October 25, 2026
By Burak Oktenli
Key Takeaways:
By Burak Oktenli
Key Takeaways:
Britain’s £100 million AI Biosecurity Lab and Anthropic’s September 2026 report of five dual-use research cases illustrate that model refusals are incomplete safeguards, because an AI provider sees only a conversation while laboratories and commercial suppliers must assess real-world projects that may lack clear harmful intent.
Existing tools—WHO’s voluntary Biorisk Implementation and Evaluation Tool, the U.S. July policy on high-risk federally supported life-sciences research, and uneven synthetic-DNA screening—address different fragments of the pipeline but leave gaps at institutional, funding and physical-service handoffs, especially for lower-capacity regions.
The article proposes proportionate, project-specific assurance records that establish institutional accountability, authorize physical implementation, and require re-review after material changes, scaled to consequence so that high-risk transitions are controlled without stifling ordinary scientific work.
Britain’s new biosecurity investment exposes a global gap: model safeguards cannot by themselves govern what happens when digital research becomes a real-world biological project.
On October 24, Britain announced a £100 million AI Biosecurity Lab, supported by up to £200 million in model and computing credits from OpenAI and Anthropic. The new institution is intended to detect biological threats earlier and accelerate medical countermeasures. It is a serious investment in using powerful artificial intelligence to defend against dangerous biology. The government’s announcement also poses a question that no laboratory or chatbot can answer alone: when AI helps develop a biological research project, who decides whether that project may proceed into the physical world?
AI can help researchers identify promising treatments, analyze complex evidence and develop new scientific hypotheses. The same broad scientific assistance can have dual-use implications. The policy mistake would be to treat either every advanced biology query as a threat or every unblocked AI answer as an adequate authorization to act.
A model refusal is a useful safeguard. It is not a complete biosecurity system. The difficult decisions arise when work moves between an AI provider, a research institution, a commercial biological service and a laboratory. Each participant may see a different fragment of the same project.
What the five cases really show
In its September 2026 threat report, Anthropic described five instances of researchers using its models in ways that could support biological weapons development. It removed associated accounts and updated its safeguards. But the company made two essential qualifications: it did not allege that the scientists intended harm, and the cases did not establish that a biological weapon had been produced.
That distinction is not a technicality. The cases covered different kinds of scientific activity and different levels of AI assistance; some outputs amounted chiefly to clerical help. A generated research document is not a completed experiment, and a computational proposal is not proof of a functioning biological product. Inflating such evidence into a claim of imminent catastrophe would weaken rather than strengthen public policy.
Yet dismissing the cases because harmful intent was not established would miss the other half of the finding. A model provider can recognize concerning patterns while remaining unable to determine the purpose, institutional supervision and subsequent activities of an entire research program. The provider sees a conversation. The laboratory must assess the project. An external service provider may see only an order or a request.
The most important security boundary may therefore sit outside the chat window: the moment an AI-assisted idea becomes a funded program, a physical-service request or an experiment whose consequences require specialist review.
The global gap is between institutions
There are already credible international foundations for addressing that boundary. In August, the World Health Organization introduced its Biorisk Implementation and Evaluation Tool, a voluntary method for countries and institutions to identify gaps and strengthen oversight of dual-use life-sciences research. WHO’s September update framed the challenge as enabling scientific progress while managing both inadvertent and deliberate misuse. Neither document delegates scientific judgment to a language model.
The United States chose another route in July, issuing a new government-wide policy for high-risk life-sciences research that establishes restrictions and independent review for specified federally supported activities. It is not a global rule for all biological science. It does, however, recognize that funding, institutional oversight and accountability matter alongside the content of a research request.
The physical supply chain has its own gaps. In June, the International Biosecurity and Biosafety Initiative for Science reported that synthetic DNA screening commitments are unevenly distributed across the global market, with intermediaries and third-party vendors remaining an important oversight challenge. Screening a transaction is valuable, but a supplier cannot be expected to know everything about a project merely from the material it is asked to provide.
