Step 1. Make it so Claude can do anything — the whole point of AGI

Step 2. Wait, if the user can do Anything, that would be Very Bad!

Step 3. Err on the safe side with blanket bans of entire fields

The latter actually seems to me a sensible reaction to e.g. the compartmentalization used in the large scale cyber attack using Claude last year. Where they were able to do Bad Thing by dividing it into many, many Small, Seemingly Harmless Things.

Gated access sounds bad (and I agree it sounds bad!) but it might actually be the only sensible response to such a set of conditions. I'm not sure though.

--

I saw some studies recently which showed LLMs provide much more detailed information to expert users. So we can distinguish between competence and incompetence based on use of language, and that is a reasonable metric for harm reduction.

But I don't think we can reliably detect "user has harmful intentions", at least not at a sufficient level of sophistication of the attacker.

Feels complex like solving a Rubik's cube to write down synthesis steps but it is all a sequence of memorized tricks. Do Cannizaro if you want this, Bergmann to do that.

But the synthesis plan is only 10% of the actual work.

The gap between writing down the synthesis step and actually doing it is also extremely large.

Even if you get the right molecule, it might be the wrong way around or just clump up into a useless mess.

The Ritonavir episode of Veritasium is a great example of how all chemistry on paper is a mere shadow of what actually happens in real life.

[1] https://www.ginkgo.bio/autonomous-lab

[2] https://www.emeraldcloudlab.com/

[3] https://www.kebotix.com/

[4] https://www.chemify.io/

[5] https://arxiv.org/abs/2507.01485

Curious to see how the others actually do.