Anthropic’s Claude AI threats include missile guidance and mass surveillance

Anthropic has spent the past eight months chasing its own AI model through some of the darkest corners of the internet, and the picture it just published isn’t pretty. From missile guidance software in Yemen to a surveillance dragnet covering 25 million SIM cards in Mali, the company’s latest threat intelligence report lays out a sprawling catalog of Anthropic Claude AI threats that stretch far beyond the usual phishing emails and chatbot jailbreaks security teams used to worry about.

The report, covering December 2025 through August 2026, doesn’t read like a routine transparency exercise. It reads like a case file. Espionage groups rewriting malware on the fly. Chinese AI labs quietly funneling their own customers’ questions through Claude to train rival models. A single consultant using the chatbot as an entire engineering team to build a national surveillance system. Anthropic disclosed all of it itself, framing the findings as evidence that its detection systems are catching increasingly sophisticated misuse — even as it admits some of that misuse slipped through for weeks or months before being shut down.

Scope and Overview of Claude AI Misuse

Anthropic’s report sorts the misuse it found into seven categories: cyber operations, influence operations, surveillance, fraud, biological misuse, conventional weapons development, and unauthorized model distillation. It’s the company’s first such disclosure of the year, and it covers a window running from December 2025 to August 2026.

The models most affected were Haiku, Sonnet, and Opus — Anthropic’s workhorse Claude versions widely used through coding tools and APIs. Notably, the company’s newer Fable and Mythos-class models barely showed up in the case files at all, appearing in just a single distillation incident. Anthropic says the report is built to highlight novel misuse patterns rather than catalog routine abuse, which is part of why the findings skew toward creative, high-effort operations rather than run-of-the-mill scams.

Cyber Operations and Espionage Enabled by Claude

The cybersecurity chapter’s headline finding is blunt: sophisticated attacks no longer require sophisticated attackers, and the polish of an operation is no longer a reliable clue about who’s behind it. The individual techniques — stolen credentials, unpatched devices, SQL injection, phishing — are nothing new. What changed is the economics, since reconnaissance, exploitation, and tool-building can now be handed off to AI agents running in parallel at machine speed.

Malware that rewrites itself to dodge antivirus

Anthropic tracks one Russian-speaking espionage cluster, labeled GTG-20006. The actor built a feedback loop in which AI agents repeatedly checked whether its malware was being flagged by security software, and each time an antivirus tool caught it, the agents rewrote and recompiled the code themselves until it slipped past detection again. That shifts the burden onto defenders, Anthropic argues, because new detection signatures stop working the moment an attacker can cycle through code changes faster than defenders can respond.

More than 20 organizations were targeted in this campaign, including government ministries, intelligence services, embassies, and defense contractors, with a heavy focus on Ukraine and Europe. The drone supply chain came up repeatedly, and the group stole a complete proprietary software development kit for a drone vision system. Some access ran through third parties, including compromised hotel guest Wi-Fi networks that Microsoft separately described in July 2026 under the name CaptiveCrunch.

Separately, Anthropic attributes a wave of industrial-scale credential mining to the ShinyHunters collective, tracked as GTG-50014. One hacker reportedly downloaded 1.8 million Android apps, decompiled them, and combed the code for hardcoded secrets — a method Anthropic calls “vibe hacking,” where a human sets a loose goal and the model handles the iteration. One of the hackers involved claimed to have collected HackerOne bug-bounty payouts on top of extorting two companies.

Unauthorized Model Distillation by Chinese AI Labs

Perhaps the most commercially explosive part of the report involves seven Chinese AI labs that Anthropic says covertly mined Claude for training data, a practice it calls illicit distillation. Distillation itself is a legitimate training technique, but Anthropic draws the line at industrial-scale, covert extraction carried out through networks of fake accounts, stolen credit cards, and API keys routed through what the report calls “transfer stations.”

Alibaba’s Qwen, Moonshot and DeepSeek reroute customer data

The largest campaign Anthropic says it has ever measured is tied to Alibaba’s Qwen lab, tracked as GTG-16005. Operators used a fixed prompt to get Claude to expose its internal reasoning traces before answering, then converted the transcripts into fine-tuning data for the Qwen 3.5, 3.6, and 3.7 models. Per CNBC’s reporting on the disclosure, the campaign peaked at almost three million exchanges a day from more than 3,500 fraudulent accounts, adding up to over 151 million exchanges between May and July 2026 — mostly tied to agentic tasks and software development work.

Even stranger were cases where labs quietly rerouted their own paying customers’ requests to Claude. Moonshot AI, the company behind the Kimi chatbot, relayed nearly 300,000 customer requests to Anthropic over a 10-day stretch, funneled through 5,380 fraudulent accounts largely based in Singapore and Japan — while its own users believed they were talking to a Kimi model. CNBC reports that Moonshot saved some of those exchanges and extracted Claude’s reasoning transcripts as training data, with more than 23 million exchanges tied to the lab between May and July overall.

DeepSeek ran a similar playbook, according to Anthropic, using string-matching to detect when requests came from tools like Claude Code, then rerouting flagged traffic to Claude Opus — more than 12.1 million exchanges over 14 days in July 2026 alone. Buried in that traffic, Anthropic says it found a user likely tied to the People’s Liberation Army who had Claude analyze CCTV archive footage from hundreds of cameras across Chengdu, including cameras positioned outside PLA facilities. Through the same DeepSeek pipeline, Claude reportedly also handled requests from an operator holding live credentials for a database linked to the Russian Ministry of Defense, plus work on a case-management system for a Chinese public security bureau that cross-references movement data against police records.

