Por décadas, las organizaciones terroristas operando aisladamente tenían limitaciones para fabricar ciertas Armas Químicas como el SARÍN, debido a los rigurosos sistemas de control acordados globalmente, sobre los precursores químicos que se requieren para la obtención del producto final. El empleo de IA y sistemas computacionales disponibles comercialmente, permitirían vulnerar las barreras establecidas por los mecanismos de control, para fabricar “DIY” (Hecho por usted mismo) análogos del SARÍN, que se asemejen a la estructura molecular final del citado agente nervioso. Ya en 2022, los investigadores demostraron que funciones de optimización del software de Machine Learning (ML), permitían diseñar análogos tóxicos del agente nervioso VX. Una señal de alerta para los Organismos de control internacionales, acerca de la amenaza oculta y al alcance de elementos marginales y terroristas, para el empleo de estas sofisticadas pero disponibles herramientas tecnológicas.
For more than two decades, lone actors with weapons of mass destruction ambitions have relied on crude toxins like ricin and amatoxins because plants like castor beans and mushrooms that contain these poisons fly under the export control radar. Law enforcement has uncovered more than a dozen plots to synthesize and use ricin. In contrast, there haven’t been any publicly documented amateur sarin or other nerve agent production attempts, not for lack of chemistry know-how but because Schedule 1 chemical precursors (substances that can be used to make weapons) are policed, flagged, and scarce. Acquiring these precursors even for peaceful research could only be done within official, institutional settings.
For those contemplating mass casualties, biotoxins like ricin are easy to produce. But delivering them effectively is difficult, requiring specialized techniques like aerosolization. Conversely for chemical warfare agents like sarin, synthesis (because of restricted precursors) has traditionally been the hard part, even if delivering them does not require specialized methods.
However, that balance is tipping because of advances in artificial intelligence. Generative AI and off-the-shelf computational tools are collapsing the precursor barrier, making DIY sarin analogs (compounds that resemble the molecular structure of sarin) as attractive as castor-bean mash for rogue individuals. These applications can make the synthesis and use of nerve agents for nefarious purposes marginally but consequentially more probable.
By enabling three-dimensional similarity searches, AI-guided planning of chemical synthesis routes, and predictions of how chemical warfare agents work in the body at a molecular level and at massive scale, these tools can identify unlisted but functionally equivalent precursors and products. Combined with large language model-based prompt engineering, today’s technologies can lower the obstacles to designing novel agents. Current regulatory barriers—including lists that categorize harmful substances—are not designed for this fast-moving frontier. Unless regulatory bodies evolve into adaptive systems that model the effects and not just the molecular structures of these compounds, the static lists of these organizations will lag dangerously behind technological advances. Those regulatory organizations can use AI, which is the instrument leading humans into this threat to begin with, to counter it.
Bypassing restrictions. There are several ways in which people could use AI and computational chemistry to bypass or creatively get around current control mechanisms. For instance, in 2022 researchers showed that machine learning software optimization functions that penalized certain toxic properties of molecules could instead reward the design of toxic analogs of the nerve agent VX. The software found over 40,000 analogs; assuredly more than a few of these would not appear on current scheduled lists and would be as or more toxic than VX.
During the last few years, there has been another significant development, namely AI-guided retrosynthesis. This computational technique uses AI to break down a target molecule into its building blocks. It can then suggest a synthetic route—complete with reaction conditions and reagents—for assembling these building blocks into the target molecule. Much like there are multiple ways to assemble Lego pieces into a house, these tools provide multiple alternative pathways to a molecule. Retrosynthesis can easily be used to deconstruct the structure of a nerve agent like sarin into unscheduled precursors that are invisible to the Chemical Weapons Convention or chemical supplier checklists.
The Chemical Weapons Convention’s lists of scheduled compounds are static, based on two-dimensional structures and chemical classes. However, computational chemistry techniques can now, at scale, search databases of millions of molecules to find structures that are functionally the same as known chemical warfare agents but belong to novel chemical classes. They do this by finding molecules that resemble the three-dimensional shape and electrostatic features of a molecule rather than its two-dimensional structure. This capability, combined with AI-guided retrosynthesis, can quickly enable lone actors to bypass the Chemical Weapons Convention’s static lists and come up with dozens of new, potentially deadlier compounds.
In addition, docking methods, which model the interactions of molecules with their three-dimensional target proteins, can enable researchers to modify the structure of these molecules to improve their interactions with these proteins and enhance their biological effects. For instance, in 2024 researchers computationally studied the interaction of Novichok agents—which are eight to 10 times more potent than sarin—with acetylcholinesterase (AchE), the enzyme that nerve agents like sarin block. The study shed light on why Novichok agents block AchE better than sarin, but the same insights can be used to design more potent compounds.
Meanwhile, new “co-folding” methods, inspired by the success of the breakthrough protein folding tool AlphaFold, can simultaneously predict both the structure of a nerve agent and its target protein. Such methods could expand the list of both nerve agents and new target proteins.
Better data, better machines. While some of these tools are still in their infancy, better data and greater compute capabilities will ensure that they become more powerful. They also fit a classic dual-use description; they are routinely used in the chemical, pharmaceutical, and agrochemical industries by thousands of researchers to design drugs, pesticides, polymers, and other useful compounds. No major modifications are needed to repurpose these tools to design chemical warfare agents, and because of intellectual property constraints, their vendors will have no insights into their misuse. In addition, the same machine learning techniques that drug developers use to penalize toxic properties of compounds can instead reward these properties.
For instance, drug companies typically deprioritize molecules like TCDD (tetrachlorobenzodioxin) that activate a protein called the aryl hydrocarbon receptor and cause acute toxicity. Instead, these compounds can be prioritized, and their toxicities maximized.
