America’s enemies no longer have to steal every piece of advanced technology they want. Occasionally, they open an American artificial intelligence tool and ask it for help.
Anthropic’s latest threat report documents actors in northern Yemen, China, Russia, and Iran using Claude for work tied to missiles, drone swarms, electronic warfare, military procurement, surveillance, and intelligence collection.
Anthropic says it identified the operations, banned the accounts, and strengthened its safeguards.
The most disturbing case came from northern Yemen. A weapons-development cell used Claude Code as something resembling a small engineering department.
From Anthropic’s report:
We identified a cell of threat actors based in northern Yemen running three weapons development programs: a guided rocket that used a commodity phone-class flight computer with final-phase homing guidance; a multi-stage ballistic missile with a stated range goal above 2,000 km; and a multi-variant missile (referred to as the “R2000” set) that included a hypersonic glide vehicle variant.
The actors used Claude Code in place of human software engineers to develop the guidance, navigation, and control (GNC) software that steers and stabilizes a flying vehicle. For example, they used Claude to integrate an open-source autopilot onto a phone-class flight computer, writing the control and position estimation software, tuning the control settings, running a firmware build pipeline, and performing a flight simulation. The actors managed several Claude instances at once, assigning each one a role, much as a lead would delegate work on a small engineering team: the actors tasked one instance with writing the code, another with research, and a third with reviewing the code the first instance produced.
Our safeguards blocked many of their requests, but not all of them. The actors used a variety of tactics to evade our safeguards, including hiding their goals and the products the software was meant for, and they split their work across multiple sessions so no single session revealed their full intent.
These actors carried out a sustained effort to develop guided weapons, including using Claude to design guidance software. We do not have evidence the actors succeeded in fielding an operational device; but they did test-fire a guided rocket. This field test appears to have failed: within hours, the actors returned to Claude to work out why it failed.
Separate Claude instances wrote software, conducted research, and reviewed one another’s work on a guided rocket, a ballistic missile with a stated range goal above 2,000 kilometers, and a missile family that included a hypersonic glide variant.
The actors used Claude to develop guidance, navigation, and control autopilot software; integrate an open-source autopilot; tune controls; run simulations; and diagnose problems. They eventually test-fired a guided rocket.
It apparently failed. Within hours, they were back asking Claude to help determine what went wrong.
Anthropic found no evidence that the group successfully fielded an operational weapon. The bad news is that the actors had already created an offline simulation toolkit that could continue working without Claude.
China presents a different concern. One China-based actor used Claude to help develop specifications and software for an anti-torpedo system intended for presentation to a Chinese defense manufacturer.
From Anthropic’s report:
We identified a China-based threat actor who used Claude to advance three parallel tracks of work on an anti-torpedo weapons system:
- First, the actor used Claude to draft a Chinese-language specification for an anti-torpedo fire control system (the core logic that aims and times an anti-torpedo weapon’s response). The document was written to win approval from a Chinese defense manufacturer, which would move the work on to technical certification and operational testing.
- Second, the actor used Claude to produce a Chinese-language technical proposal of more than 200 pages, accompanied by an executive briefing deck.
- Third, the actor used Claude to benchmark their own system against specific US anti-torpedo and anti-submarine programs based on publicly accessible information. They then generated a Chinese-language briefing on US Navy systems derived from open-source reporting.
The actor presented themselves as an original equipment manufacturer in the US defense sector. We assess the actor was associated with a Chinese defense industry manufacturer aiming to produce a weapons specification and acquisition proposal for the People’s Liberation Army Navy.
The actor used Claude to write the acquisition proposal, refining it over many drafts. After each draft, the actor instructed Claude to role-play a hostile expert reviewer to critique the proposal, then used that feedback to sharpen the next version. In parallel, the actor used Claude to build pieces of the anti-torpedo weapons system’s fire control software and a test matrix to validate them.
The operational lift the actor achieved was a function of using Claude to automate complex technical outputs. The actor leveraged the model to compress the development timelines for the certification registry, compliance documentation, and automated fire control logic. The actor also accelerated the traditional human review cycle by having Claude critique the acquisition proposal across multiple rounds of review while role-playing a persona.