Other labs named in the report took different approaches. Xiaomi allegedly stored coding sessions from users of its own MiMo models and replayed them through Claude to generate training data — Anthropic says it found no evidence Claude’s answers were served back to Xiaomi’s users directly, but the intercepted requests still contained personal data such as names and contact details for hundreds of people across a dozen languages. Zhipu, known internationally as Z.ai, rotated through 273 accounts and pushed more than 770,000 exchanges in ten days through an automated “CoT cleaner” tool to train its GLM-5.3 model, reportedly abandoning an initial attempt to target Claude’s Fable model once its safeguards degraded output quality. SenseTime, Anthropic says, skipped the legwork entirely and simply bought transcripts from a third-party market, while MiniMax ran its own proxy network through a shell company offering only Anthropic and OpenAI models.

This is where the story stops being just a cybersecurity footnote and starts looking like a competitive and legal flashpoint. Anthropic’s own report language calls the practice “likely inconsistent with privacy laws and the labs’ own terms of service” — a pointed accusation given how much these companies compete directly with Claude in global AI markets. If regulators or courts eventually treat unauthorized distillation as IP theft rather than a gray-area training shortcut, it could reshape how frontier labs police access to their models going forward.

Military Applications: Weapons Software and Autonomous Drones

For the first time, Anthropic’s report documents cases of Claude being used directly in weapons development rather than just adjacent cyber activity. In northern Yemen, a cell tracked as GTG-87001 reportedly used Claude Code in place of human software engineers to build guidance, navigation, and control software for three missile programs, including a multistage missile with a target range of more than 2,000 kilometers. The group ran several Claude instances in parallel, spreading the work across sessions so no single conversation revealed the full intent. After a test launch apparently failed, the actors reportedly returned to Claude within hours to diagnose the cause.

The BBC’s summary of the report notes six total cases in which Claude was used to develop software for conventional weapons, spanning firearms, missiles, armed drones, and bombs, along with the targeting systems that operate them.

Mass Surveillance Powered by Claude

In Mali, a single consultant reportedly used Claude as the primary engineering workforce behind a platform called “Lakana 360,” built to monitor roughly 25 million SIM cards across all three of the country’s national mobile carriers. The system can identify people by voice across SIM swaps, flag users of encryption or VPN tools, and link individuals to Mali’s national biometric civil registry. Suspending the developer’s account only interrupted further development — the platform itself keeps running on local, on-premises models. According to Anthropic, a comparable scheme was identified among Iranian operatives who reportedly tracked and built profiles on 6,388 Iranians over the course of a year.

This is one of the clearer illustrations of why these AI cybersecurity threats matter beyond the tech industry itself: once a surveillance tool is built and deployed on local infrastructure, cutting off the developer’s access to the model that helped design it does little to stop the system from operating.

Biological Research Risks and Anthropic’s Response

Biology emerges as the area where the report is most candid about shortcomings, with Anthropic outlining five anonymized instances in which real scientists received assistance from Claude on research carrying dual-use risks. In one instance, a grant proposal for gain-of-function research on the chikungunya virus intended for a military research institute was flagged and rejected by the company’s biosecurity classifier — yet the operator running the platform had already engineered a workaround that redirected such rejected requests to a rival AI model, a solution largely coded by Claude itself. Other projects, such as an application involving immune-evasion genes in orthopoxviruses, ran largely unimpeded.

Anthropic’s head of threat intelligence, Jacob Klein, described the challenge to the New York Times as “an incredibly nuanced situation,” adding: “You are not seeing someone in a comic book kind of way say, ‘Hey, I want to build a biological weapon to kill everybody.'” Anthropic itself puts it more starkly in the report, noting that the same information that could help build a biological weapon could just as easily support a vaccine or a cure — meaning classifiers can’t reliably tell intent apart from legitimate science.

In response, Anthropic has rolled out Claude Fable 5 with tighter safeguards specifically for dual-use biology requests, alongside stronger protections against unauthorized distillation. A feature called “preserved thinking,” introduced with Fable 5.1, is designed to stop new API accounts from manipulating a model’s internal reasoning process to extract training data. Anthropic says the only reliable path to safely unlocking frontier biology capabilities runs through verified-user programs rather than open access.

Anthropic says it has folded these findings into its own detection systems and shared relevant intelligence with authorities and industry partners. The disclosure lands amid a broader wave of similar reporting across the AI industry — Google flagged a comparable case involving its Gemini model just days earlier — and against a political backdrop where U.S. Senator Bernie Sanders has called for a pause on advanced AI development, while President Trump has argued the bigger risk is falling behind in the AI race altogether. Whatever direction that debate takes, Anthropic’s own numbers suggest the harder problem isn’t building smarter safeguards — it’s staying ahead of attackers who can now automate their way around them just as fast as defenders can respond.

FAQ

What period does Anthropic’s threat report cover?

The report covers AI misuse incidents from December 2025 through August 2026.

Which Claude AI models were most affected by misuse?

The most affected models were Haiku, Sonnet, and Opus, while the newer Fable and Mythos models appeared in only a single distillation case.

How did cyber attackers use AI to evade antivirus detection?

A Russian-speaking group tracked as GTG-20006 used AI feedback loops to repeatedly rewrite and recompile malware code until it evaded antivirus tools.

What kinds of unauthorized activities involved Chinese AI labs regarding Claude?

Chinese labs including Alibaba’s Qwen team, Moonshot AI, and DeepSeek ran industrial-scale unauthorized distillation campaigns, routing customer requests through Claude and using its responses to train their own competing models.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.