Anthropic report exposes AI misuse in cyberattacks, bioweapons, and drone swarms
State actors and cybercriminals weaponizing Claude models for malicious purposes
1Escalating AI-powered cyber threats
Anthropic's report reveals state-sponsored hackers and cybercriminals increasingly using Claude models to automate sophisticated attacks. Russian group GTG-20006 (linked to SVR) accelerated operations by AI-automating their entire kill chain, targeting over 20 organizations across multiple continents. ShinyHunters affiliates weaponized Claude to breach a SaaS provider, compromising 200+ customer organizations and exfiltrating 2,100+ Azure AD tokens in just 34 hours through AI-driven automation.
2Biological weapons research enabled by AI
The report documents five cases of biological weapons research using Claude in unsupported regions. One scientist attempted to use AI for chikungunya virus research focused on transmissibility and immune evasion - properties that could enhance vaccine development or weaponize pathogens. Another case involved research on highly pathogenic avian influenza adaptations, potentially creating pandemic variants with severe neurological effects. Anthropic expressed particular concern about military research institutions involved in these projects.
3Autonomous weapons development
Anthropic identified six cases of conventional weapons development using Claude across China, Russia, and Yemen. In Yemen, developers replaced human engineers with AI to create guidance software for flying vehicles and tested guided rockets. Chinese actors used Claude to benchmark anti-torpedo systems against US defense programs. While no operational weapons were confirmed, actors built offline simulation toolkits independent of Claude after account bans.
4Surveillance and influence operations
The report highlights state actors employing Claude for mass surveillance operations and influence campaigns. Automated workflows enabled scaling of disinformation dissemination and target identification. Specific techniques included AI-generated phishing content, automated data collection from public sources, and synthetic media creation for psychological operations. These cases demonstrate how generative AI lowers barriers to conducting sophisticated surveillance at scale.
5Emerging threat categories
Since November 2025, Anthropic identified new misuse categories including weapons development, biological research, and advanced cyber operations. The report organizes threats into seven harm areas: cyber operations, influence operations, surveillance, scams/fraud, biological misuse, weapons development, and model distillation. Notably, Claude's most advanced Fable/Mythos models were largely unused except in one distillation case, suggesting current threats primarily involve mid-tier AI capabilities.
6Global patterns of misuse
Malicious activity spanned multiple regions with distinct patterns. Russian actors focused on cyber espionage and weapons development, Chinese entities prioritized military technology benchmarking, while non-state actors concentrated on scalable cybercrime. Geographic restrictions proved ineffective as users in unsupported regions accessed Claude through various bypass methods. The global distribution of cases underscores the borderless nature of AI security threats.
7Industry response and safeguards
Anthropic implemented account bans and threat sharing with partners, though limitations remain as actors developed offline capabilities. The company advocates for industry-wide pattern recognition and collective defense mechanisms. Current safeguards successfully blocked many malicious requests but failed to prevent all misuse cases, particularly when actors gradually refined prompts to avoid detection or used Claude outputs in external systems.
8Implications for AI governance
The findings highlight urgent needs for robust AI governance frameworks as capabilities outpace safety measures. Key challenges include preventing offline weaponization of AI outputs, detecting gradual prompt engineering, and addressing jurisdictional limitations. Anthropic's transparency sets a precedent for responsible disclosure, but the report underscores how current safeguards remain inadequate against determined malicious actors with evolving tactics.