Operators in northern Yemen used Anthropic’s Claude model in an alleged attempt to create software for a guided rocket and a long-range ballistic missile, the company said, in one of several cases it has disclosed involving weapons research, espionage and covert influence work. Anthropic said it blocked the effort, though it acknowledged that several requests linked to missile-guidance development had passed through its internal safeguards.
According to Anthropic’s threat report, the group used Claude “in place of human software engineers”, giving separate instances of the model defined tasks in writing missile-guidance and flight-control software. The company said the operators concealed their overall objective and divided work among separate sessions, a method that helped them avoid detection.
Anthropic said it had no evidence that the group succeeded in fielding a working weapon. It said the operators appeared to have carried out an unsuccessful test-fire. The company banned the accounts associated with the project and said it had “shared threat information with public- and private-sector partners to mitigate risks posed by the actors”.
The disclosure is significant because it records a failure of safeguards at a company that presents its systems as subject to restrictions on dangerous use. Anthropic said it has thwarted multiple malicious operations involving Claude, from weapons design and cyber-espionage to mass-surveillance campaigns. The cases also show how a model’s ability to assist with individual technical tasks can be used across a larger operation when users hide the final purpose of their requests.
Anthropic said it had also stopped multiple attempts by scientists this year to use its technology for research that could aid the development of biological weapons. It did not say whether that work produced functional biological agents or progressed only as research. The company’s account leaves the scope of other undisclosed cases unclear.
Its report described a Russian-linked espionage campaign carrying the hallmarks of Midnight Blizzard, also known as APT29. Anthropic said automated AI workflows handled nearly the entire operation, from phishing and technical setup through to data theft. The targets included Ukrainian, European and diplomatic organisations, as well as drone makers.
Anthropic also described an offensive cyber operation run by university students in Hunan province. It said the group used Claude “as the engineering and orchestration layer” for a programme aimed at government and corporate networks in the Middle East, Europe and Southeast Asia.
In a separate set of cases, Anthropic said it identified and removed three Iranian state-aligned accounts that used Claude for covert influence and psychological operations. Each account was linked to a named Iranian propaganda institution, including the Islamic Culture and Communications Organisation and a Mashhad seminary command room.
A China-aligned account used Claude in what Anthropic called a “multi-day recruitment operation to infiltrate Uyghur targets in Syria”. The company said the operator had no Arabic language skills and used the model to draft outreach in regional dialect and translate replies in real time.
Anthropic said it had removed the offending accounts and passed information to partners where it judged that necessary. Its report does not establish how widely comparable activity has occurred on other AI systems, whether other providers have identified weapons-related misuse, or whether governments have coordinated a response to state-backed use of AI in such operations.
The company’s account nevertheless highlights a practical problem for AI safety controls. Restrictions can assess an individual request, while operators can distribute a larger project into small pieces that appear less revealing on their own. Anthropic’s disclosures show that the gap between those two things has already been tested in efforts involving missile software, biological weapons research, cyber operations and influence campaigns.
Comments (0)