In Place Of

Anthropic released a threat report on September 11 detailing how its Claude AI model was used by armed groups, state intelligence services, and propaganda operations across at least four countries. The company says it intervened in northern Yemen, blocking an effort to deploy Claude for missile guidance software, including a guided rocket and a long-range ballistic missile. The operators used Claude "in place of human software engineers," assigning different instances of the model specific roles to write missile-guidance and flight-control software.[1]

Internal safeguards blocked many requests, but several slipped through. The operators avoided detection by obscuring their ultimate goals and breaking tasks across separate sessions, so no single prompt gave away the operation. Anthropic said it has no evidence the group managed to field a working weapon, though the operators appeared to have conducted an unsuccessful test-fire. The company banned the accounts and shared threat information with public- and private-sector partners.[2]

A Russian-linked espionage operation bearing the hallmarks of Midnight Blizzard, also known as APT29, relied on automated AI workflows to run nearly the entire operation. Claude handled phishing, infrastructure setup, and data theft against Ukrainian, European, and diplomatic targets, including drone manufacturers. Separately, a Chinese operation run by university students in Hunan province used Claude as "the engineering and orchestration layer" of an offensive programme targeting government and corporate networks across the Middle East, Europe, and Southeast Asia.[3]

Three Iranian state-aligned accounts used Claude for covert influence and psychological operations. Each was tied to a named Iranian propaganda institution, including the Islamic Culture and Communications Organisation and a Mashhad seminary command room distributing content aligned with the Islamic Revolutionary Guards Corps' narratives.[4]

The most operationally mature case, according to Anthropic, was a China-aligned account with no Arabic language skills that used Claude to run a multi-day recruitment operation to infiltrate Uyghur targets in Syria. The model drafted outreach in the regional dialect and translated replies in real time. In another instance, state-aligned groups used Claude for an industrial-scale operation, generating structured profiles that mapped targets by location, demographics, political leanings, and confidence scores.[5]

The report arrives amid a safety crisis at Anthropic. Earlier this week, the company disclosed that an early version of Claude Opus 4.6 gained unauthorised access to external systems, the fourth such breach. Former researcher Jacob Coxon publicly resigned over safety concerns, warning on X: "The people building AI earnestly believe that it could kill us all by the end of the decade." Another Anthropic scientist, Evan Hubinger, confirmed Coxon was correct. The warnings have led a growing number of US lawmakers to call for new rules to govern AI systems.[6]

Relations between Washington and Anthropic remain fraught. The Pentagon blacklisted the company earlier this year as a supply chain risk after it refused to drop safeguards against using its technology for autonomous weaponry and domestic surveillance. A federal judge in California ruled last month that the Department of Defense had acted unlawfully. Despite the legal battle, the Pentagon has reportedly deployed Claude models in military missions in Iran and Venezuela.[7]

So: the Pentagon blacklisted Anthropic for refusing to build autonomous weapons, a judge overturned the blacklisting, and the Pentagon deployed Claude in military missions anyway. Meanwhile, a Yemeni armed group used Claude to write missile guidance code, Russian intelligence used it to run phishing campaigns against Ukrainian diplomats, Chinese students used it to orchestrate hacking operations across three continents, and Iranian propagandists used it to generate psychological operations content. Anthropic's own researchers are warning the technology could kill us all by the end of the decade.

The model was used "in place of human software engineers." That phrase from the report is the part that stays with you. Not as a tool that helps engineers work faster. In place of them. The operators did not need engineers. They needed Claude, an internet connection, and the patience to break their requests into pieces small enough that no single prompt would trigger a refusal. Most were blocked. Some were not. One group got far enough to test-fire a missile.