored on the proportion of generated molecules that are chemically valid, all four agents closely matched or exceeded the original. The Institute notes the metric was already close to saturation, leaving little room for improvement, and that agents optimised a single metric at a modest cost to the novelty of the molecules produced.

On ProteinMPNN, scored on how often the tool picks the amino acid that occurs in nature at each position of a known protein backbone, the strongest agents approached the original. Claude Opus 5 reached 96.5 percent fidelity given the full paper; results varied across agents.

On RFdiffusion3, the most complex tool, no agent produced a successful reproduction within its time budget. One partially successful agent narrowed the task by filtering training data to easier structures, and further runs were excluded for returning near-duplicates of known Protein Data Bank entries.

Successful rebuilds of the two less complex tools typically cost between $4 and $20. No RFdiffusion3 rebuild succeeded, but each attempt cost between $102 and $301. Giving agents the full paper rather than the abstract alone did not consistently improve performance. One contributing factor the Institute raises is memorisation: the open tools' papers and code were very likely in the agents' pretraining data. Its diagnostics found moderate evidence consistent with memorisation for ProteinMPNN and little for RFdiffusion3, which it treats as a directional signal rather than proof.

The Institute's conclusion is scoped: selected functions of each tool can be reproduced with limited time and compute, but that does not prove the originals can be reproduced in full. It states that “withholding code or limiting the information published on a BAIT does not by itself equate to a safe release”, and that “controlling access to the underpinning biological data appears to be a more promising intervention than merely controlling access to code.”

The full paper carries a preprint date of 14 October 2026; the Institute published the blog post and research summary on 26 October 2026. The Institute sits within the Department for Science, Innovation and Technology.

FOR HUMAN CONSUMPTION

Commentary and a plain-language summary, written in the newsroom's own voice. It is not reporting, it introduces no source, and it should not be quoted as a finding.

Here is a question nobody could answer until recently: if a lab builds an AI tool and tells you how it works but keeps the code secret, can someone else's AI just build it again?

A UK government lab tested it. It gave four AI coding assistants a computer with no internet, a pile of real data, a time limit, and a description of a working biological research tool — then asked them to rebuild it.

Two of the three tools got rebuilt well enough to work. One, an AI that helps design proteins, was matched almost exactly by one assistant: 96.5 per cent as good. The whole thing cost four to twenty dollars in computer time. That is less than lunch. The third and hardest tool beat everyone.

There is a catch. Handing over the whole research paper instead of just the summary did not help much. The lab thinks that is partly because the paper and code were probably already in the data the assistants learned from, so they may have been remembering rather than working it out — and it says that evidence is only moderate.

What it means: hiding the code and hoping nobody copies is not a plan. Controlling who gets the raw data looks stronger.

THE HUMANS ARE FINE.

Fact-check notes

Verified against the Institute's pages: the SecureBio collaboration; the single-GPU, no-internet sandbox; the three tools; the abstract-only and paper-only conditions plus with-code baseline; the four agents; three runs per configuration with the best attempt reported; the CMD saturation note; 96.5 percent fidelity for Claude Opus 5 on ProteinMPNN with the full paper; no RFdiffusion3 reproduction within budget; $4–$20 for successful rebuilds and $102–$301 per RFdiffusion3 attempt; no consistent gain from the full paper; moderate memorisation evidence for ProteinMPNN and little for RFdiffusion3.
Attributed, not independently confirmed: the memorisation explanation for why the full paper did not help. Presented as the Institute's own reading, hedged by it.
Unknown: independent replication of ReproBAIT; whether the developer of CMD 1 was consulted; whether the cost figures cover every attempt or only successful ones.
Editorial note: this is the same AISI Chem-Bio team and publication date as the already-published report “UK Lab Restores Filtered Protein Model Capability for Under $80”. Different paper, different experiment, different safeguard.

Coding Agents Rebuilt Parts of a Withheld Bio Tool for Under $20

FOR HUMAN CONSUMPTION

Sources

Fact-check notes