A small freelance team in Russia used Claude Code to write the targeting software for a swarm of kamikaze drones that picks its own human targets and issues the detonation command itself, with no person in the loop.^[1] Anthropic disclosed that case, and four others like it, in its own threat intelligence report on September 10, 2026 -- the company's account of how its own product was misused, written and published by the company that sells the product.^[1] The report covers activity Anthropic says it disrupted between December 2025 and August 2026, across seven harm categories: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation.^[1]

The drone swarm

Anthropic tracks the group as GTG-27005, and the team itself called the project "DronDoc" or "Serafim." It began work in mid-May 2026, running nine accounts created between late 2025 and early 2026 that Anthropic linked to a regional Russian university and a federal research center affiliated with the Russian Academy of Sciences -- academic and research infrastructure, not a declared military program. Anthropic's own assessment is that this was a small freelance team, not a state operation, and that it routed its traffic through commercial virtual private servers to get around the geographic access blocks Anthropic had already put in place.^[2]

What Claude Code wrote for them, according to the report, was a full software stack for autonomous first-person-view kamikaze drones operating as a swarm: shared memory so the drones could coordinate as a group, fault-tolerant logic so the swarm kept functioning if individual units dropped out, terminal guidance for the final approach to a target, a control-link geolocation module built specifically to locate the operators flying opposing drones, and a passive acoustic detection layer. The onboard targeting model can select a target -- including a target class labeled "person" -- and issue the detonation command without a human confirming the strike.^[2]

Guided rockets, naval proposals, and an electronic-warfare suite

Anthropic separately describes a cell it tracks as GTG-87001, operating in northern Yemen -- territory the report does not explicitly attribute to the Houthi movement, though the area named is Houthi-controlled. The cell integrated flight software onto a phone-class computer and used Claude for post-launch analysis of a tactical guided rocket. When a test launch failed, the group returned to Claude within hours to work out what had gone wrong.^[3] Separate reporting on the same report describes Iran-aligned actors using Claude to help build ballistic-missile guidance code and to review hypersonic-vehicle designs, and an Iran-linked actor compiling open-source targeting handbooks to track U.S. Navy vessel positions in the Middle East.^[8] The report's conventional-weapons section also references a 200-plus-page Chinese naval anti-torpedo proposal and a 16-module electronic-warfare suite, though with less detail on attribution than the Russian and Yemeni cases.

Five bioweapons cases, and a warning about its own models

Separately from the weapons-development section, Anthropic says its biological-safety systems identified and disrupted five cases of scientists attempting to use Claude in ways that could plausibly support biological-weapons development. In one, from May 2026, a scientist affiliated with a military research institute asked Claude to help draft a grant application for gain-of-function research on chikungunya virus -- a mosquito-borne pathogen with no licensed treatment, capable of causing joint pain lasting weeks or months -- routed through a platform designed to evade Anthropic's access controls; Anthropic's classifier blocked the request.^[5] In a second, a researcher in a region without standard Claude access spent weeks planning mammalian-adaptation experiments on avian influenza; Anthropic says its safeguards confined that activity to Sonnet 4 and Haiku 4.5, its weakest available model class, rather than blocking it outright. In a third, a reseller relay serving more than a dozen unrelated customers let one user run an entire session on Opus 5, drafting a full grant application for orthopoxvirus immune-evasion research -- the family that includes smallpox and mpox -- in about an hour. Two further cases involved venom and toxin redesign programs that Anthropic says had state support.^[5][4]

Anthropic's own language in the report is a break from how the company has previously discussed its safeguards: newer Claude models, it says, can no longer be assumed to fall safely below the threshold for providing meaningful bioweapons assistance -- the first time a major AI lab has said that about its own current models in public, rather than about some future, more capable system.^[4]

Iran, surveillance, and a named target set

The report also documents an Iran-linked actor using Claude to compile material on "hundreds of individuals in Israel and the Jewish diaspora" -- a surveillance and dossier-building use rather than a weapons-development one, and one of the few cases in the report where the target population, rather than just the technique, is specified.^[8] Elsewhere, the influence-operations section describes commercial, for-hire operations -- a France-based network running roughly 70 fabricated news sites and 250-plus inauthentic accounts, and an Istanbul-based platform that sold access to more than a thousand fake accounts used to micro-target voters in a Malaysian election -- alongside state-aligned propaganda pipelines feeding Russian outlets including RT, Sputnik, and TASS.

