The people prompting models do. I saw a job post a while back at RAND. It was for researchers with experience in bioweapons design to see how far along current models are for a motivated person to cause serious harm using them. I believe they have a number of publications now on this effort.