ReproBAIT: Can coding agents build their own biological AI tools?
ReproBAIT evaluates whether sandboxed coding agents can reconstruct published biological AI tools from limited text descriptions when supplied with training data and a fixed compute budget. The authors task frontier LLMs with replicating three tools—a closed-source molecular-design model, ProteinMPNN, and RFdiffusion3—and score functional parity on held-out data rather than source-code similarity. Near-parity is reached on the two simpler tools for only a few dollars, while the most complex tool defeats all agents within the allotted budget, raising questions about memorisation and whether withholding code is enough to control access.
The paper makes a timely contribution by shifting replication benchmarks from static code matching to functional re-implementation of biological models, yet its conclusions are undermined by a tiny sample (three BAITs), an absence of causal memorisation controls, and a best-of-three reporting strategy that systematically inflates apparent fidelity. The authors are appropriately cautious in places, but the abstract and discussion still frame the results as establishing a general 'reproduction capability' that should worry tool developers.
The evaluation protocol is the paper's clearest strength: functional scoring on held-out data, strict sandboxing without internet access, and isolated scorer pods to prevent reward hacking. Including a genuinely closed-source tool alongside open-source anchors is a real advance over prior benchmarks, and the memorisation diagnostics—while imperfect—are transparently reported.
The empirical base is too narrow to support the policy conclusions. With only three BAITs—and only one closed-source, which is also the least complex—alternative explanations such as memorisation and task-specific saturation cannot be ruled out.
The 'best of three' metric is defended as realistic but hides variance and systematically overestimates reliability. Performance on the closed-source CMD is essentially saturated on a single validity metric, while the RFD3 attempts either gamed the metric or narrowed the task distribution; counting these as partial successes drives a misleading headline narrative. The memorisation signal is strongest exactly where performance is highest, so the claim that withholding code alone assures control is unsupported.
The evidence supports narrow claims about these three tools under the specific conditions tested, but it does not justify general conclusions about coding agents or dual-use access control. The comparison to prior work—such as PaperBench, which evaluates replication of AI research papers—is fair, and an external check confirms Starace et al. (2025) indeed targets paper replication rather than biological tool recreation. However, the paper lacks a human baseline or cost-normalised comparison, and the complexity rubric has no external validation; the authors themselves concede that 'a dataset of three BAITs is insufficient to draw strong general conclusions.'
The authors describe the sandbox infrastructure, time budgets, and prompts in appendices, but no code, agent transcripts, or model checkpoints are publicly released. Because every hyperparameter and architectural choice is generated by the agent, omitting the trajectories and final model code makes independent verification nearly impossible; the paper therefore fails its own reproducibility standard despite a detailed reproducibility statement.
Large language models are increasingly competent at leveraging scientific knowledge and existing computational tools to execute complex workflows. At present, little information exists on their ability to reconstruct tools when given limited descriptions of such tools. We introduce an evaluation titled ReproBAIT (Reproducing Biological AI Tools), which measures the ability of coding agents to design, implement, and train biological AI tools taken from published research across a range of information access conditions. The coding agent is securely sandboxed without internet access and receives training data, a fixed time and compute budget, and limited information about the tool to replicate. We then score the reproduced biological AI tool based on its performance (tool-specific metrics) on held-out data. We evaluated a set of biological AI tools of varying complexities: ProteinMPNN, an inverse protein folding tool, RFdiffusion3, an all-atom generative diffusion tool, and a closed-source molecular design tool. We institute a methodology to check for memorisation, as the open source tools are likely to be included in models' pretraining corpus. Across a range of leading closed- and open-source coding agents, we find substantial reproduction capability for some selected tools, though limited capability for a highly complex tool. We find moderate evidence consistent with memorisation, varying across coding agents. These results suggest that tool developers need to be increasingly cautious when releasing information about the tools publicly; re-creation of the tool based on such information could undermine a tool's commercial value or invalidate dual-use managed access strategies.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.