The regional dimension is already visible in Asia. A September 2026 perspective in a WHO regional journal described uneven biosecurity capacity across ASEAN as AI-enabled life sciences advance. Any global standard designed only for wealthy institutions with full-time compliance teams risks leaving the rest of the research ecosystem with obligations it cannot implement.
These are different instruments serving different purposes: a research oversight policy, an institutional self-assessment, and a supplier screening practice. None is a complete substitute for the others. Together they show why biosecurity must follow the authorized activity across organizational boundaries without creating a universal surveillance register of scientific work.
In its September 2026 threat report, Anthropic described five instances of researchers using its models in ways that could support biological weapons development. It removed associated accounts and updated its safeguards. But the company made two essential qualifications: it did not allege that the scientists intended harm, and the cases did not establish that a biological weapon had been produced.
That distinction is not a technicality. The cases covered different kinds of scientific activity and different levels of AI assistance; some outputs amounted chiefly to clerical help. A generated research document is not a completed experiment, and a computational proposal is not proof of a functioning biological product. Inflating such evidence into a claim of imminent catastrophe would weaken rather than strengthen public policy.
Yet dismissing the cases because harmful intent was not established would miss the other half of the finding. A model provider can recognize concerning patterns while remaining unable to determine the purpose, institutional supervision and subsequent activities of an entire research program. The provider sees a conversation. The laboratory must assess the project. An external service provider may see only an order or a request.
The most important security boundary may therefore sit outside the chat window: the moment an AI-assisted idea becomes a funded program, a physical-service request or an experiment whose consequences require specialist review.
The global gap is between institutions
There are already credible international foundations for addressing that boundary. In August, the World Health Organization introduced its Biorisk Implementation and Evaluation Tool, a voluntary method for countries and institutions to identify gaps and strengthen oversight of dual-use life-sciences research. WHO’s September update framed the challenge as enabling scientific progress while managing both inadvertent and deliberate misuse. Neither document delegates scientific judgment to a language model.
The United States chose another route in July, issuing a new government-wide policy for high-risk life-sciences research that establishes restrictions and independent review for specified federally supported activities. It is not a global rule for all biological science. It does, however, recognize that funding, institutional oversight and accountability matter alongside the content of a research request.
The physical supply chain has its own gaps. In June, the International Biosecurity and Biosafety Initiative for Science reported that synthetic DNA screening commitments are unevenly distributed across the global market, with intermediaries and third-party vendors remaining an important oversight challenge. Screening a transaction is valuable, but a supplier cannot be expected to know everything about a project merely from the material it is asked to provide.
The regional dimension is already visible in Asia. A September 2026 perspective in a WHO regional journal described uneven biosecurity capacity across ASEAN as AI-enabled life sciences advance. Any global standard designed only for wealthy institutions with full-time compliance teams risks leaving the rest of the research ecosystem with obligations it cannot implement.
These are different instruments serving different purposes: a research oversight policy, an institutional self-assessment, and a supplier screening practice. None is a complete substitute for the others. Together they show why biosecurity must follow the authorized activity across organizational boundaries without creating a universal surveillance register of scientific work.
Make the consequential handoffs reviewable
The practical answer is a proportionate, project-specific assurance record held by the responsible institution. For ordinary educational questions and low-consequence scientific assistance, intrusive checks would be unjustified. For access to capabilities with potentially serious biological consequences, the record should establish three things: who is accountable for the project, what kind of work has been reviewed, and when a material change requires that review to be reopened.
The first checkpoint is institutional responsibility. An AI provider need not become an international laboratory regulator, but higher-consequence services should have a lawful way to establish whether a qualified organization is supervising the activity. Mere possession of an account or a convincing statement of good intentions is not the same as a competent assessment of research risk.
The second checkpoint is the move toward physical implementation. Where an external service is involved, a narrowly scoped confirmation of authorization may be more useful than exporting an entire confidential research file. Qualified biosafety personnel, not the model that generated a proposal, should make the relevant decision. The service provider should be able to act on an appropriate status without being asked to adjudicate the whole science.
