Bioweapons research, election meddling and a Yemen-based missile cell: the many misuse attempts on Claude

In AI firm's detailed threat intel report: five biology cases involving state-linked scientists, operations across cyber, surveillance and guided weapons.

Scientists working inside state-supported research programmes have used Anthropic's Claude models to help plan and write up experiments that could feed into biological weapons development, the company disclosed late on Thursday, in a threat-intelligence report that offers the first public account by an AI firm of how its own tools have been weaponised for attempts at pathogen engineering, state-run surveillance of dissidents, election interference across three continents and the development of guided missiles and autonomous drones.

Anthropic logo, a keyboard, and a robotic hand in this illustration taken June 5, 2026. (REUTERS)

The disclosures form the central section of a 154-page report covering activity Anthropic said it disrupted between December 2025 and August 2026 across cyber operations, influence operations, surveillance, conventional weapons development, scams and illicit distillation. The company said it withheld the identities of the researchers, their institutions, the countries where the research was conducted and the specific pathogens involved, to avoid exposing scientists who may not have intended harm. It also acknowledged it cannot know for certain what the ultimate purpose of the research was.

Chikungunya tweak for virulence

The first of five biology cases involved research on the chikungunya virus, a mosquito-borne pathogen that causes severe pain and fever for weeks or months and has no licensed therapeutic. Because chikungunya circulates naturally in humans, a deliberate release would be difficult to distinguish from a natural outbreak, which makes it a candidate weapons agent.

In May, Anthropic's biological safety classifier blocked a request for help drafting a grant application seeking to identify mutations that would make chikungunya more transmissible and better able to evade the human immune system. The proposed method, known as serial passage, involves engineering those mutations into infectious clones of the virus, infecting live animals, keeping the versions that cause the most disease, and repeating until the pathogen is more dangerous than the one the researchers started with. The application described civilian researchers but named a military research institute as the host lab.

Not just civilian use

Anthropic said it traced the request to a reseller platform serving dozens of life-sciences researchers, many of them virologists with mixed civilian and military affiliations in a country where Anthropic does not offer service. The platform tunnelled traffic through United States infrastructure to defeat the regional block, used a zero-data-retention channel to hide the content, and its operators had built an automatic fallback that routed any prompt Claude refused to a competitor's model with more permissive safeguards.

Anthropic banned the accounts and worked with partners to take down the relay. Within days, the operator was back with fresh identities. Within weeks, the chikungunya work was continuing, with Claude providing editorial help on research write-ups that described the viral modifications in the language of loss of function rather than gain.

Bird flu, across thousands of prompts

A researcher outside the United States spent several weeks and thousands of messages with Claude planning experiments on highly pathogenic avian influenza, focused on how H5 viruses adapt to mammals and cause severe disease outside the respiratory tract. H5 viruses kill roughly half of humans with confirmed infection; what has kept them from becoming a pandemic is that they do not spread efficiently between people.

The plan the researcher developed with Claude involved introducing mutations associated with mammalian adaptation and airborne transmissibility in animal models, and his descriptions were consistent with his group having physical access to live viral isolates. He reached Claude via a US virtual private server from an unsupported region, using an auto-generated username on a privacy-email service. Anthropic said its classifiers blocked the work from reaching its strongest models; the researcher was forced onto its weaker Sonnet 4 and Haiku 4.5 systems, where the company estimates the assistance he received was largely clerical.

Smallpox family, drafted in an hour

A third case involved orthopoxvirus research at a state-associated infectious-disease lab with high-containment facilities and access to live orthopoxviruses, the family that includes variola, the smallpox agent, and mpox. A reseller relay serving more than a dozen unrelated customers routed one client's request to Claude Opus 5, which drafted a full grant application in about an hour. The proposed research would identify orthopoxvirus genes that shut down a specific human antiviral pathway and confirm that deleting those genes weakens the virus in mice.

Anthropic said the application illustrated a wider dual-use dilemma. The same knowledge that allows a scientist to attenuate a virus for vaccine work would allow a different scientist to preserve, enhance or transfer that immune-evasion capability to another pathogen. Because the application was framed as attenuation research, Claude's classifiers did not block it.

