In the late 1970s, a Princeton undergraduate named John Aristotle Phillips made headlines by designing an atomic bomb using only publicly available sources for his junior year research project. His goal wasn’t to build a weapon but to prove a point: that the distinction between “classified” and “unclassified” nuclear knowledge was dangerously porous.

The physicist Freeman Dyson agreed to be his adviser while explicitly stipulating that he would not provide classified information. Phillips armed himself wiht textbooks, declassified reports, and inquiries to companies selling dual-use equipment and materials such as explosives. Within months he had produced a design for a crude atomic bomb, demonstrating that knowledge wasn’t the real barrier to nuclear weapons. Dyson gave him an “A” and than removed the report from circulation.While the practicality of Phillips’s design was doubtful, that was not Dyson’s main concern.

As he later explained: “To me the impressive and frightening part of his paper was the first part in which he described how he got the information. the fact that a twenty-year-old kid could collect such information so quickly and with so little effort gave me the shivers.”

## Zombie machines

Today, we’ve built machines that can do what Phillips did-only faster, broader, at scale-and without self-awareness. large Language Models (LLMs) like ChatGPT, Claude, and Gemini are trained on vast swaths of human knowledge. They can synthesize across disciplines,interpolate missing data,and generate plausible engineering solutions to complex technical problems. Their strength lies in processing public knowledge: reading, analyzing, assimilating, and consolidating information from thousands of documents in seconds. Their weakness is that they don’t know when they’re assembling a mosaic that should never be completed.This risk isn’t hypothetical. Intelligence analysts and fraud investigators have long relied on the mosaic theory: the idea that individually benign pieces of information, when combined, can reveal something sensitive or risky. courts have debated it. It has been applied to GPS surveillance, predictive policing, and FOIA requests. In each case, the central question was whether innocuous fragments could add up to a problematic whole.

Now apply that theory to AI.

A user might prompt a model to explain the design principles of a gas centrifuge, then ask about the properties of uranium hexafluoride, then about the neutron reflectivity of beryllium, and finally about the chemistry of uranium purification. Each question-such as, “What alloys can withstand 70,000 rpm rotational speeds while resisting fluorine corrosion?”-may seem benign on its own, yet each could signal dual-use intent. Each answer may be factually correct and publicly sourced, but taken together they approximate a road map toward nuclear capability, or at least lower the barrier for someone with intent.

Critically, as the model has no access to classified data, it doesn’t know it is indeed constructing a weapon. It doesn’t “intend” to break its guardrails. There is no firewall between “public” and “classified” knowledge in its architecture, because it was never trained to recognize such a boundary. And unlike john Phillips, it doesn’t stop to ask if it should.

This lack of awareness cr## The Emerging Threat of AI-Assisted Weapons of Mass Destruction

The rapid advancement of large language models (LLMs) presents a novel and concerning threat: the potential for AI-assisted growth of weapons of mass destruction (WMD). while the knowledge required to build these weapons isn’t entirely inaccessible, the process is traditionally hampered by meaningful informational hurdles. LLMs are rapidly dissolving these barriers,lowering the threshold for both state and non-state actors seeking to acquire or develop WMD capabilities.

### The Information Bottleneck and LLM Solutions

Historically, constructing WMDs has been limited not just by access to materials, but crucially, by the difficulty of assembling the necessary, highly specialized knowledge. This knowledge is often fragmented, buried within obscure literature, or intentionally obscured through classification. LLMs excel at overcoming this “information bottleneck” by efficiently aggregating and synthesizing information from diverse sources.

Consider the example of synthesizing sarin gas. A researcher would traditionally need to consult multiple sources to understand:

| Knowledge area | Specific Information Needed | Sources |
|—|—|—|
| Precursors of sarin | Methylphosphonyl difluoride (DF), isopropyl alcohol etc. | Declassified military papers, 1990s court filings, open-source retrosynthesis software |
| Organophosphate coupling chemistry | common lab procedures to couple fluorinated precursors with alcohols | Organic chemistry literature and handbooks, synthesis blogs |
| Fluorination safety practices | Handling and containment procedures for fluorinated intermediates | Academic safety manuals, OSHA documents |
| Lab setup | Information on glassware, fume hoods, Shlenk lines, PPE | Organic chemistry labs, glassware supplier catalogs |

These examples are illustrative rather than exhaustive. Even with current LLM capabilities, it is evident that each list could be expanded to be more extensive and granular-retrieving and clarifying details that might determine whether an experiment is crude or high-yield, or even the difference between success and failure. llms can also refine past protocols and incorporate state-of-the-art data to,for example,optimize yields or enhance experimental safety.

### God of the gaps

There’s an added layer of concern because LLMs can identify information gaps within individual sources. While those sources may be incomplete on their own, combining them allows the algorithm to fill in the missing pieces. A well-known example from the nuclear weapons field illustrates this dynamic. Over decades,nuclear weapons expert Chuck Hansen compiled what is frequently enough regarded as the world’s largest public database on nuclear weapons design,the six-volume Swords of Armageddon.

to achieve this,Hansen mastered the government’s Freedom of Information Act (FOIA) system. He would submit repeated FOIA requests for the same document to multiple federal agencies over time. Because each agency classified and redacted documents differently, Hansen received multiple versions with varying omissions. By assembling these, he was able to reconstruct a kind of “master document” that was, in effect, classified-and which no single agency would have released.Hansen’s work is often considered the epitome of the mosaic theory in action.

llms can function in a similar way. Actually, they are designed to operate this way, as their core purpose is to retrieve the most accurate and extensive information when prompted. They aggregate sources, identify and reconcile discrepancies, and generate a refined, discrepancy-free synthesis. This capability will only improve as models are trained on larger datasets and enhanced with more sophisticated algorithms. A especially notable feature of LLMs is their ability to mine tacit knowledge-cross-referencing thousands of references to uncover rare, subjective details that can optimize a WMD protocol. such as, instructions telling a researcher to “gently shake” a flask or stop a reaction when the mixture becomes “straw yellow” can be better understood when such vague descriptions are compared across thousands of experiments.

In the examples above, safeguards and red flags would likely arise if an individual attempted to act on this knowledge; as in many such cases, the real constraint is material, not informational. However, the speed and thoroughness with which LLMs retrieve and organize information means that the knowledge problem is, in many cases, effectively solved. For individuals who might otherwise lack the motivation to pursue information through more tedious, conventional means, the barriers are substantially lowered. In practice, an LLM allows such motivated actors to accomplish what they might already attempt-only with vastly greater speed and accuracy.

Most AI models today impose guardrails that block explicitly dangerous prompts such as “how to make a nuclear bomb.” Yet these filters are brittle and simplistic.A clever user can circumvent them with indirect prompts or by building the picture incrementally. There is no obvious reason why seem“`html

The AI-Enabled Threat Landscape: From Recipes to real-World Risks