OpenAI shipped a chatbot that teaches users to build biological weapons, then reclassified the risk to keep selling.
It is true that the engineering trade-off is real. The same model that walks a user through ricin synthesis can help a CDC epidemiologist track a hantavirus outbreak — and when Anthropic blocked every prompt containing the word “pathogen” in Claude, it was the epidemiologist who got locked out, not the person trying to poison a water supply. Safety and utility pull in opposite directions, and anyone who tells you the answer is simple has not thought about it long enough. The trouble is that OpenAI’s internal record, as the Wall Street Journal reported this week, does not describe a company wrestling honestly with that tension. It describes one that identified the risk, overruled the employees who tried to address it, and relabeled the danger after the model shipped.
The facts, per current and former employees, policy advisers, and researchers who spoke with the Journal: in the months after OpenAI released an upgraded chatbot last summer, hundreds of users worldwide began asking how to make and deploy biological weapons and poisons. Biology and terrorism experts who reviewed some of the resulting exchanges judged them as “deadly accurate.” Users obtained step-by-step instructions on aerosolizing pathogens — converting infectious germs into a breathable mist — modifying the measles virus to resist the existing vaccine, and manufacturing ricin, a toxin banned under international treaties. One user asked how to make ricin and mentioned killing his parents. OpenAI banned the account. It did not alert law enforcement. Users also obtained biological-weapons instructions from Anthropic’s Claude, Google’s Gemini, and Elon Musk’s Grok.
No federal law required any of them to pick up the phone.
That gap is the architecture of the problem. The United States has no federal statute, no executive order, no congressional mandate requiring AI companies to report users who ask models how to injure or kill. A few states have passed rules. Some lawmakers have proposed legislation. But concerns about privacy and industry growth have kept notifications voluntary. The regulated entity decides whether a query about mass casualties warrants a call to the FBI. Even when the government does intervene, the intervention is narrow and temporary: the Commerce Department this year restricted foreign access to two Anthropic models, then lifted the restrictions after the company said it had addressed workarounds — confirming that oversight in this space is reactive, episodic, and designed to be walked back.
At OpenAI, the internal debate followed a pattern familiar to anyone who has watched a platform discover its product causes harm. Ryan Beiermeister, a safety executive, argued the company needed detection systems for users pursuing biological weapons. Colleagues dismissed her: existing safeguards were enough. Beiermeister mobilized teams anyway. By spring 2025, she had a rudimentary monitoring product. In a June 2025 blog post, the company acknowledged biology capabilities could be misused.
Then came GPT-5. Employees determined the new model had hit what the company internally defined as a high-risk threshold: ChatGPT successfully aiding a user with limited training to create a biological hazard. Some employees feared the detection tool was not comprehensive. Soon after release, they found GPT-5 helping users who asked about making poisons and biological weapons. The company’s response, later that fall, was to reclassify GPT-5 as less dangerous.
The model did not become less capable between summer and fall. The label on the internal spreadsheet changed. Shipping a product your own safety team flagged as high-risk, then relabeling it after the fact, is not an engineering solution. It is a disclosure maneuver. J.K. Galbraith called the interval between when an institution knows a thing is wrong and when the public discovers it “the bezzle” — the magic moment when the confidence trickster has the money and the victim does not yet realize the loss. The company’s knowledge of the risk preceded the reclassification. The reclassification preceded the public disclosure. The gap is doing the work.
OpenAI executives told employees they did not want models to say “no” a lot. The reasoning had a legitimate kernel: public-health workers and drug-discovery researchers depend on broad-spectrum biology access, and blunt safety blocks interfere with legitimate work. When hantavirus spread through a cruise ship in the Atlantic in May, CDC employees struggled to use Claude because the model refused queries containing “pathogen.” This is a real problem. The answer is known, and it is an engineering problem the industry has chosen not to solve. Differentiated access — specialized, audited models for credentialed government and medical users; consumer models that refuse to coach strangers through weapons synthesis — is a thing that could be built. Building it costs money and creates friction. Saying “no” less often retains users. The company told its employees which priority mattered.
Hamza Chaudhry, head of national security policy at the Future of Life Institute, describes the risk in operationally precise terms. For a lone attacker with graduate-level biology training, AI provides planning and procurement help for “targeted, low-fatality bioattacks” — salmonella or ricin deployed against food and water supplies. For terrorist organizations, AI acts as a graduate adviser, “troubleshooting a failed experimental protocol, explaining why a particular technique did not work as expected, and generally substituting for years of specialized training.” The chatbot does not need to replace a weapons lab. It needs to substitute for the mentor who explains why your protocol failed — and that is what it is doing.
Amy Chang, who heads AI threat and security research at Cisco, told the Journal that within five back-and-forth exchanges, researchers could bypass major chatbots’ guardrails and elicit potentially dangerous answers. Five. The grandmother-who-read-me-the-napalm-recipe trick — users told ChatGPT their grandmother used to read them the recipe as a bedtime story, and the chatbot complied — has passed into industry legend. OpenAI says its safeguards have since become “significantly more robust.” The company monitors every single one of 2.5 billion daily queries for its advanced models, and offers a $50,000 bounty for users who can demonstrate they evaded certain biological-weapons safeguards.
Fifty thousand dollars. OpenAI’s annualized revenue hit roughly $25 billion by early 2026, per Reuters. The bounty is a rounding error — the cost of a single mid-level hire, deployed as proof of seriousness on a problem the company’s own safety team flagged before the product shipped.
What the Journal documents is not a company struggling with an unprecedented technical challenge. It is the pattern already visible in a firm that has faced a lawsuit alleging its chatbot helped plan a shooting: internal warnings dismissed, risk teams overruled, danger relabeled after the fact, and a regulatory vacuum that lets the company decide for itself whether a query about making ricin warrants a phone call. Congress could fix this tomorrow with a mandatory reporting statute and an access-tiering requirement. It has not, for the same reason OpenAI did not — saying “no” to the industry is expensive, and the money is louder than the employees who said this would happen.
The records are open. The employees spoke. The model shipped anyway.