Trusted access: How AI labs unlock sensitive biology models for vetted users only

Trusted access means an AI company gives its most capable or least restricted model only to people and organizations it has checked, while everyone else gets a version with stricter safeguards. It is a response to “dual-use” knowledge, where the same skill can protect people or harm them. Biology is the clearest case.

One biology question, two very different askers

Picture a researcher who builds tests to detect new viruses in wastewater. Her work needs a model that talks frankly about how pathogens spread and evolve. Now picture an anonymous stranger who types the same question into a public chatbot. The words are identical, but the risk is not.

A public model cannot tell them apart from a single message. The simple choice is to refuse both. Trusted access is the other choice: find out who is asking first, then decide what to unlock.

This is an old pattern outside AI. Chemical suppliers, pharmacies and laboratories already sell some materials only to checked buyers. Trusted access applies the same logic to software that answers questions.

Safeguards for everyone, exceptions for the vetted

Most of the idea is a two-layer design. The first layer is a default set of protections applied to every user. The second is a way to relax some of them for vetted users.

Anthropic describes the first layer in its May 2025 post on ASL-3 (AI Safety Level 3) protections, released with Claude Opus 4. It uses “Constitutional Classifiers”: separate models that read inputs and outputs in real time and block a narrow class of harmful chemical, biological, radiological and nuclear (CBRN) content. Anthropic says the target is end-to-end weapons workflows and universal jailbreaks, not ordinary science questions.

The same post, in a footnote, describes the second layer. Access control systems let users with dual-use science and technology applications be vetted to receive targeted exemptions from some classifier actions. The post does not say how the vetting works.

Where the classifier idea came from

The classifier work was published by Anthropic researchers, led by Mrinank Sharma, in a January 2025 arXiv paper titled “Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming”. A “constitution” here is a written list of what content is allowed and what is not. It is used to generate synthetic training data for the classifiers.

The authors report that over 3,000 estimated hours of red teaming (testers trying to break the system) found no universal jailbreak on an early version that matched an unguarded model’s level of detail across most target queries. They also report costs: an absolute 0.38% rise in refusals on production traffic and 23.7% extra inference compute.

That refusal number matters for this topic. Any filter that stops attackers also sometimes stops legitimate scientists. Anthropic itself notes the classifiers may produce false positives. Vetted exemptions are one way to reduce that cost for people who have a real need for the sensitive material.

Who runs trusted access today, including the UK lab

OpenAI launched Rosalind Biodefense on May 29, 2026, according to R&D World. The program sponsors access to GPT-Rosalind, which OpenAI describes as a restricted-access frontier reasoning model for life sciences, for vetted outside developers. Their work covers epidemiological modeling, early detection, screening and non-pharmaceutical interventions such as public-health measures.

A separate government track covers select U.S. and allied partners. Named participants include Lawrence Livermore National Laboratory, Johns Hopkins Applied Physics Laboratory and the Coalition for Epidemic Preparedness Innovations. The report says developers are vetted but does not explain the criteria.

The model also shows up in the UK. As we reported, the UK’s new AI Biosecurity Lab counts trusted access to OpenAI’s most capable relevant models through Rosalind Biodefense as part of OpenAI’s offer. Anthropic’s offer includes trusted model access, and Google DeepMind says it intends to offer trusted access to Gemini and specialized science models.

The announcement does not say what the access tiers allow, so the practical meaning of “trusted” in the UK deal is still unknown.

Limits: Vetting is a judgment call, and power concentrates

Trusted access has real weak points. Vetting can be wrong, and an approved account can be misused or shared. The criteria are mostly unpublished, so outsiders cannot check whether the line sits in the right place.

There is also a fairness question. One commentary cited in coverage of Rosalind Biodefense argued that routing powerful biology capability through a single vendor’s access layer is a risk. That is an opinion, not an established finding. Even so, it points at a real design issue: the company that builds the model also decides who counts as trusted.

Finally, the tiers rest on the labs’ own safety claims. The UK announcement offers no independent verification of what the models can do for biodefense, so the benefits remain the companies’ and government’s framing.

What to watch as the UK lab takes shape

Three things will show whether the approach works. First, whether the labs publish vetting criteria, such as what documents or institutional ties unlock which tier. Second, whether independent testers, such as government institutes, can audit both the restricted and public versions. Third, whether the model credits in the UK deal come with clear rules on how long they last and how they are valued, which the announcement leaves open.

If those details appear, trusted access could become a shared standard across labs. If they do not, it will stay a set of private policies that readers have to take on trust.