The third checkpoint is change. Permission granted for one stated purpose should not silently cover a materially altered objective, operating arrangement or risk profile. Institutions should define those triggers before a project begins. A valid authorization has a scope and a review history; it is not a permanent exemption from further scrutiny.
This would not require every country to adopt the same legal test or every scientific provider to share customers’ sensitive research data. It would require participating institutions to make limited, risk-relevant assertions intelligible to the parties that rely on them, while preserving local decision-making and the ability to challenge errors.
Security that does not suffocate science
The objection is substantial: additional gates can slow beneficial research, exclude smaller laboratories and produce mistaken suspicions about scientists working on legitimate public-health problems. That would be a policy failure. The safeguards should scale with consequence, offer reasons for restrictions, permit independent review and avoid indefinite blacklisting on the basis of unverified provider assessments.
Information exchange must likewise be disciplined. Institutions may need to report a verified concern to competent authorities or counterpart providers, but speculative alerts should not become permanent reputational judgments. Records should distinguish direct observation, technical assessment and unresolved questions. Privacy, research confidentiality and due process are safety considerations too.
A workable pilot would test whether the proposed process identifies unauthorized high-consequence transitions without blocking ordinary legitimate science. Measure false restrictions and appeal outcomes alongside detection and response. Count the cost of compliance to smaller institutions. Use WHO’s voluntary assessment work and existing institutional committees as a starting point rather than announcing a new global authority whose competence and legitimacy are untested.
Britain’s new lab can help develop defensive scientific capabilities. WHO can support countries building competent review systems. AI companies can improve model safeguards, and biological suppliers can improve screening. Their real test is whether those efforts work together at the moment digital assistance becomes a consequential physical undertaking.
It is not enough for a chatbot to know when to say no. The institutions around it must know who can responsibly say yes, and to what.
Space Needs Consent That Machines Can Enforce – OpEd
.jpg)
October 25, 2026
By Burak Oktenli
Key Takeaways:
Outer Space Treaty rules do not create automatic exclusion zones or permissions, so commercial consent must explicitly limit actions, stages and windows to prevent inspection from becoming unauthorized contact.
Onboard, versioned authorizations checked by flight software, tested through voluntary demonstrations of revoked or mismatched permissions, can make legitimate servicing distinguishable from intrusion without a new treaty.
Satellite inspection, debris removal and servicing depend on the same close-approach technology. A credible space economy needs permission that specifies what a spacecraft may do—and what happens when that permission changes.
A robotic spacecraft closes on another object in orbit. It could be inspecting a damaged satellite, preparing to remove debris or arriving to repair a paying customer’s spacecraft. The navigation problem looks remarkably similar in each case: identify the target, match its motion, approach and perhaps make contact. What the guidance software cannot infer from distance alone is whether the next move is permitted.
That question became harder to ignore this October, when a Russian spacecraft carried out an uninvited series of close maneuvers near a commercial ICEYE radar satellite. Independent observations raised concern but did not establish that an attack or damage had occurred. The episode was not a servicing mission. Its relevance is the ambiguity of proximity: a capability that can support valuable work can also be used to create pressure.
Meanwhile, the cooperative market is growing. In September, the European Space Agency advanced its Phoenix satellite-servicing project. Japan’s Astroscale completed the ADRAS-J inspection campaign in March, after photographing an uncooperative rocket stage; a separate follow-on mission aims to capture and dispose of it. These developments create the same policy challenge from the other side: how can an approaching vehicle prove that its actions remain within the permission granted for a specific mission?
The answer should be a common, machine-enforceable account of orbital consent. Not a new global licence to approach anything, nor a digital signature that magically makes a manoeuvre safe. A defined operational agreement must be translated into limits the vehicle can actually follow—and limitations other parties can meaningfully inspect.
A licence to look is not a licence to touch
International law already supplies important boundaries, but not a universal traffic light for every satellite encounter. Article VIII of the Outer Space Treaty preserves the jurisdiction and control of the state of registry, and ownership does not disappear merely because an object becomes debris. Article VI makes states responsible for national space activities and requires authorization and continuing supervision of private operators. Article IX requires due regard and, in specified circumstances, consultations about potentially harmful interference.
