Anthropic says its Claude models were used in projects involving missile software, autonomous drones, cyberattacks and mass-surveillance systems. The company described dozens of operations it says were detected between December 2025 and August 2026. The actors included suspected state-linked hackers, criminals, spyware providers and people working on military projects. Anthropic says it disrupted the accounts involved, although some systems built with Claude may continue operating without further access to the model.
The report covers seven categories of abuse: cyber operations, influence campaigns, surveillance, fraud, biological research, conventional weapons development and the unauthorised extraction of model capabilities for training competing AI systems. Anthropic stresses that the cases are among the most significant and unusual incidents it has identified, rather than a description of typical Claude use.
Claude was used in missile guidance work
One of the most serious cases involved a group in northern Yemen working on three weapons projects in parallel: a guided missile, a multistage ballistic missile with a planned range of more than 2,000 kilometres and a family of missiles that included a hypersonic glide vehicle variant.
Claude Code was used to help develop guidance, navigation and control software. According to Anthropic, the model assisted with autopilot integration, control code, positioning, parameter tuning and flight simulations. Operators reportedly ran several Claude instances at the same time and divided tasks among them in a way similar to a small software-development team.
The project went beyond theory. The group carried out a guided-missile test in Yemen. Anthropic believes the test likely failed because participants returned to Claude within hours to troubleshoot the system. The company says it has no evidence that the group succeeded in producing an operational weapon.
A Russian team worked on an autonomous drone swarm
Another case involved a small team operating in Russia that was developing an autonomous swarm of FPV drones for offensive use. Claude Code was used to write and test software that was then integrated directly into the project.
The system was intended to include swarm coordination, terminal guidance, detection of opposing operators and software allowing targets to be selected and detonation commands to be issued. The design envisaged attacks that could proceed without a human making the final decision. Anthropic also found evidence that parts of the code had been tested on real electronic hardware, although the system remained at an early stage and was still being validated largely through simulation.
Materials from the war in Ukraine were used to train image-recognition components, and locations in the Donetsk region appeared as example targets. Anthropic did not attribute the project directly to the Russian state. It assessed that it was probably run by a small specialised freelance team involved in both civilian and military work.
AI was integrated into mass-surveillance systems
The report also describes the use of Claude by actors connected with surveillance projects in Mali, China and Iran. AI was used to write software, process large datasets and identify individuals for further monitoring.
The largest case involved a platform called Lakana 360 in Mali. Anthropic says a likely independent consultant working for the country’s state security service used Claude as a primary programming tool while building a system intended to cover around 25 million SIM cards across all three national mobile operators.
The platform was designed to analyse calls and messages, identify people by voice, detect VPN and encryption use and combine telecom data with government registers. One feature automatically generated intelligence reports on specified phone numbers.
Anthropic notes that once such a platform is deployed, disabling access to Claude does not necessarily shut it down. In this case, the system was reportedly running locally with other AI models, meaning the account ban stopped further assistance from Claude but did not disable the deployed platform.
Russian cyber campaign used AI across the attack chain
Anthropic also described a highly automated cyber operation whose behaviour it said was consistent with earlier reporting on Midnight Blizzard, a group linked by US authorities to Russia’s Foreign Intelligence Service.
The campaign targeted government, military and diplomatic organisations in Ukraine and Europe. AI was used at multiple stages, from reconnaissance and infrastructure preparation to phishing, gaining access, analysing stolen information and exfiltrating data.
One notable mechanism was automated malware adaptation. When security software detected malicious code, AI agents modified and recompiled it in an attempt to produce a new version that would evade detection.
Anthropic identified more than 20 organisations that were at different stages of targeting, reconnaissance or active operations. The targets included ministries, defence and intelligence institutions, diplomatic facilities, defence contractors and organisations linked to drone technology.
The biggest change is scale and cost
The report does not suggest that AI has created entirely new categories of threat. Cyberattacks, surveillance, espionage and weapons development existed long before generative AI. The difference is the amount of work that can now be carried out by smaller teams.
Anthropic says AI is increasingly moving beyond advice and into execution and coordination. Models can conduct reconnaissance, write code, process information, manage infrastructure and automate parts of an attack. Human operators can therefore spend more of their time selecting targets and supervising outcomes.
That could reduce the cost of sophisticated operations and lower the skills barrier for some activities. Tasks that previously required teams of specialists can increasingly be divided between a smaller number of people supported by AI agents and automation tools.
Anthropic also acknowledges important limitations in its own findings. Most of the evidence comes from the company’s internal investigations, and in several cases attribution is assessed as probable rather than confirmed. The company says it blocked accounts linked to the incidents and used the findings to strengthen its safeguards, but operators can still move to other commercial models or run open models locally.
Source: Anthropic; Reuters; Axios; Associated Press; The Guardian, 10 September 2026.
Original Polish article: ManagerPlus.pl
