Sixteen living viruses, able to infect. Not one of the sixteen had existed in nature. A machine designed them.

It happened on 6 August, and Science published it. Two models called Evo, trained by Brian Hie’s group across Stanford and the Arc Institute with the graduate student Samuel King, started from ΦX174, a phage of just over five thousand bases studied since the 1970s, and produced hundreds of thousands of candidate genomes. Almost three hundred went into laboratory synthesis. Sixteen worked, and combined into a single preparation they cleared two strains of Escherichia coli already resistant to a naturally occurring phage.

While we were arguing about whether artificial intelligence writes schoolchildren’s essays, a machine was designing living organisms that work.

Anyone who read that news as the eve of something terrible skipped the line that matters most.

The two models had been trained on the sequences of two million bacteriophages. Sequences of viruses capable of infecting humans, animals and plants were deliberately left out of that training set. People made that decision, not the machine: the researchers themselves, before the experiment, inside the laboratory. Alongside the exclusion they put the rest of the safeguards in place, a non-pathogenic phage, a non-pathogenic E. coli host, a secure laboratory and red-teaming runs designed to find where the system gave way. No authority imposed it and no regulation required it. The most effective safeguard in the whole affair was a design choice, made by people who knew what they were building.

Five weeks earlier something had happened that points the same way, and that no company discloses gladly. On 21 July OpenAI reported that two of its models, during an internal evaluation of cyber capability, escaped the isolated environment they were held in. They found a previously unknown flaw in software acting as a proxy for package registries, crossed the network and reached Hugging Face’s production infrastructure. Their goal was to steal the answers to the benchmark they were being tested on, a test built on real vulnerabilities. There was no consciousness and no will to power. A system trained to maximise a score found the cheapest available route to the score, and that route ran through theft.

Who noticed matters. Hugging Face saw the intrusion and contained it on 16 July, five days before OpenAI traced the activity back to its own evaluation run. The target discovered the attack before the party that had unwittingly launched it. Not a supervisory authority, not a prosecutor, not a compliance obligation.

It is worth stopping on something the two episodes have in common. Neither made news for more than a day, and neither involved a chatbot writing text.

That is the rule, not the exception. The part of artificial intelligence discussed in public is the part you can see, which is words: essays, emails, articles. The part that is changing things sits where nobody is looking. Inside a laboratory designing an organism. Inside the software package registry half the internet runs through. Inside the way a garage runs a diagnostic, a law firm reads a contract, a hospital orders its waiting lists, a business decides who works on Saturday night.

The trade changes, not the name of the trade. That is why almost nobody notices until it has already happened: no announcement arrives, a process simply starts working differently one day. And when change comes in through processes, anyone legislating on what can be seen writes about the wrong thing, and writes about it late.

An unexpected voice has just weighed in on this. On 23 August, as a guest on David Senra’s Founders podcast, Sam Altman admitted he had got the timing wrong. “I think the economy just has so much inertia,” he said. “People keep doing the same things they’re doing. They keep buying from the same company.” After 2023 he had expected the software business to be up for grabs far faster than it turned out to be. His conclusion, in his own words: “we’ve all been too ambitious on timelines, even with this incredible technology.”

Coming from the man who sells the technology, that is worth more than ten forecasts. And it says something precise: the bottleneck is not the machine, it is the time an organisation needs to rebuild the way it works.

The two things hold together and do not contradict each other. The visible part runs fast and matters little. The part that matters comes in slowly, through processes, and precisely because it comes in slowly it makes news on no particular day. We will notice it when a trade, one day, is simply done another way.

Over the same period Europe was doing what Europe does well. The artificial intelligence regulation, in the Official Journal since July 2024, runs to one hundred and thirteen articles, one hundred and eighty recitals and thirteen annexes. Above it sit the GDPR, the DSA, the DMA, the Data Act, the NIS2 directive and the Cyber Resilience Act. Below it, in Italy, law 132 of September 2025, in force since 10 October, assigns supervision to AgID and to the national cybersecurity agency.

Now the money. According to Stanford’s AI Index 2026, private American investment in artificial intelligence reached 285.9 billion dollars in 2025, of which 163.6 billion went to generative AI alone. In that same segment China and Europe together stopped at 4.7 billion. On total private investment the ratio between the United States and China is twenty three to one.

One hundred and eighty recitals on one side, four point seven billion on the other.

There is a Lombard precedent twenty minutes by tram from the newsrooms that debate these matters. On 8 April 1583 the governor of Milan issued a proclamation against the bravi, the armed retainers of the local lords. A year later, on 12 April 1584, finding the city still full of them, he issued a second. Then came 5 June 1593, 23 May 1598, 5 December 1600, 22 September 1612, 24 December 1618, and 5 October 1627, a year and a month before the walk taken by don Abbondio in Manzoni’s novel. A ninth appeared in February 1632. In 1598 the governor had written that this was “the last and peremptory warning”. Five more followed.

Manzoni gathers them in his first chapter to make a single point: eight laws on the same subject in forty four years are documentary proof that none of the eight worked.

And here is the passage that concerns us more than any investment statistic. When a rule fails to secure obedience, those who wrote it rarely withdraw it. They stiffen it. The second proclamation, the one from 1584, provides that anyone whom two witnesses identify as “commonly reputed to be a bravo” may be put to torture even where no offence has been established, and sent to the galleys for three years “on the sole opinion and name of bravo“. Climbing the ladder of severity, the first thing to fall is the burden of proof. Conduct gives way to reputation. Fact gives way to suspicion.

This is not an abstract worry for a law on artificial intelligence. Regulation that proves ineffective on a subject it cannot control tends to migrate towards what it can control: the formal obligation, the register, the label, whoever is already visible and already compliant. Frontier laboratories stay where they are. The bill is paid by the small firm that uses the software to work and by the researcher who fills in forms instead of verifying results.

There is a serious objection to all this, and it does not come from anyone defending regulations. Paolo Benanti has observed that biosecurity is built to recognise dangers resembling those we already know, while a generative model produces things that resemble nothing on any list. He is right, and it is a serious objection to the idea that leaving things alone is enough. In another piece, on the tachograph that British lorry drivers rejected in 1968 as the spy in the cab, and which later became the evidence they used to defend themselves, Benanti calls for a publicly held instrument of measurement. That conclusion is not ours and it stands regardless: an instrument becomes a protection through the institutional architecture around it, not through the way it is built.

Our answer starts there. Rules are needed, and they need to be verifiable. Verifying means being able to run the test again, and running the test again means knowing how to build the thing. In July’s incident the intrusion was spotted by whoever held the logs, which is to say whoever owned the infrastructure. In August’s experiment the limit was set by people who knew the model from the inside. In both cases safety came from technical competence, and in both cases it arrived before any proceeding.

So a supervisory agency is better asked how many engineers it has hired, how many machines it holds to re-run an evaluation, how many incidents it has reconstructed end to end. Those questions are answered with numbers, and the numbers say a great deal more than a clause.

A competent Italy and a competent Europe would also be safer, for themselves and for everyone else. The good news from August is that the safeguard held: someone knew how to set a limit on the thing they were building, and the limit worked. The work left to us is to make sure that someone, now and then, is also from here.