None of those provisions creates a blanket numerical exclusion zone around every satellite, or makes any unannounced approach automatically unlawful. Nor can a commercial contract erase responsibilities under international law. The Liability Convention distinguishes certain surface and aircraft damage from fault-based liability for specified damage to another launching state’s space object in orbit. States, owners, operators and insurers must work within those separate obligations.
That matters most for debris. A defunct spacecraft may present a genuine collision risk without becoming ownerless property. An agreement to inspect it should not silently become permission to grapple it, change its trajectory or destroy it. The same distinction applies to a functioning satellite: a client may authorize photography at an agreed distance without authorizing docking or propellant transfer.
For a commercial operation, therefore, the consent record should name the relevant object and the parties entitled to authorize the service, the specific actions permitted, a defined operating window, the conditions under which the approach can continue and the actions that must stop or be reconsidered if those conditions change. Different stages should carry different authority. A successful first inspection is not an open-ended mandate for the next intervention.
Permission has to reach the flight computer
A signed contract stays on Earth. Decisions during proximity operations are made by flight software operating with uncertain sensors, changing geometry and sometimes delayed communications. The practical test is whether an onboard enforcement mechanism can distinguish the approved manoeuvre from an otherwise feasible but unapproved one.
The spacecraft could carry a versioned authorization specifying its target, permitted operating volume, approach stage, relevant navigation-quality limits and expiry conditions. Its controller would check those conditions against current observations before advancing to a more consequential step. The agreement would also specify how the ground team authenticates an amendment, and how an investigator can later reconstruct the permissions and measurements in force when an action occurred.
This is not a proposal to let the vehicle settle questions of sovereignty or intent. Cryptography can establish that an authorization came from an approved party; it cannot guarantee that a sensor estimate is correct or that the operation is physically safe. Independent guidance, collision-avoidance and safety checks remain necessary. Where a target is unresponsive, prior authorization from the appropriate parties matters more, not less: a dead spacecraft cannot perform a live digital handshake.
Withdrawal is equally important, but “stop immediately” is not a complete safety rule. At a distant standoff point, a safe retreat may be appropriate. In the middle of a capture or docking sequence, an abrupt separation can increase danger. Each approved phase needs a pretested response to lost communications, revoked permission, contradictory measurements and partial failure. A loss of contact must not be reinterpreted as permission to widen the mission.
Well-designed limits should also protect useful autonomy. A service vehicle cannot ask Earth to approve every control pulse. Operators should authorize bounded sequences in advance and reserve a fresh decision for a meaningful expansion of risk, a new target, an unexpected contact or a material change in the planned intervention.
Standards should test authority, not just docking
Industry is not starting from zero. ISO 24330:2022 sets programmatic principles and practices for rendezvous, proximity operations and servicing. This September, the American Institute of Aeronautics and Astronautics opened another public review of a spacecraft fiducial-marker standard, intended to help servicers and clients work with prepared visual interfaces. Those efforts improve the technical and procedural foundations. The next useful layer is a testable link between the approved service and the manoeuvres actually executed.
Space agencies and commercial customers could begin with a small voluntary demonstration. Before launch, they would approve a staged mission authorization shared by the servicer and client teams. During tests, evaluators would introduce an expired permission, a command addressed to the wrong object, an unexpected change in target motion, loss of ground contact and a withdrawal request during a sensitive phase.
Passing the test would mean refusing unapproved escalation while preserving a physically safe response. The review would record missed violations as well as unnecessary aborts, recovery burden and the time needed to recognize a changed condition. A perfect signature with no credible response to an unsafe approach would not count as success.
The international opportunity is concrete. Europe is seeking a commercial market for inspection, life extension and removal while Japan’s planned ADRAS-J2 capture mission connects Japanese development with launch services in Europe. Customers, regulators and insurers could incorporate the same permission-and-revocation tests into demonstration contracts without waiting for a comprehensive new treaty. Participating countries would retain control over their own authorization decisions.
