Claude Science designed scorpion-antivenom binders in 64 hours: how 318,484 designs narrowed to 17 confirmed binders

On October 20, Anthropic published a research write-up: an internal research model running inside Claude Science spent about 64 hours, working mostly on its own, designing small proteins (minibinders) that latch tightly onto scorpion neurotoxins.^[1] The numbers chain together like this: it generated 318,484 designs, narrowed them to 180 on its own, the team added 31 more, and all 211 went to the wet lab, where 17 were confirmed to bind at both testing labs.^[1] What makes this worth writing about is not the headline “AI discovers something.” It is that the system ran one full loop of experimental science end to end: mass exploration, layered filtering, then a handoff to a wet lab for ground truth, with humans supplying a single prompt up front and interjecting four times.

Read it next to the previous post, Terence Tao’s blog: why mathematicians still do math once AI can solve problems, and it is the same question from another angle. In math, AI now does the “stated clearly, mechanically checkable” problems at expert level, and the bottleneck recedes to choosing and digesting problems. In protein design, Claude Science compressed “generate candidates, score them, filter” into a few days, and the bottleneck recedes to wet-lab truth and the long stretch where “binding” is not “a cure.” The structure matches: the mechanically checkable stretch gets flattened, and value and scarcity move to the two ends.

The short version

• This is not a story about an AI inventing a scorpion antivenom. The 17 designs prove one thing: they bind tightly enough to recombinant toxins, each against a single toxin. No cell-level neutralization, no in-vivo protection in animals. Anthropic explicitly does not claim to have produced an antivenom.^[1]
• The real novelty is the loop, not any single result. Narrowing 318,484 computational designs to 211 lab candidates and then to 17 confirmed binders runs on a closed explore→filter→wet-lab-truth loop. The wet lab is the one source of truth in that loop, and also its slowest and most expensive step.
• What pushes the frontier is the harness and the agent loop, not a bigger model. A footnote carries the key line: the same work, with a single agent, a single GPU, and 24 hours, reaches comparable in-silico scores.^[1] That is the same read as Claude Science harness: nine-loop amplitudes with nobody at the wheel.
• The multitoxin “universal binder” line failed completely. Of the 211 designs, 91 aimed at all five toxins at once, and none met the criteria for more than one toxin.^[1] That negative result says more about today’s limits than the 17 successes do.
• The data is public. All 211 designs and their binding data are on HuggingFace, which turns “binding is not a cure” from a disclaimer into material others can build on.^[5]

What actually happened

Get the facts straight first, because the headline reads too easily as “AI built a scorpion cure.” The reality is far more restrained.

It began with a question from Citrini Research, a financial investment research firm: could AI let a group of motivated nonexperts take on a genuine human-health problem?^[1][3] Anthropic’s life-science team worked with them and landed on scorpion venom. Scorpions sting more than 1.2 million people a year and kill more than 3,250, mostly children in places with limited medical access; new treatments are both hard to make and unlikely to recoup their cost, which is why scorpion envenomation is classed as a neglected tropical disease.^[1] In other words, this is a target no one has a commercial reason to touch, and one that genuinely kills people.

The team reused the prompt from its August single-prompt binder study, revised it with Citrini, and handed it over.^[1][4] Over the next 64 hours or so, the internal research model ran largely autonomously inside Claude Science, with humans steering through four follow-up prompts.^[1] It searched the Protein Data Bank (PDB) and the AlphaFold database for toxin structures to design against, and for each toxin picked five “hotspots,” the specific amino-acid positions its designs were meant to grab.^[1] It also set the quality thresholds a design had to clear, decided how heavily to lean on each tool, and developed its own multitoxin strategies.^[1] In total it used 12 design tools to generate 318,484 designs, filtering out any that resembled a toxin or a known protein, then co-folded and screened 553,052 design–toxin pairs by predicting each pair as one complex.^[1] The campaign burned on the order of 10,000 GPU hours.^[1]

Figure: the campaign’s loop and funnel. Bar widths only illustrate “narrows at each layer”; they are not to scale, and the real numbers sit on the bars. Data from^[1].