Another built roughly 16 software modules involving electronic warfare and suppression of enemy air defenses. At one point, the simulation shifted to 12 targets in Taiwan, including air bases, radar sites, command facilities, and Patriot batteries.
Russia-linked actors used Claude to work on an autonomous kamikaze-drone swarm capable of identifying targets and issuing detonation commands without a human in the loop.
Another Russia-based operation used Claude to locate suppliers, prepare tender documents, find middlemen in China and Hong Kong, and map routes designed to hide where dual-use goods were ultimately going.
From Anthropic’s report:
We identified likely freelance Russia-based threat actors who set out to build a full-stack autonomous first-person-view (FPV) kamikaze drone swarm. The actors used Claude Code to write and test the code and save it directly into the actors’ own project files. In addition to Claude Code, the actors used a software-in-the-loop simulation stack and a rented graphics processing host for model training. They called the operation “DronDoc” or “Serafim.”
The actors used Claude to build the core software system, including the drones’ shared swarm memory and fault-tolerant coordination logic (FTCL); an onboard small language model to govern attack, observe, and return-to-base behaviors; a terminal guidance software system to steer drones to their target (using the onboard camera) and issue the call to detonate; a control-link geolocation module to find opposing drone operators; a passive acoustic detection layer; and low-level logic for the drones’ programmable chips. The actors designed the platform for autonomous lethal engagement; the onboard model could select targets (including a “person” target class) and issue detonation commands without a human in the loop. The actors’ activity—including flashing the low-level firmware to live development boards, provisioning single-board computers, and wiring up a simulation environment over a mesh network—confirmed that they were using real hardware-in-loop testing within their sessions.
The actors trained a computer vision classifier on scraped Ukrainian combat footage, splitting the target classes into “enemy” and “friendly,” and allow-listing Russian systems. They also repeatedly used a fixed coordinate in Donetsk Oblast as the demonstration strike point, with front-line cities and corridors in Ukraine as the mission geography.
The actors created their accounts between late 2025 and early 2026 and started the operation in mid-May 2026. The actors circumvented our geographic access controls by routing traffic through commercial virtual private servers.
We assess the actors were a small, specialized freelance team doing a mix of civilian and military work, not a Russian state entity. We identified nine accounts associated with this group; eight were used only for ordinary freelance work, not weapons-related software development. Based on our investigation, we assess the actors had ties to a regional university with a federal research center associated with the Russian Academy of Sciences. The actors claimed to have received funding from Russia’s Advanced Research Foundation, National Technology Initiative, and Ministry of Defence, though we cannot verify those claims. We identified this activity as part of our internal investigations into suspected weapons development, we banned accounts associated with the actors, and have incorporated our investigative findings into safeguards to reduce the risk of future misuse.
Then there’s Iran.
An Iran-nexus actor used Claude to gather publicly available information and develop targeting recommendations involving U.S. naval forces. The material included personnel information taken from military photographs, ship and aircraft identifiers, satellite-imagery tools, websites exposing naval movements, and research into vulnerabilities in shipboard communications equipment.
From Anthropic’s report:
We identified an Iranian threat actor that leveraged free Claude.ai accounts across 16 single-operator organizations to develop malware, a delivery pipeline, and a phishing portal targeting domestic Iranians. The delivery pages were designed to serve malicious content only to visitors whose IP addresses originated in Iran. The pages were themed around censorship-circumvention tools and a fabricated Farsi news brand.
The attack lifecycle and AI usage
Phishing and delivery tooling
The threat actor used Claude for engineering and testing, decomposing projects into individually benign web-development requests. The output included a VBScript dropper controlled through a Telegram bot, fake Microsoft Excel and Windows credential dialogs, a fake ESET NOD32 antivirus login page that sends captured credentials to Telegram, a ClickFix-style Win+R lure, V2Ray landing pages, and geo-gated delivery pages. Claude refused nine out of ten direct requests that were facially malicious. But our safeguards performed less consistently when the user fragmented the work and directed the model to carry out tasks across later, smaller sessions.
SECOMS64 implant
In another portion of the campaign, the threat actor used Claude to build SECOMS64, a modular Windows implant. The implant included a keylogger, screenshot capture, Chrome credential extraction with an App-Bound Encryption bypass, and reconnaissance of Microsoft Defender and Intune. Supporting components included a PowerShell reverse shell tunneled through ngrok, USB-drive propagation, a browser-data destruction module, and a staged dropper, retrieved from a file-sharing service and modified to evade antivirus detection.