Such a standard would not force a hostile or secretive actor to cooperate. It would, however, give willing operators an observable way to distinguish agreed servicing from behavior outside the stated mission, and provide a clearer record when an incident becomes a diplomatic dispute. Reciprocal notification can make an approach more understandable; notification alone is not consent, and silence should never be treated as authorization to intervene.
Orbit is becoming a workplace as well as a strategic arena. The next challenge is not merely building robots precise enough to get close. It is ensuring that the same robot remains bound to the purpose for which it was invited.
The difference between a repair and an intrusion should not depend only on what an operator says afterward. It should also be visible in what the spacecraft was permitted, and prevented, from doing.
.jpg)
October 25, 2026
By Burak Oktenli
Key Takeaways:
Uninvited Russian maneuvers near an ICEYE satellite and growing cooperative servicing missions highlight the dual-use ambiguity of orbital proximity operations.
Outer Space Treaty rules do not create automatic exclusion zones or permissions, so commercial consent must explicitly limit actions, stages and windows to prevent inspection from becoming unauthorized contact.
Onboard, versioned authorizations checked by flight software, tested through voluntary demonstrations of revoked or mismatched permissions, can make legitimate servicing distinguishable from intrusion without a new treaty.
Satellite inspection, debris removal and servicing depend on the same close-approach technology. A credible space economy needs permission that specifies what a spacecraft may do—and what happens when that permission changes.
A robotic spacecraft closes on another object in orbit. It could be inspecting a damaged satellite, preparing to remove debris or arriving to repair a paying customer’s spacecraft. The navigation problem looks remarkably similar in each case: identify the target, match its motion, approach and perhaps make contact. What the guidance software cannot infer from distance alone is whether the next move is permitted.
That question became harder to ignore this October, when a Russian spacecraft carried out an uninvited series of close maneuvers near a commercial ICEYE radar satellite. Independent observations raised concern but did not establish that an attack or damage had occurred. The episode was not a servicing mission. Its relevance is the ambiguity of proximity: a capability that can support valuable work can also be used to create pressure.
Meanwhile, the cooperative market is growing. In September, the European Space Agency advanced its Phoenix satellite-servicing project. Japan’s Astroscale completed the ADRAS-J inspection campaign in March, after photographing an uncooperative rocket stage; a separate follow-on mission aims to capture and dispose of it. These developments create the same policy challenge from the other side: how can an approaching vehicle prove that its actions remain within the permission granted for a specific mission?
The answer should be a common, machine-enforceable account of orbital consent. Not a new global licence to approach anything, nor a digital signature that magically makes a manoeuvre safe. A defined operational agreement must be translated into limits the vehicle can actually follow—and limitations other parties can meaningfully inspect.
A licence to look is not a licence to touch
International law already supplies important boundaries, but not a universal traffic light for every satellite encounter. Article VIII of the Outer Space Treaty preserves the jurisdiction and control of the state of registry, and ownership does not disappear merely because an object becomes debris. Article VI makes states responsible for national space activities and requires authorization and continuing supervision of private operators. Article IX requires due regard and, in specified circumstances, consultations about potentially harmful interference.
None of those provisions creates a blanket numerical exclusion zone around every satellite, or makes any unannounced approach automatically unlawful. Nor can a commercial contract erase responsibilities under international law. The Liability Convention distinguishes certain surface and aircraft damage from fault-based liability for specified damage to another launching state’s space object in orbit. States, owners, operators and insurers must work within those separate obligations.
That matters most for debris. A defunct spacecraft may present a genuine collision risk without becoming ownerless property. An agreement to inspect it should not silently become permission to grapple it, change its trajectory or destroy it. The same distinction applies to a functioning satellite: a client may authorize photography at an agreed distance without authorizing docking or propellant transfer.
For a commercial operation, therefore, the consent record should name the relevant object and the parties entitled to authorize the service, the specific actions permitted, a defined operating window, the conditions under which the approach can continue and the actions that must stop or be reconsidered if those conditions change. Different stages should carry different authority. A successful first inspection is not an open-ended mandate for the next intervention.