After 64 hours the model handed over its final 180 designs. The team then worked with the model to add 31 more, bringing the total to 211: 60 against a single toxin (12 per toxin), 30 against the two β-family toxins, 30 against the three α-family toxins, and 91 against all five at once.^[1] Those 211 went to two contract research organizations (CROs), Adaptyv Bio and Twist Bioscience, to be tested on the bench for actual binding.

Why scorpion venom: a neglected target that suits de novo design

Scorpion venom was not chosen only for how grim it is. It is also a clean technical test. The venom carries several protein neurotoxins, and the ones most dangerous to humans bind sodium channels in nerve-cell membranes, making nerves fire at the wrong time and dumping stress chemicals like adrenaline; in severe cases that leads to heart failure, fluid in the lungs, and sometimes death.^[1] Traditional antivenoms immunize horses with milked venom and then purify the antibodies, a process that takes months, usually works for only a few toxins, and is expensive and often in short supply.^[1]

De novo design offers another route. A binder is a molecule that grips a specific target tightly; antibodies are the natural example. In principle, a binder that covers the part of a toxin that latches onto the sodium channel can stop the toxin from reaching it.^[1] These proteins are generated from scratch in software and can be tuned to be more drug-like — more stable, easier to supply — which is exactly what the regions with the most stings need. This time the team picked five toxins across four regions and four species: Cn2 from Mexico, Ts1 from Brazil, AaH I and AaH II from North Africa, and LqhIII from the Middle East, aiming each design at the toxin’s channel-binding site.^[1]

Figure: the toxin grabs the sodium channel and makes nerves misfire; a binder covers the toxin’s channel-binding site so it cannot reach the channel. The two bottom lines report the Cn2 binder results. Data from^[1].

The five toxins were chosen with a harder motive, too. They share one fold (overall shape) yet are only 26% to 62% identical in amino-acid sequence between any two.^[1] The team wanted to see whether Claude could design a single binder that grabbed several toxins at once — a true “universal antivenom cocktail” would then need far fewer molecules, which helps on both cost and regional reach. So it was asked to design four kinds: against each toxin individually, against the β-family pair (Ts1 and Cn2), against the α-family trio (AaH II, AaH I, LqhIII), and against all five at once.

How the loop converges: truth lives only in the wet lab

From 318,484 to 17, the instinct is “they filtered hard.” But what decides how much to trust this loop is how that last wet-lab gate was set. This part deserves a slow read, because it governs how far you can believe the phrase “17 confirmed binders.”

The two CROs used deliberately different expression systems. Adaptyv Bio used a cell-free system, making proteins with machinery extracted from bacteria; Twist Bioscience expressed designs in mammalian cells (human kidney cells here) as fusions to Fc, the stem of an antibody.^[1] The two are complementary ways to measure binding, combined to raise confidence. Both used surface plasmon resonance (SPR): a toxin flows over the design while the instrument tracks in real time how fast it binds and releases, yielding a dissociation constant KD — the lower, the tighter.^[1]

The criteria for calling a design a binder were strict, and this is the part I most readily trust. A design had to be a hit at both labs: binding evidence in every replicate against that toxin, and every KD at 1 µM or tighter. It also had to show no signal against CLEC12A, an unrelated human protein used to screen out “sticky” false positives.^[1] Stacked together, that demands passing across labs, across replicates, and against a negative control at the same time. LqhIII was the one exception, assessed only by Adaptyv Bio.^[1]

Seventeen designs cleared that gate, each against a single toxin: seven against Cn2, four against AaH II, four against AaH I, and two against LqhIII.^[1] Of the big multitoxin batch, none met the criteria for more than one toxin.^[1] Among the 60 single-toxin designs, 11 were binders, an 18% rate that Anthropic says is in line with typical protein-design campaigns, including its own earlier work.^[1] That line matters. It pulls “17” back from an exclamation point to a normal value. The loop’s value is not a freakish hit rate; it is that the whole chain, from picking structures to shipping samples, was run largely by the model itself.

