CBRN Weapons

CBRN is an abbreviation from English. It stands for chemical, biological, radiological, and nuclear. It refers to four types of weapons that can kill or injure very large numbers of people in a single strike. Chemical weapons act through toxic substances such as nerve agents. Biological weapons use pathogens, meaning viruses or bacteria. Radiological weapons disperse radioactive material, for example using an ordinary explosive charge. Nuclear weapons are atomic bombs, in which energy is released from the nucleus of atoms. In German, people used to say ABC-Waffen (ABC weapons), but today the international acronym CBRN has become the standard.

The red line of AI safety

The term appears on a tech site because it shows up in almost every safety report from major AI companies. Companies like OpenAI, Anthropic, or Google check before every release whether their new model could help build such weapons. This check is considered the toughest hurdle of all. Other risks are weighed against each other, but here there is a clear limit.

The reason is the scale of the potential harm. A chatbot that helps with fraud causes damage that can be repaired. A pathogen that escapes from a lab cannot be recalled. Experts therefore speak of an irreversible risk, meaning harm that cannot be undone.

Biological weapons are of particular concern. Building an atomic bomb requires enriched uranium, huge facilities, and years of work. That knowledge is useless without the material. With pathogens, it’s different: laboratory equipment has become comparatively cheap, and for a long time the bottleneck was expert knowledge. It is precisely this bottleneck that AI could shrink.

How models are tested for weapons knowledge

Protection consists of several layers. Even at the training data stage, certain texts are filtered out, such as detailed synthesis instructions for toxic substances. After that, the model is trained to refuse such questions. In addition, filters run alongside that check requests and responses in real time and block them if suspicious.

Before release comes so-called red teaming. In this process, a team deliberately attacks its own model and tries to get around the safeguards. External experts are often involved, such as biologists or government agencies. They ask the kinds of questions a real attacker would ask and document every answer that goes too far.

The decisive question here is not: Does the model know something dangerous? Much of it is already in textbooks. The question is whether the model gives a layperson a genuine advantage. Experts call this uplift. A model that organizes steps, corrects mistakes, and answers follow-up questions may well replace years of training. It is exactly this difference that gets measured.

CBRN in laws and company reports

In everyday life, you mostly encounter CBRN in reports about new AI models. Almost every major release is accompanied by a safety card, a document containing the test results. It states which risk level the model was assigned to. Anthropic uses levels called ASL for this, while OpenAI has a similar system with categories ranging from low to critical.

Politics also uses the acronym. The European Union’s AI Act explicitly names CBRN risks as a danger that providers of large models must assess. In the US, government requirements demanded safety tests before especially capable models could be released. Anyone reading reports about AI regulation will therefore regularly come across the acronym.

A common misconception is that AI could build an atomic bomb. It cannot, because software doesn’t supply uranium or centrifuges. Another point is more contested: some researchers consider the current benefit to attackers to be small, since the internet and specialist literature already contain a great deal. Others point out that the models improve every year. Because a single mistake here would be irreversible, companies still test cautiously as a precaution.