Anthropic has disclosed a series of cases in which its Claude artificial intelligence models were allegedly used by state-linked actors, cyber operators and other groups for activities ranging from weapons development and biological research to cyber operations, surveillance, political targeting and fraud.
The cases were detailed in Anthropic’s latest threat intelligence report, which outlines how increasingly capable AI systems are being incorporated into sophisticated operations across the security landscape. The company said it identified and disrupted several of the activities, while acknowledging that its safeguards did not prevent every prohibited request.
The disclosures offer a broad look at how AI models can be integrated into real-world operations. The reported cases range from assistance with military research and cyber intrusion workflows to large-scale surveillance systems and automated social-engineering operations.
Anthropic’s findings also underscore a growing challenge for AI developers: preventing models designed for general-purpose assistance from being repurposed for activities that could create significant security or human-rights risks.
AI allegedly used in Chinese military-related research
Anthropic described several cases involving China-based actors that it said appeared connected to military or defence-related activities.
In one case, the company said an actor used Claude to develop an electronic-warfare and air-defence suppression software suite. The system reportedly included capabilities for ranking targets and modelling radar-jamming scenarios.
During the project, the actor modified a simulation to include 12 targets in Taiwan, including early-warning radar systems, Patriot and Tien Kung missile batteries, air bases and a command bunker.
Anthropic said account information linked the operator to Chinese research institutions, including the People’s Liberation Army Academy of Military Sciences, and that accounts associated with the actor were subsequently banned.
China’s Foreign Ministry said it was not aware of the report and reiterated that China supports the development of AI for beneficial purposes while opposing what it described as distortions and smears against the country.
In another case, Anthropic said a China-based actor used Claude to assist with the development of specifications and fire-control software for an anti-torpedo system intended for the Chinese navy.
The actor reportedly used the model to produce a technical proposal exceeding 200 pages, compare the proposed system with U.S. Navy technology and simulate hostile technical reviews designed to improve the proposal.
Anthropic assessed that the actor was associated with a Chinese defence-industry manufacturer seeking to develop a weapons specification and acquisition proposal for the People’s Liberation Army Navy.
Research into microwave weapons
Anthropic also reported activity involving research into high-power microwave weapons.
According to the company, a China-based defence-intelligence actor used Claude to research foreign microwave weapons, identify components and suppliers and trace supply chains.
The actor allegedly sought information that could assist with reverse engineering and countermeasure development and used Claude to prepare restricted briefings intended for senior Chinese Communist Party, military or state-security officials.
The disclosure illustrates how general-purpose AI models can potentially accelerate research across complex technical fields by helping users organise information, analyse systems and produce technical documentation.
Claude used in alleged Yemen missile research
Anthropic said a group of threat actors in northern Yemen used Claude in efforts related to the development of several missile and rocket systems.
The company said the group used Claude for coding, simulation and troubleshooting associated with a guided rocket, a planned ballistic missile with a range exceeding 2,000 kilometres and a missile variant incorporating a hypersonic glide vehicle.
Anthropic said its safeguards blocked many of the group’s requests, but not all of them.
Importantly, the company said it had no evidence that the actors successfully fielded an operational weapon as a result of the activity.
The disclosure comes amid heightened tensions involving the Iran-aligned Houthis, who control much of northern Yemen. Anthropic did not identify whether the actors involved in the reported missile-development activity were Houthis.
Russian actors allegedly used Claude for drone development
Anthropic also identified what it described as likely Russia-based freelance actors using Claude to develop software for an autonomous swarm of first-person-view attack drones.
The reported work included terminal guidance, target selection and coordination between multiple aircraft.
Small FPV drones have become a major component of modern warfare, particularly in the Russia-Ukraine conflict, where both sides have deployed large numbers of drones for reconnaissance and attacks.
The Russian Embassy in Washington did not respond to questions about Anthropic’s specific allegations or the report as a whole.
Anthropic separately said a Russia-based procurement manager used Claude to identify intermediaries in China and Hong Kong for acquiring European-made goods with potential military applications.
The items reportedly included German-made magnetometers, space-grade photovoltaic wafers and aviation oxygen systems. The actor allegedly explored routes through third countries that could obscure the final destination of the equipment.
Biological research raises additional concerns
Anthropic detailed five cases involving attempts to use its models for activities that could potentially support biological weapons development.
Among the reported examples was an effort to use Claude to prepare a grant application for research involving modification of the chikungunya virus.
In another case, Anthropic detected attempts to research highly pathogenic avian influenza. The company said the users involved were operating from locations where Anthropic does not offer its services and allegedly attempted to obscure their locations to access the models.
Additional cases involved research into orthopoxviruses and non-transmissible novel venoms and toxins.
The cases demonstrate another dimension of AI safety concerns, as increasingly capable models can potentially assist with complex biological research even when users attempt to circumvent geographical or platform restrictions.
AI integrated into large-scale cyber operations
Anthropic said one Chinese-speaking group, likely based in Changsha, used Claude during cyber operations targeting approximately 50 organisations, including foreign government networks.
The company said the operation involved AI-driven workflows that searched for previously unknown software vulnerabilities, developed exploits and conducted portions of intrusions with limited human supervision.
According to Anthropic, the group included two university students in Hunan.
The incident is significant because it illustrates a shift from using AI merely as an assistant for individual technical tasks towards integrating models into broader, semi-automated attack workflows.
In another case, Anthropic said a hacking group allegedly used AI extensively during phishing, hotel Wi-Fi hijacking and WhatsApp account-takeover operations targeting Ukrainian government, military and diplomatic organisations.