The distillation section names seven Chinese labs

The report's seventh harm category, "illicit distillation," is where Anthropic makes its most direct competitive accusation: it names seven China-based AI companies -- Alibaba, DeepSeek, Moonshot AI, Xiaomi, Zhipu (also known as Z.ai), MiniMax, and SenseTime -- as running large-scale campaigns to extract Claude's outputs and reasoning traces and use them to train cheaper, competing models.^[7] Anthropic describes Alibaba's campaign, aimed at training its Qwen model family, as the largest distillation attack it has ever measured: more than 151 million exchanges with the Claude API between May and July 2026, peaking near three million a day, spread across more than 3,500 accounts Anthropic flagged as fraudulent.^[6] Anthropic says Moonshot routed customer requests from its Kimi product to Claude without telling those customers, then presented Claude's answers back to them as Kimi's own -- nearly 300,000 requests over one 10-day window, run through more than 5,380 fraudulent accounts -- and that DeepSeek used a similar relay method, generating more than 12 million distillation exchanges over 14 days in July 2026.^[6] Zhipu, Anthropic says, ran a pipeline specifically extracting Claude's chain-of-thought reasoning on cyber-security tasks; Xiaomi replayed developer and coding sessions from its own models through Claude via coding tools; SenseTime purchased transcripts of Claude conversations from third-party data brokers; and MiniMax built a proxy service, operated through a shell company, that resold access to both Anthropic's and OpenAI's models.^[7]

Why does this matter? Every fact in this piece -- the drone swarm with no human in the loop, the five bioweapons cases, the seven Chinese labs training on stolen Claude outputs -- comes from a document Anthropic wrote about itself, chose what to disclose, and published on its own website. No independent regulator, auditor, or court record produced any of it. That is not a reason to discount the report; Anthropic has real incentive to catch this activity, since a bioweapons case or an autonomous-targeting drone traced back to Claude is a business-ending story if a competitor or a government finds it first. But self-disclosure is also a selection process: it shows the cases Anthropic caught, judged safe to publish, and could frame as evidence its safeguards worked, not necessarily the full universe of misuse, successful or not, occurring on its platform. That distinction matters most on the bioweapons finding, where Anthropic is simultaneously the entity being investigated, the investigator, and the only publisher of the results -- a structure no other regulated industry handling comparably dangerous capability would be allowed to operate under. The transparency here is real and substantive. It is also, by construction, incomplete in a way only Anthropic itself is positioned to know.

Addendum: a separate Anthropic-co-authored study shows the report's own method can't see this

A joint study from Anthropic, the UK AI Security Institute, and the Alan Turing Institute found that poisoning an LLM's pretraining data takes a near-constant number of documents -- about 250 -- regardless of how large the model is.^[11] The prior assumption in the field was that an attacker needs to control a fixed percentage of the training corpus, which would make poisoning larger models progressively harder since they train on proportionally more data. This study tested models from 600 million to 13 billion parameters, trained on 6 billion to 260 billion tokens, and found the same roughly 250 documents compromised all of them -- including the largest model, trained on more than 20 times the clean data of the smallest. The same near-constant relationship held when the poisoning happened during fine-tuning rather than pretraining.^[11] The researchers used a low-stakes demonstration attack -- a trigger phrase that makes the model output gibberish -- specifically because it is safe to study at this scale; the finding is about the dynamics of the attack, not a claim that this exact backdoor is what a real adversary would plant.^[12]

Why this belongs here: everything above in this piece is about catching misuse of a model that already works correctly -- a user routing harmful requests through Claude, and Anthropic's own safeguards or threat-intelligence team catching it after the fact. This is a different category of risk: a small, fixed number of documents placed on the open web, before training even starts, can plant a backdoor in the model itself -- invisible in normal use, and not something any amount of usage-monitoring after deployment would catch, because the model behaves normally until the specific trigger appears. Anthropic's own report above is a genuine account of a real detection system working. This finding is a reminder that detection-after-deployment and defense-in-training are two different problems, and the report above only demonstrates progress on the first one. Evolving how AI actually works -- training processes that can verify or exclude poisoned data before a model ever ships, not just monitoring what a finished model is asked to do after -- is the open half of the problem this report doesn't touch.