CBRN

CBRN is an abbreviation made up of four words. It stands for chemical, biological, radiological, and nuclear. It refers to the four types of weapons that can kill very large numbers of people in a single strike: poison gas, disease-causing pathogens, radioactive material, and atomic bombs. In earlier times, people often used the term WMD (weapons of mass destruction) more broadly, but today the CBRN abbreviation has become the standard. The term appears in news about artificial intelligence because companies are checking whether their programs could help in the production of such weapons.

Why exactly these four categories are grouped together

The four types of weapons have little to do with one another technically. A nerve agent is produced in a completely different way than an atomic bomb. They are grouped together because of their effects: they strike indiscriminately, act over large areas, and can hardly be undone. That is why they are internationally classified as weapons of mass destruction and are banned or strictly limited by dedicated treaties.

For the AI industry, this category matters for a practical reason. Once damage is large enough, it no longer helps to fix it after the fact. Most errors made by AI systems are different: a wrong translation or a fabricated quote can be corrected. A released disease cannot be taken back. That is why safety teams treat CBRN separately from all other risks.

A common misunderstanding is that AI could produce such weapons itself. It cannot. The concern relates to knowledge: a chatbot could explain to an untrained person which steps are necessary. Experts call this lowering the barrier to entry.

How AI companies test for dangerous knowledge

Before a large language model is released, it undergoes safety testing. Part of this is called red teaming: experts deliberately try to coax dangerous answers out of the model. They disguise their questions while doing so, for example as a school assignment or as a researcher’s question. If the model gives in, the test counts as failed.

For CBRN tests, companies work together with government bodies. In the US and the UK there are dedicated AI safety institutes for this purpose. The reason is simple: to judge whether an answer is truly dangerous, you need biologists and chemists. A software developer cannot make that assessment.

If a problem is found, the model is retrained so that it refuses such questions. In addition, filters run over users' requests. Neither measure is perfect. That is why companies set thresholds beyond which a model is not released at all.

CBRN in safety reports and legislation

Anyone reading the publications of OpenAI, Anthropic, or Google DeepMind will find dedicated chapters on CBRN there. These documents are called System Cards or Model Cards. They describe how well a new model performed in such tests. Anthropic, for example, assigns its models safety levels that are oriented precisely around these risks.

Policy also uses the term. The European Union’s AI Act explicitly names CBRN risks as a reason for stricter requirements on very capable models. In the US, there was a presidential executive order with a similar thrust.

For investors and industry observers, this is relevant because such reviews cost time and money. They can delay the release of a model by weeks. At the same time, experts disagree about how great the danger actually is. Some consider it overstated, since the necessary knowledge is available in libraries anyway. Others point out that compiling and explaining this knowledge makes the decisive difference.