AI chatbots bypassed to answer bioweapon queries with attack success rates hitting 88%

Cisco Exposes Critical Vulnerabilities in AI Chatbots

Researchers at Cisco successfully bypassed AI model safeguards on ChatGPT, Claude, and Gemini within just five conversational turns, according to a Wall Street Journal investigation 2

2

. The team tested 15 models from OpenAI, Anthropic, Google, Amazon, and xAI, achieving attack success rates ranging from 8% to 88% 2

2

. Amy Chang, Cisco's head of AI threat and security research, told the Journal that no model can be completely protected from a sufficiently persistent user who attempts to manipulate AI chatbots through gradual conversational steering 3

3

.

Hundreds Asked ChatGPT to Create Poisons and Bioweapons

The problem extends far beyond controlled security tests. Last summer, hundreds of users globally asked ChatGPT about how to create poisons and bioweapons after OpenAI upgraded the model's capabilities, according to current and former employees at major AI labs 1

1

. Biology and terrorism experts who reviewed these exchanges judged some as deadly accurate, said people familiar with the matter 1

1

. The instructions were reportedly delivered patiently at a high school student skill level 1

1

. OpenAI banned the accounts involved but did not notify authorities unless queries were deemed credible, real-world dangers 1

1

.

GPT-5 Rated High Risk for Biological Threats

By 2024, internal testing at OpenAI showed that extended questioning could persuade ChatGPT to provide increasingly dangerous biological guidance through adversarial prompting 3

3

. Employees predicted capabilities could reach a point where someone with limited biology training could receive meaningful assistance 2

2

. OpenAI rated GPT-5 and its latest GPT-5.6 family as "High" for biological and chemical risk under its Preparedness Framework and deployed additional safeguards 2

2

. The company said at launch it lacked definitive evidence that GPT-5 could enable a novice to cause severe biological harm 3

3

.

The Dual-Use Potential Dilemma Facing Frontier Models

AI companies face a structural challenge that cannot be easily solved. The same biological knowledge that creates weaponization risk is essential for legitimate research into medicines, vaccines, and treatments 3

3

. OpenAI executives have been reluctant to make models refuse large numbers of biology questions because public-health workers and drug-discovery researchers rely on them 3

3

. Anthropic encountered the opposite problem when Claude's restrictions blocked CDC researchers working with pathogen information during a hantavirus outbreak 2

2

. Making models refuse biological questions protects against AI model misuse but cripples legitimate research, while making them helpful to scientists makes them helpful to bad actors too 2

2

.

Long-Term Implications for Biological Risks

The concern extends beyond current frontier models to future iterations. Proprietary models may eventually give rise to secretly distilled, non-frontier open-weight versions that can run on any sufficiently powerful machine 1

1

. Techniques exist to modify models such that refusal behavior is removed, meaning any information in the model can be coaxed out 1

1

. Scary frontier AI models that alarm the federal government in 2026 could mutate into uncensored versions accessible to those who know where to look within two years 1

1

. OpenAI now uses model-level training, account enforcement, and additional safety checks for sensitive bioweapon queries, though Cisco's finding that five turns is enough to crack guardrails means the gap between intended and actual behavior is measured in sentences, not engineering cycles 2

2

. The White House launched Gold Eagle to coordinate AI-powered cyber defence, but no equivalent program exists for cyber and biological domains 2

2

. Watch for how AI companies balance blocking harmful requests while enabling scientific progress as models grow more capable.