ReproBAIT: Can coding agents build their own biological AI tools?

About the project

I worked on ReproBAIT at the UK AI Security Institute in collaboration with SecureBio. We investigated whether keeping a tool’s code and model weights private is sufficient to control access to its capabilities as coding agents improve.

We tasked agents with implementing and training biological AI tools without internet access, using supplied training data and fixed time and compute budgets. We varied the information available, from an abstract to a full paper, and measured the resulting models’ performance on held-out data.

My contribution

I rebuilt most of ReproBAIT’s evaluation framework, moving from a prototype running on a single EC2 instance to a sandboxed evaluation system. I designed and implemented the sandboxing infrastructure, sourced the training data and set up the RFdiffusion3 evaluation, and extensively refactored the ProteinMPNN evaluation pipeline.

Findings and impact

Agents reproduced selected capabilities of some tools, while the most complex tool remained beyond their reach within our experimental setup. These findings suggest that withholding code and weights alone may not preserve control over capabilities when agents have access to published descriptions and training resources.

ReproBAIT was used in external evaluations reported in OpenAI’s GPT-6 Astra and GPT-5.6 system cards.