Anthropic’s Claude Misuse Report Details Missiles and Cyberattacks

Claude moved from assistant to operator

Anthropic’s September 2026 threat report covers activity detected between December 2025 and August 2026. It groups the cases into seven areas, including cyber operations, surveillance, fraud, biological misuse and conventional weapons development.

The most important change is how Claude was used. Several attackers went beyond asking a chatbot for advice. They placed AI agents inside automated workflows that handled reconnaissance, exploitation, malware changes and stolen-data processing. Humans still selected targets and reviewed the results.

These findings come from Anthropic’s own investigations. Independent outlets have reported the disclosure, but cannot examine all the underlying evidence.

Claude helped develop missile software

One case involved a cell in northern Yemen working on a guided rocket, a multi-stage ballistic missile and a missile variant that included a hypersonic glide vehicle.

Anthropic says the group used several Claude Code instances like a small engineering team, assigning separate coding, research and review roles. Its ballistic missile had a stated range goal above 2,000km, but Anthropic found no evidence that an operational weapon was fielded.

The group test-fired a guided rocket, which appeared to fail, then returned to Claude for help analysing the failure. Anthropic says its safeguards blocked many requests, but not all of them.

Biological research presents a harder problem

Of the report’s five biological case studies, one involved researchers asking Claude to help write a funding application for experiments that would genetically alter the chikungunya virus. The proposed work examined changes that could affect how easily the virus spreads and evades immune defences. Anthropic says its safety system blocked the initial request, although the platform used by the researchers later regained access and Claude provided editing help on related work. The research was intended for a military institute, which raised concern, but Anthropic does not claim it was a biological-weapons programme.

Another researcher planned avian-flu experiments involving mammalian adaptation, although safety systems confined the work to weaker Claude models. Elsewhere, Opus 5 produced an orthopoxvirus immune-evasion grant application in about an hour.

This does not prove that the researchers intended to create biological weapons. Anthropic describes the work as dual use, meaning the same knowledge could support legitimate medicine or harmful development. A wider 30-day review found roughly 35 research efforts, most of which were ordinary civilian science.

What Anthropic actually stopped

Anthropic banned associated accounts, strengthened its safeguards and shared information with authorities or industry partners where appropriate. That disrupted access to Claude, but it did not necessarily shut down the organisations or their wider projects.

Some users regained access through relays and new identities. The Yemen-based cell had also built an offline simulation toolkit. Blocking one hosted model does not remove knowledge or software already produced.

What to watch next

The next test is whether AI companies can detect misuse without blocking legitimate research. Downloadable and privately hosted models also matter because platform bans cannot control systems running elsewhere. Comparable evidence from competitors would show whether Anthropic’s cases are exceptional or part of a wider pattern.