Toxin research described as therapy

The two remaining biology cases concerned toxin research. In one, a researcher inside a state-supported programme used Claude to build an atlas of venom-derived toxin peptides drawn from multiple animal lineages and to extend it into a generative pipeline that could optimise the properties of such molecules. The stated therapeutic purpose was to design new painkillers and antidepressants, but the atlas contained scaffolds for both analgesic and paralytic targets, and paralytic compounds of this class are export-controlled under the Australia Group regime because they can be developed into incapacitating agents.

In the second, a researcher used Claude across several projects involving the computational redesign of a diverse set of toxins, framed as therapeutic work under a national public research programme. Two of the targets Anthropic flagged were a bacterial toxin subunit and a protein from a hemorrhagic-fever virus on the World Health Organization's priority list of pandemic and epidemic threats. The researcher co-wrote quarterly progress reports with Claude and specifically instructed the model to keep the descriptions of which bacterial toxin and which viral protein he was working on deliberately low in fidelity. Anthropic said the instruction is not consistent with an author writing up therapeutic work in good faith.

What guardrails miss

The company argues in the report that its classifiers robustly guarded the content they were designed to guard, but that a large and growing share of dual-use scientific research now looks valuable to both legitimate and potentially malicious users, and no classifier can reliably tell them apart on content alone. In a 30-day sweep of activity from institutions in adversarial states, it found roughly 35 distinct research efforts, most of them ordinary civilian science, some with what it called notable dual-use potential.

Anthropic's stated position is that frontier biological capabilities can now only be served safely through trusted-user programmes with verified institutional signals and data retention that allows misuse to be identified after the fact.

The wider report documents parallel patterns across other harm areas that show sophistication and resources decoupling. Small operators, sometimes working alone, are running campaigns that a year ago would have required teams.

The lone hacker, doing a team's work

A cluster of financially motivated affiliates of the ShinyHunters extortion group set ten Amazon cloud servers to download 1.8 million Android applications from app stores and pull them apart in search of credentials that developers had accidentally left inside the code — API keys, session tokens, authentication credentials that were never meant to travel with an app to a customer's phone. Verified finds were routed in real time to private Telegram groups sorted by what they unlocked.

The credentials became front doors to a technology provider from which a terabyte of data was stolen, an airline holding tens of millions of passenger records, and an energy company at which the operators claimed they could remotely control the current at home EV chargers. A Russian financially motivated actor tracked as GTG-50020 turned the same technique on the AI industry itself, spending four days last spring attempting to steal production API keys from roughly 30 AI companies. His stated goal, pursued across more than a dozen paths, was to reach a pre-release Claude model; every attempt failed.

A Russian intelligence-linked operator consistent with the group known as Midnight Blizzard used AI monitoring agents to watch whether its deployed malware had been flagged by security products in the wild, then had other agents rebuild the code until it went undetected, closing an evasion loop that traditionally gave defenders weeks of breathing room.

A group of Chinese computer-engineering undergraduates in Hunan province, one of whom had interned at a security firm, ran an autonomous vulnerability-research loop that produced more than a dozen previously unknown flaws in a major security-appliance vendor's products in a single month.

A single French-speaking hacktivist breached 14 European political parties, media outlets and think tanks over the spring, and built a doxxing search engine loaded with tens of millions of records including national health identifiers.

Fake newsrooms, widespread broadcasts

A Turkish firm, the report said, sold access to what its own documents described as a military-grade real-time political operations platform. Its Malaysia deployment used real census and electoral data to profile voters across all 222 parliamentary constituencies against race, religion and royalty, ran roughly 1,000 fake X accounts, and in one recorded instance was tasked with generating a million artificial views on the sitting prime minister's account.

A former editor-in-chief of Sputnik Moldova used Claude to produce Russian-language articles that ran on Russia-linked media and were echoed across a network of aligned outlets in a fabricated verification loop, so that a single story appeared to have been independently confirmed. The content included fabricated claims about Moldovan president Maia Sandu ahead of the country's September 2025 parliamentary vote.

