Anthropic released a threat‑intelligence report on Thursday detailing how its Claude family of models was leveraged in a series of malicious projects from December 2025 through August 2026. The company said it had disrupted multiple incidents involving biological‑weapon research, conventional weapons software, cyber‑espionage, surveillance scams and political propaganda, and chose to publish the findings out of a sense of responsibility to alert the public.
Among the most serious incidents were five cases where actors allegedly used Claude to generate knowledge that could aid biological‑weapon development, a risk Anthropic described as one of the gravest threats posed by frontier AI. The report also listed six instances of AI‑assisted software creation for firearms, missiles, armed drones, bombs and targeting systems, underscoring how generative models can automate technical design work that previously required specialist expertise.
Cyber operations featured prominently, with state‑backed and criminal groups such as ShinyHunters and the Russia‑linked Midnight Blizzard incorporating Claude into offensive workflows. In one documented operation, the AI helped rewrite malware code after detection, enabling it to evade defenses more rapidly. Chinese‑based laboratories were also cited in separate espionage activities, and a Russia‑linked campaign used Claude to bolster surveillance of dissidents.
Beyond hacking, Anthropic identified misuse in fake dating apps, hotel‑Wi‑Fi scams and an Iranian propaganda outlet that employed Claude for disinformation. The incidents spanned Claude Haiku, Sonnet and Opus models, while the larger Mythos‑class models were largely untouched except for a single “distillation” case. Following the disclosures, Anthropic said it has integrated the lessons into its safety processes and shared relevant intelligence with government and industry partners to improve detection and disruption.
