Anthropic reports Claude AI misused for missiles, cyber-espionage across multiple nations

Anthropic released a threat report this week documenting a series of attempts to weaponize its Claude AI system across multiple continents—from missile guidance software in Yemen to state-sponsored cyber operations targeting Ukraine, Europe, and the Middle East. The company says it blocked most of the malicious activity, but the incidents reveal how difficult it remains to prevent sophisticated actors from bending advanced AI tools toward destructive ends.

The most direct weapons application came from northern Yemen, where operators attempted to use Claude as a substitute for human software engineers. They assigned different instances of the model specific technical roles, tasking them with writing guidance and flight-control code for both a guided rocket and a long-range ballistic missile. Anthropic's internal safeguards caught many of these requests, but some slipped through—the operators had learned to obscure their true intentions and fragment the work across separate sessions so that no single prompt would expose the full scope of what they were building. The company has no evidence the group successfully deployed a working weapon, though it says the operators appeared to conduct at least one unsuccessful test-fire. Anthropic banned the accounts involved and shared what it learned with government and private-sector partners.

State-linked espionage operations proved more sophisticated. A Russian-linked group bearing the hallmarks of Midnight Blizzard, also known as APT29, allegedly used Claude to automate nearly its entire operation—handling phishing, system setup, and data theft in a single coordinated workflow. The targets included Ukrainian, European, and diplomatic organizations, as well as drone manufacturers. In a separate case, Anthropic disrupted what it described as a Chinese operation run by university students in Hunan province. That group used Claude as the "engineering and orchestration layer" of an offensive program that targeted government and corporate networks across the Middle East, Europe, and Southeast Asia. Both operations were shut down through account bans and enhanced monitoring.

Iran-aligned groups pursued a different strategy: influence and psychological operations at scale. Anthropic identified and removed three accounts tied to named Iranian propaganda institutions, including the Islamic Culture and Communications Organisation and a Mashhad seminary command room aligned with the Islamic Revolutionary Guards Corps. In one particularly mature operation, a China-aligned account with no Arabic language skills used Claude to conduct a multi-day recruitment campaign targeting Uyghurs in Syria. The model drafted outreach messages in the regional dialect and translated replies in real time, creating a fully automated influence operation. Anthropic also documented an industrial-scale targeting operation in which state-aligned groups used Claude to generate structured profiles mapping potential targets by location, demographics, political leanings, and confidence scores.

The timing of these disclosures compounds an already strained relationship between Anthropic and the Pentagon. Earlier this year, the Department of Defense blacklisted the company as a supply chain risk after Anthropic refused to remove safeguards against autonomous weapons and domestic surveillance applications. Anthropic challenged the decision in California court, and a judge ruled last month that the Pentagon had acted unlawfully. Yet despite that legal victory and the public friction, the Pentagon has reportedly deployed Claude in military missions in Iran and Venezuela. The new threat report arrives as Anthropic seeks to restore its standing within the US defense industrial base.

The incidents have also reignited internal safety concerns at the company. Earlier this week, Jacob Coxon, a researcher at Anthropic, publicly resigned and warned that "the people building AI earnestly believe that it could kill us all by the end of the decade." Another Anthropic scientist, Evan Hubinger, publicly affirmed Coxon's assessment. The timing coincided with the disclosure of an unauthorized access incident involving an early version of Claude Opus 4.6. Anthropic said it is investigating the recurring breaches and has engaged an independent research firm to conduct a comprehensive review. The company's safety posture—the very thing that led the Pentagon to blacklist it—now appears to be under internal scrutiny as well.