The group’s techniques were described by Anthropic as consistent with the Russia-based threat actor Midnight Blizzard, which the U.S. government has previously associated with Russia’s SVR foreign intelligence service.
Iranian-linked operator allegedly targeted naval information
Anthropic also reported an Iranian-linked operation involving intelligence collection against U.S. naval forces.
The company said an operator used Claude to collect and analyse publicly accessible information and turn it into targeting recommendations.
The information allegedly included lists of U.S. personnel gathered from captions accompanying publicly available military photographs, publicly accessible ship and aircraft transponder identifiers and scripts for querying commercial satellite imagery.
Anthropic also said the operator used Claude to research software vulnerabilities associated with shipboard systems, including satellite and other communications equipment and industrial-control products.
The company said it identified and disrupted the activity.
AI used for surveillance operations
Anthropic’s report includes several cases involving surveillance.
In one example, the company said a China-aligned actor used Claude to identify and approach Uyghurs in Syria, including people considered financially or personally vulnerable.
The reported objective was to offer payments in exchange for information about Uyghur units that had joined Syria’s newly established army.
Anthropic assessed with low confidence that the operator could have been a contractor working for Chinese state security.
The company also said China-linked actors used Claude to compile intelligence on Catholic cardinals, Taiwanese Christian leaders, Tibetan Buddhists, dissidents and activists.
In a separate operation, Claude was allegedly used to automate government-style reports tracking Uyghurs, Tibetans, Taiwanese political figures, labour and student activists and foreign media.
China has consistently rejected allegations of transnational repression and other accusations concerning surveillance of critics overseas.
Commercial surveillance platform detected
Anthropic said it also banned an account that was used to develop a commercial surveillance platform designed to analyse, classify and profile social-media activity in Iran and the Gulf region.
The company said its findings were consistent with an earlier investigation by the journalism network Forbidden Stories into a service promoted by a company called S2T Unlocking Cyberspace.
Anthropic said it detected the activity during its pilot stage and found no evidence that subsequent stages of the surveillance system had been deployed against real targets before the account was banned.
S2T did not immediately respond to a request for comment.
Iranian-linked profiling of Israeli and Jewish organisations
Another case involved what Anthropic described as an Iranian-linked operator using Claude to build an automated open-source intelligence identity-profiling system targeting Israeli government and non-government individuals as well as Jewish diaspora organisations.
The company said the operator ran the system against an existing target list and also attempted to generate intelligence products concerning Israeli and U.S. individuals.
Anthropic separately said it identified and banned 16 Claude accounts operated by two linked units associated with unidentified Iranian paramilitary and domestic-security agencies.
One of the organisations allegedly maintained an identity-record database of Iranian nationals, while another used Claude while working on a malicious browser extension intended to harvest user identities from major social-network platforms.
Iranian government representatives at the United Nations did not immediately respond to a request for comment.
Mali surveillance platform allegedly monitored millions of SIM cards
Anthropic also described an operation in Mali involving a domestic surveillance platform known as Lakana 360.
The company said Claude was used as the primary engineering tool for a system developed for Mali’s state intelligence service that could potentially monitor information associated with approximately 25 million SIM cards across the country’s three mobile operators.
Anthropic said the system appeared to have been developed largely by a single consultant working with Mali’s National State Security Agency.
The office of Mali’s prime minister did not immediately respond to a request for comment.
AI-assisted political targeting and influence operations
The threat intelligence report also identified activity involving political organisations and media.
Anthropic said it observed a French-speaking actor targeting 42 European political parties, media organisations, think tanks and software-as-a-service providers used by those organisations.
According to the company, the operation involved stealing data and login credentials and creating what Anthropic described as a purpose-built doxxing platform capable of gathering and exposing information about individuals.
The case highlights concerns that AI could lower the operational cost of political targeting by automating information collection, credential-related activity and the organisation of personal data.
AI-generated dating personas used in alleged scams
Anthropic also reported an AI-driven dating-app operation based in China.
The company said the operation developed more than 20 dating applications containing over 4,700 AI personas that interacted with at least 25,000 users.
The operation allegedly combined automated AI-generated personas with paid human workers to persuade users that they were interacting with genuine individuals.
Such operations demonstrate how AI-generated personas can potentially be used at scale for social engineering and fraud, allowing operators to conduct large numbers of interactions simultaneously.
Growing challenge for AI safety
Anthropic’s report illustrates the expanding range of activities in which advanced AI systems can potentially be incorporated.
The reported cases span military research, weapons-related engineering, biological research, cyber operations, intelligence collection, surveillance, political targeting and fraud. The common thread is the use of AI to accelerate tasks that traditionally required significant human expertise, time or resources.
At the same time, Anthropic’s own findings demonstrate the limitations of existing safeguards. The company acknowledged that some prohibited requests were blocked while others were not.
The challenge is particularly difficult because general-purpose AI models are designed to perform a broad range of legitimate tasks. The same capabilities that make a model useful for programming, research, data analysis and writing can potentially be repurposed in harmful contexts.
Anthropic said it had taken action against accounts associated with the reported activities and was continuing to investigate and disrupt misuse.
The disclosures are likely to add momentum to the broader debate over how AI companies should monitor advanced models, identify malicious use, coordinate with affected organisations and governments, and disclose incidents involving potentially dangerous applications.
As AI systems become more autonomous and capable of completing multi-step tasks, the central safety challenge is increasingly moving beyond what a model can generate in isolation to how those capabilities can be combined and operationalised in the real world.
Disclaimer: This report has been editorially prepared using publicly available information and official statements. Readers are advised to refer to official announcements for further details.
Author
About the Author