The two strongest binders, Cn2-B1 and Cn2-B2, both grab Cn2 from the Mexican scorpion, with single-digit nanomolar KD at both labs.^[1] More interesting is the competition experiment: each binds at or near the same epitope as LR, an antibody reported to neutralize Cn2 in mice, and LR’s site covers the part of Cn2 that docks onto the sodium channel.^[1] Two molecules fighting over the same spot suggest these designs will likely neutralize Cn2 too. Note “likely” — they have not been tested in cells, let alone in live animals.

The edge of Claude’s autonomy: it set the rules, and it hit a wall

The part most worth studying is who did what. The initial prompt defined the toxin targets, the design and folding tools, and the rules for novelty, scoring, and filtering.^[1] Beyond that, choosing structures, picking hotspots, setting quality thresholds, deciding how much to lean on each tool, and devising multitoxin strategies were all on the model.^[1] It even sent the protein sequences to Twist Bioscience to order synthesis, in emails noting they were written by Claude.^[1]

Human input concentrated in four follow-up prompts, and the pattern is telling. The model ran on its own for 24 hours first; the results were good enough that the team prompted it to keep looking for better designs, and the follow-ups mostly pushed it toward multitoxin binders.^[1] One detail says a lot: most of the 180 designs, including the strongest Cn2-B1, were selected only after the third follow-up.^[1] Autonomy, then, is not hands-off. Where you add a sentence, and which direction you push, still shapes the output heavily. This matches Claude Science harness: nine-loop amplitudes with nobody at the wheel and its “minimal human intervention” read: the point is not that the model runs fully unattended, but that intervention points are few and clearly recorded.

The failure of the multitoxin line is worth more than the successes. The 91 all-five designs, plus the two within-family batches, produced zero cross-toxin binders.^[1] Anthropic lists several possible reasons: current capability limits, their prompting, the limits of available design tools, even the biological feasibility of multitoxin design.^[1] It does not make excuses and does not oversell, and that candor about negative results is exactly what you should look for first when reading this kind of paper. Set against Claude “discovers” a CRISPR-like enzyme system: how to read the science marketing — where the dispute was “searched and found” being sold as “discovered” — the good news here is that the author drew the boundaries.

What the 17 binders mean, and what they do not

Stated flatly: this study proves binding to recombinant toxins, and nothing more. Recombinant toxins are grown in the lab from each toxin’s gene, not purified from real venom. Anthropic names the two biggest limits — no design was tested for neutralization in vitro (against cultured cells) or for efficacy in vivo (in living animals such as mice).^[1]

The road from a binder to a drug is long. Take the most promising, Cn2-B1: first confirm it also binds toxin purified from venom; then test it in vitro with patch-clamp recordings (which measure current through sodium channels) to see whether it actually blocks the toxin; then test it in mice to see whether it protects them; and finally the drug must be safe, stable, affordable, and reachable where stings happen, which takes clinicians, funders, and policymakers working together.^[1] Two outside experts, Susana Vázquez Torres (Spanish National Cancer Research Centre) and Timothy P. Jenkins (Technical University of Denmark), called it a promising first step; Torres added a blunt line — binding itself is no longer the main bottleneck, and the real work lies in the long stretch after binding that turns a molecule into a real drug.^[1]

This is exactly why I will not read the piece as “the cure is here.” Binding is the stretch AI is best at right now, and the one most easily checked by machine. Neutralization, protection, manufacturing, and access come after, and that is where value and scarcity actually sit. The further capability advances, the more pressure moves to those later stretches. Set that logic next to the Tao post and it is the same thing.

Dual use and biosecurity: public data is part of the answer

A system that designs proteins to grip “almost any target” carries an inherent dual-use question. The mitigating facts here: the goal is to neutralize toxins rather than enhance them, and all 211 designs with their binding data are posted publicly on HuggingFace.^[1][5] Publishing is itself a biosecurity posture. It turns the result into material that is reproducible, auditable, and open for peers to verify, rather than a press release you can only read the summary of. The involvement of two outside experts, Torres and Jenkins, is part of the same “let outsiders check” machinery.

The longer-term question is not one this paper can close. As the bar for designing credible binders drops to “a few days plus a prompt,” who gets to run it, against which targets, and whether they publish, becomes a governance question larger than any single result. The sample here is a positive one: a target no one would fund yet that truly kills people, all data released, outside experts reviewing. It does not, and cannot, settle whether that practice generalizes.

