Anthropic says Claude was abused to automate attacks and weapons work

Anthropic published a report on 10 September 2026 detailing how state-sponsored and criminal groups abused its Claude models for cyberattacks, weapons software, influence operations and biological research. The company said the activity it disrupted ran from December 2025 to August 2026 and spanned seven "harm areas": cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development and distillation.

According to The Register's account of the report, the misuse involved the Claude Haiku, Sonnet and Opus models. Anthropic said its most powerful Claude Fable and Mythos-class models were not used, except in one distillation case.

The most detailed cyber case involves a group Anthropic tracks as GTG-20006, which it describes as the state-sponsored cyber espionage arm of Russia's Foreign Intelligence Service, also known as Midnight Blizzard, APT29 or Cozy Bear. Anthropic said the group used customised AI-driven workflows that automated much of its operations, from development and infrastructure acquisition through phishing, persistence via command and control, to data exfiltration. More than 20 organisations were targeted, including embassies, think tanks, defence-industrial companies and government, defence and intelligence agencies across Ukraine, Europe, the Middle East, Asia and North Africa. The Hacker News reported that the group also built an AI-assisted workflow to rebuild malware after detection, in an effort to stay ahead of defenders.

Anthropic also described "multiple clusters" linked to the data-theft-and-extortion gang ShinyHunters. One affiliate that specialises in supply-chain attacks breached a software-as-a-service provider and used that access to steal data from roughly 200 of the provider's customer organisations. The report says the affiliate then carried out a session-store dump containing more than 2,100 Azure AD token sets across more than 40 corporate tenants in about 34 hours, and that "AI agents performed nearly all of the work".

The report documents five cases of users in unsupported regions using Claude to support biological weapons development. In one, a scientist sought help writing a grant application for chikungunya virus research focused on transmissibility and immune evasion. Anthropic said such work could help develop better vaccines, but could also be used to make the pathogen more dangerous, and that the military research institute involved gave it cause for concern. In May, the company found a user outside the US researching adaptations of highly pathogenic avian influenza.

Anthropic said it has added a new misuse category covering conventional weapons software, and shared six cases: three in China, two in Russia and one in Yemen. In Yemen, a weapons programme used Claude in place of human software engineers to write guidance, navigation and control software. "Our safeguards blocked many of their requests, but not all of them," Anthropic said. It found no evidence of an operational device, but said the actors test-fired a guided rocket and had built an offline simulation toolkit that does not depend on Claude. In China, a user drafted a specification for an anti-torpedo fire control system and an acquisition proposal, repeatedly asking Claude to role-play a hostile reviewer. A likely Russian freelance team used Claude to build core software for an autonomous kamikaze drone swarm.

Anthropic said it banned the accounts involved and shared threat information with public- and private-sector partners. It said it hopes the findings help other developers spot similar patterns on their own platforms.