Who gets to be defended: OpenAI's biodefense model and the geography of access

OpenAI has built a frontier life-sciences model and decided that "qualified organisations and government partners" get to use it. That decision is being described as a safety measure. It is also a distribution decision, and the two are not the same thing. The people most exposed to biological threats are not in the room where the access list is drawn up.

The announcement, published on 29 May, is called Strengthening societal resilience with Rosalind Biodefense.¹ The model is GPT-Rosalind, framed as a frontier reasoning system for biological research, drug discovery, protein engineering and genomics. Access runs through "trusted developers" and named U.S. and allied government partners with approved public health and biodefense missions. OpenAI calls the approach "defensive acceleration."¹

I want to take the framing seriously before I take it apart. The biosecurity community — Johns Hopkins's Center for Health Security, the Nuclear Threat Initiative, Kevin Esvelt's group at MIT — has spent years arguing that broad public access to frontier life-sciences AI is more dangerous than restricted access through auditable channels. On that view, what OpenAI has built is roughly what was asked for. Gated access is a real harm-reduction strategy, not theatre.

So this is not a piece arguing that GPT-Rosalind should be open. It is a piece about who the gate is for.

The category that does the work. "Qualified organisations and government partners" is the operative phrase, and it is doing more work than it looks like. It is a category built by exclusion. To be inside it, an entity must be legible to OpenAI's vetting process and to a U.S.-anchored security architecture. That rules in the U.S. Department of Health and Human Services, the Biomedical Advanced Research and Development Authority, the Defense Advanced Research Projects Agency, the UK Health Security Agency, a handful of allied equivalents, and a small set of well-resourced research institutions. It rules out, by construction, most of the world.

The places where the next pandemic is most likely to begin — regions with weak disease surveillance, under-funded public health systems, and limited diagnostic capacity — are precisely the places least likely to clear a "trusted partner" bar set by a San Francisco company in coordination with the U.S. national-security establishment. The World Health Organization is not named as a partner. African CDC is not named as a partner. The Indonesian or Vietnamese or Bangladeshi public health authorities, whose surveillance work would benefit most from an epidemiological reasoning tool, are not named either. They may yet be. The announcement does not preclude it. It also does not promise it.

Defensive acceleration is a market position. OpenAI did not invent this phrase by accident. It signals safety to regulators and to critics, and it stakes out a first-mover position in a government procurement market that Anthropic is already inside through Project Glasswing and its Mythos cybersecurity model. Frontier labs are no longer competing primarily on consumer chat. They are competing on national-security verticals, biodefense, cyber, intelligence analysis, where the customer is a state and the moat is clearance, not capability.

This is not cynicism. Genuinely defensive and strategically timed are both true at once. But naming the commercial logic matters, because the safety framing keeps doing political work that the commercial framing would not. "We are restricting access to protect humanity" reads differently from "we are restricting access to build a defensible position in the federal procurement market." Both sentences describe the same architecture.

The vetting is the part we cannot see. The announcement describes safeguards on access pathways. It does not specify what those safeguards are, who audits them, what the criteria for "trusted developer" status look like in practice, or what recourse exists when access is denied. The 2011 H5N1 gain-of-function controversy, and more recently the 2023–24 wave of biosecurity work on large language models and pathogen synthesis, established that the gap between "we have safeguards" and "here is what they are" is where the policy argument actually lives.²

OpenAI is not unique here. NIH, BARDA and DARPA have run gated access to sensitive research tools for decades, and the U.S. Select Agent Program offers a workable analogy for what adequate biosecurity access control looks like: published criteria, independent inspection, statutory backing, congressional oversight.³ None of that infrastructure currently applies to a private lab's decision about who can use its model. The federal government can be a customer of GPT-Rosalind without being the regulator of GPT-Rosalind. That is the gap.

The dependency runs both ways. When a frontier lab builds its distribution architecture around state partners, it gains regulatory goodwill and a procurement channel. The state gains leverage over the lab's operational perimeter, including, eventually, over which non-U.S. partners get added to the trusted list. This is a power arrangement before it is a safety arrangement. It does not become less of a power arrangement because the underlying intent is good.

For a non-aligned state, or for a country whose relationship with Washington shifts across administrations, the access list is a foreign-policy instrument whether OpenAI intends it as one or not. A Brazilian public health agency's access to a defensive biological-preparedness model now depends, in part, on the Brazilian government's standing with the U.S. security establishment. That is a strange way to organise pandemic preparedness for a planet.

What to watch. Three things, concretely. First, whether OpenAI publishes the vetting criteria, or whether "trusted partner" remains a black-box determination. Second, which non-U.S., non-allied institutions appear on the access list in the next twelve months — particularly WHO, Africa CDC, and major South and Southeast Asian public health bodies. Third, whether any independent body, congressional, academic, or international, gains audit rights over the access decisions. Without those three, "defensive acceleration" describes a capability that is defensive for some populations and unavailable to others.

The benefit of GPT-Rosalind, if the capability is real, is the kind of thing that ought to be globally distributed, because pathogens are. The architecture OpenAI has built does not distribute it globally. It distributes it along an axis that the biosecurity community has not, to my knowledge, argued is the right axis. The argument was for gated access. The argument was not for this particular gate.

I do not think OpenAI is acting in bad faith here. I think the company has made a defensible safety choice and a strategically convenient distribution choice and is presenting them as a single decision. They are not a single decision. Naming them separately is the beginning of being able to argue about either one.

Footnotes

¶