Permission has to reach the flight computer
A signed contract stays on Earth. Decisions during proximity operations are made by flight software operating with uncertain sensors, changing geometry and sometimes delayed communications. The practical test is whether an onboard enforcement mechanism can distinguish the approved manoeuvre from an otherwise feasible but unapproved one.
The spacecraft could carry a versioned authorization specifying its target, permitted operating volume, approach stage, relevant navigation-quality limits and expiry conditions. Its controller would check those conditions against current observations before advancing to a more consequential step. The agreement would also specify how the ground team authenticates an amendment, and how an investigator can later reconstruct the permissions and measurements in force when an action occurred.
This is not a proposal to let the vehicle settle questions of sovereignty or intent. Cryptography can establish that an authorization came from an approved party; it cannot guarantee that a sensor estimate is correct or that the operation is physically safe. Independent guidance, collision-avoidance and safety checks remain necessary. Where a target is unresponsive, prior authorization from the appropriate parties matters more, not less: a dead spacecraft cannot perform a live digital handshake.
Withdrawal is equally important, but “stop immediately” is not a complete safety rule. At a distant standoff point, a safe retreat may be appropriate. In the middle of a capture or docking sequence, an abrupt separation can increase danger. Each approved phase needs a pretested response to lost communications, revoked permission, contradictory measurements and partial failure. A loss of contact must not be reinterpreted as permission to widen the mission.
Well-designed limits should also protect useful autonomy. A service vehicle cannot ask Earth to approve every control pulse. Operators should authorize bounded sequences in advance and reserve a fresh decision for a meaningful expansion of risk, a new target, an unexpected contact or a material change in the planned intervention.
Standards should test authority, not just docking
Industry is not starting from zero. ISO 24330:2022 sets programmatic principles and practices for rendezvous, proximity operations and servicing. This September, the American Institute of Aeronautics and Astronautics opened another public review of a spacecraft fiducial-marker standard, intended to help servicers and clients work with prepared visual interfaces. Those efforts improve the technical and procedural foundations. The next useful layer is a testable link between the approved service and the manoeuvres actually executed.
Space agencies and commercial customers could begin with a small voluntary demonstration. Before launch, they would approve a staged mission authorization shared by the servicer and client teams. During tests, evaluators would introduce an expired permission, a command addressed to the wrong object, an unexpected change in target motion, loss of ground contact and a withdrawal request during a sensitive phase.
Passing the test would mean refusing unapproved escalation while preserving a physically safe response. The review would record missed violations as well as unnecessary aborts, recovery burden and the time needed to recognize a changed condition. A perfect signature with no credible response to an unsafe approach would not count as success.
The international opportunity is concrete. Europe is seeking a commercial market for inspection, life extension and removal while Japan’s planned ADRAS-J2 capture mission connects Japanese development with launch services in Europe. Customers, regulators and insurers could incorporate the same permission-and-revocation tests into demonstration contracts without waiting for a comprehensive new treaty. Participating countries would retain control over their own authorization decisions.
Such a standard would not force a hostile or secretive actor to cooperate. It would, however, give willing operators an observable way to distinguish agreed servicing from behavior outside the stated mission, and provide a clearer record when an incident becomes a diplomatic dispute. Reciprocal notification can make an approach more understandable; notification alone is not consent, and silence should never be treated as authorization to intervene.
Orbit is becoming a workplace as well as a strategic arena. The next challenge is not merely building robots precise enough to get close. It is ensuring that the same robot remains bound to the purpose for which it was invited.
The difference between a repair and an intrusion should not depend only on what an operator says afterward. It should also be visible in what the spacecraft was permitted, and prevented, from doing.
About Burak Oktenli
Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, RealClearDefense, RealClearMarkets, and Geopolitical Monitor. He is the author of Authority Architectures for Autonomous Systems, a ten-volume series on how authority in autonomous systems is delegated, monitored and recovered, at authority-architecture.me.
View all posts by Burak Oktenli →