A single Bangladesh-based operator ran a pro-Awami League fake-news factory through 29 rotated Claude accounts, producing fabricated Bengali content for rural audiences that the operator noted in his own code was meant to be simple enough that "no one knows the news is fake." Some of the narratives also aligned with pro-Indian geopolitical framings, Anthropic said, though it found no evidence of direction or funding by any state or political party, including the Awami League itself.

A distributed operation linked to the Iranian opposition group Mojahedin-e-Khalq cloned the identity of a real Iranian activist by feeding roughly 8,400 of his own Telegram posts to an AI, then used the clone to hold live political conversations with the activist's real contacts inside Iran.

One consultant, twenty-five million SIM cards

A single consultant in Bamako, hired by Mali's state intelligence service, used Claude as his engineering workforce to build "Lakana 360," a national domestic surveillance platform designed to monitor roughly 25 million SIM cards across all three of the country's mobile operators. The system captures call records, texts and voice traffic, matches individuals against the national biometric registry, and tracks a person's voiceprint across different SIM cards to defeat burner phones. At the operator's explicit request, the warrant requirement was stripped from the component that generates intelligence dossiers on any tasked phone number.

A separate Chinese military operator, the report stated, with no Arabic-language skills ran a multi-day covert operation to recruit ethnic Uyghurs who had joined the newly formed Syrian Army. Claude drafted outreach in Syrian dialect, translated replies in real time and was made to role-play an Arabic-speaking expert consultant to quality-check the operator's own deceptive messages for dialect and terminology.

Yemeni rebels working on rockets

Perhaps the most stark was the case of a cell in northern Yemen that used Claude Code in place of engineers to develop guidance, navigation and control software for a rocket, a ballistic missile with a stated range goal above 2,000 kilometres and a hypersonic-glide-vehicle variant. Anthropic did not name a sponsor; the geography and profile are consistent with a Houthi-linked programme. The operators ran multiple Claude instances at once, assigning each a role. They test-fired a guided rocket that appears to have failed, and within hours had returned to Claude to work out why.

A small Russia-based freelance team used Claude Code to build an autonomous first-person-view kamikaze drone swarm, with an onboard model that could select a "person" target class and issue the detonation command without a human in the loop. Its computer-vision classifier was trained on scraped Ukrainian combat footage.

A China-based defence researcher, whom Anthropic assesses is linked to research institutions, used Claude to build a targeting suite for electronic warfare and air-defence suppression, and mid-project changed the software's default scenario to 12 targets in Taiwan, including a command bunker, Patriot batteries and major air bases.

Rival AI labs, harvesting Claude

Anthropic stated that Moonshot and DeepSeek, the Chinese firms behind the Kimi and DeepSeek models, silently rerouted their own customers' requests to Claude and displayed Claude's responses as if they were their own, using the resulting exchanges to train their models on Claude's reasoning traces. Alibaba ran what Anthropic said was the largest distillation attack it has ever measured, peaking at nearly three million exchanges a day from more than 3,500 fraudulent accounts.

The relayed traffic exposed sensitive third-party data those users had no idea was being handed to a US company. Moonshot's included a user Anthropic assesses was likely affiliated with the People's Liberation Army, using what he thought was Kimi to analyse CCTV footage from hundreds of cameras in Chengdu, including cameras outside PLA facilities and a state-owned enterprise, to determine whether a tracked individual was behaving abnormally. DeepSeek's relayed traffic exposed live credentials for a Russian defence-ministry-linked government database, and a municipal Chinese Public Security Bureau case-management tool that matched citizens' movements against police records by national ID.

Across every section of the report Anthropic makes the same argument. The labour that used to distinguish well-resourced state operations from lone operators — reconnaissance, exploitation, tool development, foreign-language work, data processing — is now delegated to AI models running in harnesses at machine speed and in parallel. Anthropic said it banned the accounts associated with the operations described, improved its detection systems, and where appropriate shared indicators with governments, industry partners and, in the biology cases, with affected AI labs.