Chemistry × AI × Global Security
When the AI Meant to Save Lives Designed a Weapon Instead
A chemist's complete guide to the Urbina et al. study — nerve agents, generative AI, and the treaty that governs it all
"We were trying to think about what a malicious actor could do with these tools. What we found was more alarming than we expected." — Fabio Urbina, Senior Scientist, Collaborations Pharmaceuticals (2022)
Introduction: A Thought Experiment That Became a Warning
In early 2022, a small team of researchers at a pharmaceutical AI company received an unusual invitation. A Swiss government security conference wanted to explore a simple but terrifying question: Can the same artificial intelligence we use to discover life-saving drugs also be used to design chemical weapons?
The team ran an experiment. By the next morning, they had their answer — and it changed the way the world thinks about AI in chemistry.
Their paper, Dual use of artificial-intelligence-powered drug discovery (Urbina, Lentzos, Invernizzi & Ekins, Nature Machine Intelligence, 2022), generated 40,000 potentially lethal novel molecules — including compounds structurally similar to VX, one of the deadliest nerve agents ever synthesised — in under six hours, on a 2015 MacBook laptop, using only publicly available data.
This blog breaks down everything you need to understand about this story: the chemistry of nerve agents, how generative AI models actually work, and the international legal framework designed to prevent exactly this kind of threat.
Part 1: The Chemistry of Nerve Agents — From the Ground Up
What is a nerve agent?
A nerve agent is a synthetic chemical weapon that disrupts the normal signalling between nerves and muscles. The result is a catastrophic loss of control over bodily functions — and at sufficient doses, death.
All classical nerve agents belong to a family of chemicals called organophosphates (OPs) — compounds containing a phosphorus atom bonded to carbon-containing (organic) groups. Organophosphates were first synthesised in the early 20th century, initially as insecticides. Researchers discovered that their insecticidal activity worked by inhibiting a critical enzyme — the same enzyme found in humans. This discovery, in the 1930s, led directly to the development of nerve agents as weapons during World War II.
The enzyme at the centre: Acetylcholinesterase (AChE)
When your brain wants your hand to move, it sends an electrical signal down a nerve. At the neuromuscular junction, the nerve releases acetylcholine (ACh), which binds to muscle receptors and causes contraction. AChE then immediately breaks down ACh so the muscle can relax:
Acetylcholine + H₂O → Choline + Acetic acid
(AChE)
This happens thousands of times per second. Without AChE, the entire neuromuscular system collapses.
How organophosphates inhibit AChE
AChE has an active site with a key serine residue (Ser-203 in human AChE). Organophosphate nerve agents enter the bloodstream, travel to this site, and form a covalent bond with the serine via phosphylation — effectively gluing the enzyme shut:
AChE–Ser–OH + Nerve Agent → AChE–Ser–O–P(=O)(OR)R' + Leaving group
With AChE blocked, acetylcholine accumulates at all cholinergic junctions. The classic SLUDGE symptoms appear (Salivation, Lacrimation, Urination, Defecation, GI distress, Emesis), followed by muscle paralysis and — critically — failure of the respiratory muscles. Death occurs through respiratory failure.
If oximes (e.g. pralidoxime/2-PAM) are administered quickly, AChE can sometimes be reactivated by breaking the phosphylated bond. But if the agent remains bound too long, the enzyme undergoes aging — a dealkylation that makes the bond permanent. Once aging occurs, oximes no longer work. Recovery requires slow synthesis of new AChE molecules over several weeks.
The treatment protocol is: Atropine (symptom management) + Oximes (pre-aging AChE reactivation) + Benzodiazepines (seizure control).
VX specifically — why it is the benchmark
VX (O-ethyl S-[2-(diisopropylamino)ethyl] methylphosphonothioate) was developed in the UK in the 1950s. It is classified as a CWC Schedule 1 substance — virtually no legitimate civilian application. What makes VX uniquely lethal:
- Extreme potency: Lethal skin dose ~10 mg for an adult — less than a drop of water
- Persistence: An oily liquid with low volatility; can remain active on surfaces for days to weeks
- Fast aging: Reduces the window for effective oxime treatment
- Multiple exposure routes: Skin absorption, inhalation, and ingestion are all lethal
Part 2: Generative AI in Drug Discovery — How It Actually Works
SMILES notation — turning molecules into text
Before training AI on molecules, you need to represent them as data. The most widely used system is SMILES (Simplified Molecular Input Line Entry System), which converts 3D chemical structures into text strings:
Water (H₂O): O Ethanol: CCO Benzene: c1ccccc1 Aspirin: CC(=O)Oc1ccccc1C(=O)O
This means molecules can be treated exactly like text — and the same AI architectures that power language models can be applied directly to molecular generation.
