Anthropic disrupted Claude misuse across weapons engineering, cyber espionage, mass surveillance and fraud, according to a threat-intelligence report published in September. The company says the cases occurred from December 2025 through August 2026 and involved state-linked groups, criminals, spyware vendors and individual operators.

The report identifies four especially consequential patterns:

• Claude helped automate major parts of cyberattack chains.
• Weapons teams used it for guidance and targeting software.
• A contractor built a national surveillance platform with its assistance.
• A dating-app network deployed thousands of deceptive AI personas.

More on This Story

• U.S. Warns China AI Distillation Campaigns Target Frontier Models
• California Enacts AI Child Safety Laws, Bans Addictive Feeds and Chatbot Toys

Anthropic Disrupted Claude Misuse Across Seven Harm Areas

Anthropic’s September threat report covers cyber operations, influence campaigns, surveillance, scams, biological misuse, conventional weapons development and illicit model distillation. It says Claude Haiku, Sonnet and Opus models appeared in the investigated activity.

The company says none of the cases involved its newer Fable or Mythos-class models, apart from one distillation matter. Anthropic says it banned linked accounts, strengthened detections and shared intelligence with authorities or industry partners when appropriate.

These are Anthropic’s internal investigative findings, not court judgments or independent confirmations of every attribution. The company uses internal Generative Threat Group identifiers and sometimes withholds countries, institutions and individuals to protect sources or because intent remains uncertain.

That caveat matters most in biological research. Anthropic documented five cases with potential dual-use implications but explicitly said it was not asserting that the scientists intended harm. It described the assistance in some cases as clerical or limited, while warning that more capable models could increase future risk.

Claude Misuse Operations Automated Cyber Espionage

The report’s clearest technical shift is from chatbot assistance toward orchestration. Anthropic says a majority of the cyber operations it studied used AI for direct execution or coordination across reconnaissance, exploitation and data exfiltration, while human operators selected targets and reviewed stolen material.

One actor, whose behavior Anthropic says was consistent with public reporting about Russia-linked Midnight Blizzard, used AI-driven workflows against Ukrainian and European government, military and diplomatic targets. More than 20 organizations appeared in its planning, reconnaissance or active operations.

According to the report, the workflow handled phishing infrastructure, malware development, credential theft and parts of lateral movement. It also monitored whether security products detected malicious tools, then modified and rebuilt those tools in an effort to evade newly deployed defenses.

Anthropic says the same actor bulk-exported mailboxes at two drone-component manufacturers and stole a software development kit for a drone-vision system. Other compromises involved cloud-email records, national identity information and corporate registry data.

The operational implication is significant even when a model does not discover a novel vulnerability. Automation can compress the time between access, exploration and theft while letting one operator adapt to unfamiliar systems. Defenders may therefore need behavioral monitoring that follows an intrusion across tools, identities and cloud services.

Weapons Cases Reached Software, Simulations and a Field Test

Anthropic describes six conventional-weapons cases: four involving software for weapons and two focused on procurement or intelligence. The projects included a guided rocket, anti-torpedo fire control, a simulated drone swarm, electronic-warfare targeting, dual-use procurement and directed-energy research.

In northern Yemen, a cell allegedly used several Claude instances as a small engineering team to work on guidance, navigation and control software. Anthropic says the actors integrated an open-source autopilot with a phone-class flight computer and created simulations for guided and longer-range missile concepts.

The company found no evidence that the group fielded an operational system. It did, however, report a guided-rocket test that appeared to fail, followed within hours by attempts to diagnose the failure with Claude. Anthropic banned the associated accounts but said the group had already produced an offline simulation toolkit.

Another China-based actor used Claude to draft a technical proposal exceeding 200 pages for an anti-torpedo system, according to the report. Anthropic assessed that the actor was associated with a defense manufacturer seeking approval for work intended for the People’s Liberation Army Navy.

Anthropic says actors divided tasks across conversations, concealed the intended end use and sometimes bypassed safeguards. The company has since added classifiers aimed at detecting requests involving high-yield explosives and weapons development, though it acknowledged that its controls blocked many requests rather than all of them.

Surveillance and Fraud Show the Scale of AI-Assisted Abuse

In Mali, Anthropic says one subscriber served as the primary software engineer for Lakana 360, a domestic surveillance platform designed for the national intelligence service. The system was built to monitor roughly 25 million SIM cards across all three national mobile operators.

The described capabilities included collecting calls, messages and voice traffic, linking people across SIM cards and generating intelligence dossiers. Anthropic says a warrant check was removed from the dossier component and that the deployed platform ultimately ran locally, beyond the reach of an account ban.

A separate China-based app studio allegedly used Claude to build more than 20 deceptive dating apps and operate 4,700 AI personas. Anthropic counted at least 25,000 people interacting with those personas during a two-week period in April, producing about 2.36 million messages.

Real gig workers were mixed into the service for video calls and social-media checks, at a reported ratio of about three AI personas for each human profile. That hybrid design illustrates how automation can scale a scheme while people handle moments where authenticity is harder to fake.

The report gives model providers useful detection signals, but it also exposes a structural limit: disabling an account cannot remove software, datasets or offline tools already created with a model. Effective containment will require controls across identity, payments, resellers, cloud infrastructure and downstream platforms.

For security teams, the immediate lesson is to track AI as part of an attacker’s operating system rather than as a standalone chatbot. The next measure of progress will be whether shared indicators and stronger access controls can shorten detection time without blocking legitimate scientific, security and engineering work.