The toolkit was oriented toward surveillance of individuals. The keylogger captured keystrokes while the Telegram Desktop app was in focus. The screenshot component ran as an executable named “Telegram,” with a matching icon, and exfiltrated captures through a Telegram bot. The USB module logged the serial number of every drive it touched, and an Android application in the same cluster uploaded a device’s contacts, messages, and media. Persistence was layered: a registry run key, scheduled tasks at highest run level, self-deleting batch files, and a binary disguised as a Windows font-driver service at a fixed ProgramData path. An alternative exfiltration path staged data in commercial cloud storage under filenames encoding the victim’s hostname; the files were then downloaded and deleted server-side. The threat actor also tested remote code execution through Telegram document handling, evaluated additional command-and-control frameworks, packaged components to run without a visible console window and bypass SmartScreen, and wrapped tooling in a fake image-editing application with a counterfeit Adobe copyright notice. Elsewhere in the cluster, we identified a drive-wiping one-liner and browser-data destruction targeting a named Windows user.
None of this means Claude built Iran a missile or handed China a finished weapon. Anthropic caught and disrupted the operations, and some projects never advanced beyond development or simulation.
But dismissing the case because some failed would miss the warning.
For generations, advanced weapons development required engineers, laboratories, specialized knowledge, time, and money.
Frontier AI can’t replace all of those things. It can, however, make scarce expertise easier to obtain and allow a small team to attempt work that once demanded far more people.
Anthropic’s own testing says AI models are becoming steadily more capable at simulated intelligence targeting and conventional weapons-development tasks.
From Anthropic’s site:
Anthropic’s Frontier Red Team developed new evaluations to measure AI capabilities in tactical intelligence targeting (like finding where people are based on fragmentary information) and conventional weapons development (like engineering drones to strike a moving target).
- For some tasks in military and intelligence domains, models could do things that, historically, only a set of scarce, highly-trained human experts could do.
- These evaluations show how models have become useful to actors seeking to misuse our platform for surveillance and conventional weapons development. They also show why on-platform safety measures are necessary, like the new classifiers we have implemented to block such misuse.
- Although open-weights models from PRC developers that we tested were behind the frontier, they also showed concerning ability to identify and target adversaries, and improve weapon performance.
Cybersecurity and biorisk are among the best-studied domains of risk from misuse of AI. But most of modern conflict occurs in more conventional realms. Adversaries try to identify and target one another to collect intelligence. Combatants try to make conventional weapons more precise and less vulnerable to countermeasures. “Kill chains,” such as “find, fix, track, target, engage, assess,” are end-to-end conceptual models of these engagements. Making improvements in any step of this process has typically required expert human labor and judgment: experienced intelligence analysts or highly-trained engineers, for example. As AI shows tremendous progress in data analysis, software development, and coding, can it apply these skills to the specialized domains associated with national security?
A new report from Anthropic’s Threat Intelligence Team suggests the answer is yes. It includes instances of AI misuse in surveillance and conventional weapons development which show threat actors already perceiving benefit from the use of AI models.
The Frontier Red Team has developed some complementary capability evaluations to better illustrate how AI progress is changing the risk landscape across different parts of the kill chain. The evaluations show that models are making consistent progress on simulated intelligence and weapons development tasks. Open-weights models we tested on the same evaluations are behind the frontier (typically between Sonnet and Mythos-class models in performance), but often still show concerning levels of capability. Models well short of the frontier will have intelligence and military applications.
America should remain the world leader in AI. Smothering our own companies with regulation while China races ahead would be an extraordinary act of self-sabotage.
Leadership also requires recognizing what we built.
The same technology that helps an American engineer solve a problem helps an adversary solve one too. The same model that accelerates a business project shortens the learning curve for somebody designing a weapon.
America won the race to build some of the world’s most capable AI.
Now comes the harder part: making sure our enemies don’t turn our advantage into theirs.
The AI race isn’t only about technology companies and stock prices anymore. It’s becoming a national-security contest with consequences Americans need to understand. Join PJ Media VIP today and get 60% off with promo code FIGHT.