The five main types of generative AI used in molecular design
- Recurrent Neural Networks (RNNs) — Process SMILES strings character by character, learning the "grammar" of chemistry and generating new molecules like a text autocomplete
- Variational Autoencoders (VAEs) — Encode molecules as points in a "latent space," allowing rational design by navigating between known molecules
- Generative Adversarial Networks (GANs) — Pit a generator (creates fake molecules) against a discriminator (spots fakes), training each other until the generator produces indistinguishable molecules
- Transformer Models — The same architecture as ChatGPT, predicting the next atom/bond token instead of the next word
- Reinforcement Learning (RL) — Generates molecules, scores them on a property of interest, and iterates toward molecules that optimise that property
The reward function: the most dangerous line of code
In normal drug discovery AI, the system is rewarded for:
Urbina et al. changed it to:
That single inversion — converting the toxicity penalty into a toxicity reward — transformed a medicine-finding tool into a weapon-design engine. Using the rat acute oral toxicity LD₅₀ dataset, the model was explicitly directed to generate molecules more lethal per unit dose than VX itself.
By morning: 40,000 candidates. The top 2,000 clustered around VX in chemical space. Several were predicted to be more toxic than VX. And critically, the AI also generated several known chemical warfare agents it had not been specifically trained on — demonstrating genuine exploration of novel toxic chemical space.
- Accessibility: Public datasets, open-source tools, a consumer laptop — not a nation-state capability, but graduate-student capability
- Speed: 6 hours vs. months of conventional computational toxicology
- Novelty: Genuinely new molecules not in any existing database — and not covered by existing chemical weapons regulations, because they have never been explicitly identified before
Part 3: The Chemical Weapons Convention
The Chemical Weapons Convention (CWC) — formally, the Convention on the Prohibition of the Development, Production, Stockpiling and Use of Chemical Weapons and on their Destruction — is the most comprehensive disarmament treaty in history.
| Detail | Information |
|---|---|
| Drafted | 3 September 1992, Geneva |
| Entered into force | 29 April 1997 |
| State parties | 193 countries |
| Implementing body | OPCW, The Hague, Netherlands |
| OPCW Nobel Prize | 2013 (Peace) |
India and the CWC
India was an original CWC signatory (14 January 1993, Paris) and ratified in September 1996. India's domestic implementing legislation is the Chemical Weapons Convention Act, 2000, administered by the National Authority Chemical Weapons Convention (NACWC) under the Cabinet Secretariat.
The Three Schedules
| Schedule | Restriction level | Examples | Key limit |
|---|---|---|---|
| Schedule 1 | Highest — virtually no legitimate use | VX, sarin, soman, tabun, mustard gas, Novichok | Max 1 tonne/country; any production >100 g/year declared to OPCW |
| Schedule 2 | Significant — limited civilian uses | Thiodiglycol, BZ (amiton) | Declared; cannot be exported to non-CWC states |
| Schedule 3 | Moderate — large commercial uses | Phosgene, hydrogen cyanide, triethanolamine | End-use certificate required for export to non-members |
The gap the Urbina study exposed
The CWC's scheduling system was designed in the 1990s around known chemistry. The 40,000 AI-generated molecules are novel — many are not listed on any schedule. Under existing CWC language, they may not technically be prohibited. While the CWC does include a broad "general purpose criterion" covering any chemical that can cause death through its action on life processes, enforcement against a theoretical molecule on a laptop is a fundamentally different challenge than enforcement against a known stockpile.
Part 4: The Dual-Use Dilemma — Chemistry's Oldest Problem, Now Accelerated
This tension has existed since Fritz Haber invented the Haber-Bosch process (feeding over 3 billion people) and also supervised the first large-scale chlorine gas attack at Ypres in 1915. Alfred Nobel invented dynamite for safer mining — and spent the rest of his life tormented by its military use, endowing the Nobel Prizes to honour those who "conferred the greatest benefit to humankind." Organophosphate chemistry was developed for agriculture; the same molecular mechanism that kills crop pests was engineered into sarin and VX.
