Anthropic published a 154-page threat intelligence report on Thursday detailing how state-linked actors, scientists, and criminal groups used Claude for missile development, biological weapons research, surveillance, and influence operations13,11. The report covers misuse the company disrupted between December 2025 and August 20263.
It is Anthropic's third such report since March 2025.
Weapons and bioweapons
Anthropic said it disrupted a Yemen-based guided weapons engineering cell that used Claude to develop guidance software for missiles, operating in northern Yemen where Iran-backed Houthi militants are active5. The Financial Times and Bloomberg separately reported that Houthis used Anthropic's AI in an effort to build ballistic missiles6,7.
On the biological side, Anthropic said it stopped multiple attempts by scientists this year to use its technology for research that could help develop biological weapons2. The company gave five examples of actors who "circumvented controls" and "obfuscate[d]" the purpose of their research to dodge safeguards, with some users located in nations Anthropic prohibits from accessing its models, including Russia, China, and Iran. One blocked request involved a grant application for gain-of-function research on the chikungunya virus targeting transmissibility and immune evasion properties.
Anthropic said its older models, such as Claude Opus 4 and Claude Sonnet 4.5 from 2025, were "well below the threshold where they could meaningfully assist a sophisticated user in carrying out dangerous biological research". The company said it has applied stronger safeguards restricting dual-use biological research queries in more recent models such as Claude Fable 5.
State surveillance at scale
Anthropic found people linked to governments in Mali, China, and Iran using Claude to streamline surveillance operations1. In Mali, a single consultant working for national security authorities used Claude to create a system that collects data from the country's mobile operators and builds dossiers about people. Iranian actors used Claude to build and deploy a malicious Firefox browser extension that "harvested users' identities from social networks".
A religious affairs intelligence office in China reduced its operations from "many teams of analysts" to "a single office, using an AI assistant to produce thousands of investigations per month," according to the report. Chinese government actors also used Claude to analyze social media data, determine how politically sensitive posts were, and select possible targets for what they called "control," which could include coercive questioning or closer monitoring. One Chinese state security bureau created an internal manual for using AI in surveillance operations.
All surveillance cases in the report involved Claude Haiku, Sonnet, or Opus rather than Anthropic's newer Fable or Mythos-class models. Jacob Klein said AI tools are making state-backed surveillance cheaper and more efficient, increasingly allowing individual government employees or contractors to automate work that once required teams of analysts.
Enforcement and migration
Anthropic said it banned every account tied to the surveillance operations it uncovered and strengthened safeguards based on its findings. In June, the company banned an account that used Claude to build a commercial surveillance platform designed to spy on people in Iran and the Persian Gulf, detecting the use case before it became operational.
Klein said Anthropic has seen actors move to open-source models after its safeguards or enforcement created too much friction. In Mali, the government ultimately deployed its surveillance platform locally using other models.
The report also outlined nine influence operations originating in Russia, Iran, Turkey, and across the Persian Gulf, South Asia, Africa, and Europe. "The cases we share here aren't typical misuse, but rather examples of the most notable and novel threat activity we've identified to date," Anthropic wrote.
ANALYSIS The report's breadth, spanning weapons engineering, biological research, surveillance automation, and influence operations across multiple continents, documents a misuse surface that extends well beyond the prompt-injection and jailbreak scenarios that have dominated prior AI-safety disclosures. The Mali case, where the government migrated to open-source models after Anthropic's enforcement, illustrates a limit on any single vendor's ability to contain downstream harm.