One barrier to using computational chemistry tools for machine learning or three-dimensional similarity searching is that they still live behind institutional guardrails and their vendors subject them to licensing requirements. But the advent of free and web-accessible large language models trained on thousands of papers, patents, and other sources has changed the stakes and taken the threat to a new level. Open-source tools like RDKit—a set of cheminformatics algorithms that includes techniques like similarity searching—are already being incorporated in systems like chatGPT. These developments will enable users to computationally design compounds directly inside large language models with simple natural language prompts, rather than having to write specialized code or access institutional licenses. Often the real barrier to chemical or biological weapons is assumed to be physical access rather than knowledge, but as the example of bypassing restricted precursors demonstrates, the boundary between the two can be porous.
In an instance of what’s called the “mosaic theory” in national security and legal circles, seemingly innocuous, dual-use queries can build up to an aggregate picture that provides relatively easy access to methods of synthesizing dangerous compounds. Users can retrieve equipment and safety protocols needed for these syntheses through large language models; they can scour online sources selling used equipment and conveniently assemble them in one place; they can update historical experimental protocols with modern data. Virtually anyone can acquire information about assays, purification techniques, and animal models. Current large language models include guardrails that prevent the easy acquisition of dangerous information, but often the difference between having and not having such information is a matter of clever prompt engineering and dual-use queries refined by trial-and-error.
As the models evolve, are trained on even more data, and are taught to recognize subtle patterns, including ones embedded in tacit knowledge, there is little doubt that the obstacles will be eased further.
Outpaced by innovation. The common problem in confronting this brave new world is the slow-moving nature of static prohibited-compound lists created by the Chemical Weapons Convention schedule and enforced by the Organization for the Prohibition of Chemical Weapons. These lists are deliberately and carefully updated through international consensus, often when there’s already some evidence of harm. As an example, even in the pre-AI world, it took 27 months from the first use of the novel nerve agent Novichok to its registration on the Chemical Weapons Convention schedule. To be fair, the Organization for the Prohibition of Chemical Weapons has realized the problem, and its 2023 and 2025 reports discussed how machine learning and other computational techniques can now predict the toxicities of unsynthesized novel molecules. This year the organization has also teamed up with four academic institutions to explore potential AI-enabled chemical warfare agent predictions.
But the AI field is moving extraordinarily fast, making it hard for the regulatory regime to keep track of all developments; for instance, both the 2022 VX analog study and the 2023 Organization for the Prohibition of Chemical Weapons report either predate or don’t mention large language models, while there is a single mention of such models in the 2025 Organization for the Prohibition of Chemical Weapons report. To meet the challenge of chemical warfare agents in the age of AI, the Chemical Weapons Convention and Organization for the Prohibition of Chemical Weapons and other supplier and regulatory lists should function as active research repositories that create evolving, living lists. These organizations need to beat the emerging technological confluence of AI and chemistry at its own game, incorporating AI tools in their own evaluation of emerging threats. Here are a few ways in which the existing regulatory regimes can be supplemented:
- Better precursor tracking: AI-guided retrosynthesis software can provide a list of synthetic pathways different from the standard pathways relying on scheduled and restricted precursors. Every new and old chemical warfare agent registered on the list should be accompanied by a set of plausible retrosynthesis pathways, especially ones that flag unscheduled precursors.
- Reduced dependence on static lists of two-dimensional structures: Standard computational tools can provide a list of molecules that may not be like existing chemical warfare agents in their two-dimensional structure but have similar three-dimensional shape or electrostatic similarity translating to similar biological effects. These structures should be included in the lists.
- Enhanced use of machine learning-based activity toxicity prediction: Machine learning and generative AI tools can generate virtual molecules that maximize key toxicities—neurological, hematological, or respiratory. Such models should become a standard part of the toolkit of threat anticipation.
- Better multisource data tracking: The organizations also need to expand the kind of data that would trigger an inquiry. For instance, any compound that has an activity greater than a threshold against acetylcholinesterase would be tagged. Similarly, any data that suggests a response in an assay or animal model similar to a known chemical warfare agent should be curated and analyzed.
Many of these tools would emphasize a “function first” rather than a “structure first” approach, one that evaluates chemical warfare agent threats based on their biological effects rather than their chemical structures. These safeguards should also ensure that they don’t encroach on user privacy and allow legitimate research by scientists, including nonproliferation specialists.
Ultimately, entities like the Organization for the Prohibition of Chemical Weapons and the Chemical Weapons Convention can keep up with new computationally created threats through combined holistic tracking and consolidation of both chemical and biological data. But information tracking is only one aspect of anticipating these threats. The novel and important challenge facing these organizations is to significantly expand their own research activities, staying up to date with the latest computational and AI tools and having both internal and external researchers battle-test these tools to anticipate new chemical warfare agent designs. To do this, these organizations should collaborate with companies developing the latest AI models and perhaps get early access to unrestricted versions to explore frontier capabilities for molecular design.
The AI-enabled lowering of barriers to chemical warfare agent design may not necessarily lead to a proliferation of basement sarin labs that result in mass casualties. But even a small uptick in successful attempts by disgruntled actors might cause a serious disruption in the political and social fabric of a country and—especially in countries with unstable or autocratic regimes—could lead to power grabs and the suspension of civil liberties. But there is a way to thwart such attempts or at least anticipate them. It is by appreciating that ultimately, the best defense against a new, emerging technology is the use of that same technology to counter it. If AI is going to lead us to a new threat environment of chemical weapons, then AI would also be the best way to thwart the misuse of the technology, and humans would be wise to embrace it.
Fuente: https://thebulletin.org