What generative AI has changed is the speed and accessibility at which this duality can be explored:
Before generative AI
- PhD in medicinal or computational chemistry
- Years of domain expertise in toxicology
- Expensive proprietary databases and software
- Months or years of work
After generative AI
- Working knowledge of Python
- Publicly available datasets and open-source tools
- A consumer laptop
- One overnight run
The synthesis barrier remains meaningful — actually producing these molecules still requires controlled precursor chemicals, specialised laboratory equipment, and genuine synthetic chemistry expertise. But the window between "I have an idea for a toxic molecule" and "I have a computational prediction of 40,000 toxic molecules" has shrunk from years to hours.
What the paper actually recommended
The Urbina et al. paper was an alarm call, not a blueprint. The researchers published responsibly — without synthesis routes or complete molecular structures — and briefed the White House Office of Science and Technology Policy. Their recommendations:
- The AI and chemistry communities must actively engage with dual-use risk — it cannot be left to security policymakers alone
- Codes of ethics of both chemical societies and computer science societies need strengthening
- AI model builders and toxicity data curators must be in active dialogue about misuse risks
- Governance frameworks must be developed proactively, not reactively
Conclusion: Chemistry Has Always Had Two Faces
The Urbina study is not a story about AI being dangerous. It is a story about chemistry being powerful — and about the responsibility that comes with wielding that power. The dual-use problem has existed since Haber, since Nobel, since the first chemist noticed that an insecticide and a nerve agent share the same mechanism. What AI has changed is the speed and accessibility at which this duality can be explored.
As chemists — whether we work in pharmaceutical research, industrial formulation, nanomaterials, or textile chemistry — we are now stakeholders in this conversation in a way we were not before. The tools of modern AI-assisted chemistry are entering our laboratories and our workflows. With them comes a responsibility that our predecessors never had to navigate at this scale.
The question is not whether chemistry will be used for both good and ill. History has already answered that. The question is whether the chemistry community will be at the table when the governance decisions are made — or whether we will arrive after the fact, to deal with the consequences.
Quick Reference: Key Facts
| Topic | Key Fact |
|---|---|
| Paper | Urbina F, Lentzos F, Invernizzi C, Ekins S. Nature Machine Intelligence, 2022 |
| AI tool used | MegaSyn (Collaborations Pharmaceuticals) |
| Molecules generated | 40,000 novel potentially toxic molecules |
| Time taken | Under 6 hours |
| Hardware | 2015 Apple MacBook |
| Reference nerve agent | VX (O-ethyl S-[2-(diisopropylamino)ethyl] methylphosphonothioate) |
| VX lethal dose (skin) | ~10 mg for an adult human |
| VX classification | CWC Schedule 1 substance |
| Mechanism of action | Irreversible AChE inhibition via serine phosphylation |
| Antidotes | Atropine + oximes (before aging) + benzodiazepines |
| CWC entry into force | 29 April 1997 |
| CWC state parties | 193 |
| OPCW headquarters | The Hague, Netherlands |
| OPCW Nobel Prize | 2013 (Peace) |
| India signed CWC | 14 January 1993, Paris |
| India's domestic law | Chemical Weapons Convention Act, 2000 |
| India's national body | NACWC — Cabinet Secretariat |
| Schedule 1 examples | VX, sarin, soman, tabun, mustard gas, Novichok |
| Schedule 2 examples | Thiodiglycol, BZ (amiton) |
| Schedule 3 examples | Phosgene, hydrogen cyanide, triethanolamine |
| SMILES | Simplified Molecular Input Line Entry System |
| Dual-use concept | Same science can serve both beneficial and harmful purposes |
1. Urbina F, Lentzos F, Invernizzi C, Ekins S. Dual use of artificial-intelligence-powered drug discovery. Nature Machine Intelligence. 2022;4(3):189–191.
2. Aroniadou-Anderjaska V et al. Mechanisms of Organophosphate Toxicity and the Role of Acetylcholinesterase Inhibition. Toxics. 2023;11(10):866.
3. Chemical Weapons Convention. Organisation for the Prohibition of Chemical Weapons. opcw.org
4. Chemical Weapons Convention Act, 2000. Government of India.
5. IUPAC Top Ten Emerging Technologies in Chemistry 2025. Chemistry International. October–December 2025.