The frontier mover is the harness, not a bigger model

The part easiest to skip, and most worth underlining, is the compute math in the footnotes. The whole campaign used on the order of 10,000 GPU hours, which the authors admit is far more than most researchers can access; but they immediately add that they have made these models about 4x faster on average and shown that a simplified prompt using a single agent and a single GPU over 24 hours reaches comparable in-silico scores.^[1]

That line shifts the story’s center of gravity. If the same computational result can go from “10,000 GPU hours plus multi-tool orchestration” down to “one GPU and a day,” then what is advancing the frontier is not some bigger model but the harness that wraps the model in an explicit loop — who drives the tools, how they filter, where a human line gets inserted. This tracks two site posts: Claude Science harness argues the frontier mover is an explicit harness plus minimal human intervention, and AI harness and environment legibility argues how far an agent gets depends on how much readable feedback the environment leaves it. In the scorpion loop, the wet lab is that hardest, slowest, most honest feedback step.

So I would rather read this result as a demonstration of an agent loop than a leap in model capability. The model is a part; the loop is the machine. And the machine’s most precious part is the one you cannot speed up: wet-lab truth.

A framework: how to read autonomous science-agent results

Every few weeks a new “Claude (or some model) made a scientific breakthrough” appears. Rather than ride the headline’s emotion, place it on an evidence ladder — see which rung it stops at, and whether the authors said so plainly.

Figure: a six-rung evidence ladder from computational design to a drug. This study honestly stops at rung 2 and names rungs 3 through 6 as not done. Use the same ruler on any “AI science breakthrough.” Data and plans from^[1].

A few questions you can ask straight down the list:

1. Which rung of the evidence ladder does it stop at? In-silico scoring, binding to a recombinant target, or actual in-vivo efficacy and a drug? This one stops at rung 2, and the authors say so. If the headline claims higher, that is marketing.
2. Where does the ground truth come from, and can it be reproduced? Here it comes from SPR at two CROs, with strict criteria and all data public. A “discovery” with no independent wet-lab truth should be treated as an in-silico result.
3. Are the negative results reported? The multitoxin total failure and the merely “normal” hit rate are both stated. A write-up that reports only wins loses half its credibility.
4. Is the model or the loop moving the frontier? Look for the harness, tool orchestration, human intervention points, and the compute math. The 4x speedup and the “single GPU, single agent, 24 hours” line are the most durable part here.
5. How is dual use handled? Is the target neutralizing or enhancing, is the data public, are outside experts reviewing? This one scores positively on all three.

Closing

What I credit in this Claude Science campaign is not the number 17. It is that it ran one full loop of experimental science honestly and laid out every gate, every human interjection, and every category of failure. The chain from 318,484 to 211 to 17 is three stages of narrowing — explore, filter, verify against truth — and the truth stage, two labs with criteria strict across replicates and controls, cannot be accelerated by compute, which is exactly why it is the most trustworthy part. Looking ahead, what decides how far this kind of work goes is probably the harness and the willingness to publish data, not a model that got a bit larger. When you read this kind of news, lay out the evidence ladder, see which rung it stops at and whether it said so, and that will serve you better than riding the headline.

References

1. Anthropic, “How Claude designed protein binders against scorpion neurotoxins,” 2026-10-20: https://www.anthropic.com/research/claude-scorpion-toxin-binder-design ↩
2. Anthropic, technical report for this study (PDF): https://www-cdn.anthropic.com/31ac578806cffd8b3d92d8affe6edc4c04d502e1.pdf
3. Citrini Research (collaborator, a financial investment research firm): https://www.citriniresearch.com/p/citrini-therapeutics ↩
4. Anthropic, “Claude accelerates protein design” (the August single-prompt binder study): https://www.anthropic.com/research/Claude-accelerates-protein-design ↩
5. Anthropic, scorpion-toxin binder-design dataset (211 designs with binding data): https://huggingface.co/datasets/Anthropic/scorpion-toxin-binder-design ↩