Anthropic's Claude Exploited for Weapons Research and Model Distillation

Anthropic's new threat intelligence report documents eight months of Claude abuse, detailing how state-linked and independent threat actors used the company's flagship language model to accelerate research into dual-use technologies including missiles, drone swarms, and surveillance systems. Simultaneously, seven Chinese AI laboratories conducted industrial-scale campaigns to extract Claude's capabilities without authorization, using the captured outputs to train competing models. The disclosures, published September 11, 2026, expose a fundamental tension in how frontier AI models are distributed: the same API openness that enables legitimate developer innovation creates surface area that safety filters cannot fully police in real time.

Scope of the Misuse Campaign

Anthropic's report covers December 2025 through August 2026 and breaks misuse into seven categories: cyber operations, influence operations, surveillance, fraud, biological misuse, conventional weapons, and unauthorized model distillation. The company notes that it is documenting novel misuse patterns rather than typical abuse cases. The models most affected were Haiku, Sonnet, and Opus, while the newer Fable and Mythos models showed up in only a single distillation case.

Cyber Operations and Autonomous Malware

Anthropic tracks a Russian-speaking espionage actor designated GTG-20006 that used Claude to create a feedback loop in which AI agents checked whether malware was being flagged by common security products, and when caught, agents rewrote and recompiled the malicious code until it evaded detection. This pattern represents a qualitative shift in attack economics: autonomy lowers the cost side of an attacker's math and makes previously unprofitable targets worth pursuing.

More than 20 organizations were targeted, including government ministries, intelligence services, embassies, and defense contractors, with a focus on Ukraine and Europe. The drone supply chain came up repeatedly, and the actor stole a complete proprietary SDK for a drone vision system. Access sometimes ran through third parties, such as compromised hotel guest Wi-Fi providers whose guest devices were then loaded with malware.

Weapons Development: Missiles and Autonomous Drones

A cell in northern Yemen used Claude Code in place of human software engineers for the guidance, navigation, and control software of three missile programs, including a multistage missile with a target range over 2,000 kilometers. The actors ran several Claude instances in parallel and spread the work across sessions so that no single one revealed the intent. When a test launch apparently failed, the actors returned to Claude within hours to identify the cause.

A second case likely involving freelance Russian actors resulted in an autonomous FPV kamikaze drone swarm with a small language model onboard and terminal-phase targeting by camera, designed for autonomous lethal effect. The onboard model could select targets of the "person" class and trigger detonation with no human in the loop, with the image classifier trained on captured Ukrainian combat footage.

A Chinese case involved a suite of roughly 16 modules for electronic warfare and the suppression of enemy air defenses, with the simulation's default scenario switching midway to twelve targets in Taiwan.

Surveillance at National Scale

A single consultant in Mali used Claude as the primary engineering workforce for "Lakana 360," a platform to monitor roughly 25 million SIM cards across all three national mobile carriers. The platform identifies people by voice across SIM swaps, flags users of encryption and VPNs, and links individuals to the national biometric civil registry. Suspending the account interrupted only the development work, not the operation, since the platform runs on local models on-premises.

Anthropic documents similar patterns with Iranian units that claim to have surveilled and profiled 6,388 Iranians within a year.

Industrial-Scale Model Distillation

The distillation campaigns represent a different class of threat, targeting not weapon development but competitive advantage. Anthropic identified attacks from seven Chinese labs conducting what it defines as illegitimate distillation: industrial-scale, covert campaigns that extract model capabilities without authorization, usually enabled by networks of fake accounts using stolen credit cards and API keys, routed through "transfer stations".

The largest campaign ever measured is attributed to Alibaba's Qwen lab, where a fixed prompt got Claude to write out its reasoning traces before answering, and the transcripts were processed into fine-tuning data for the Qwen 3.5, 3.6, and 3.7 models, peaking at almost three million exchanges a day from more than 3,500 fraudulent accounts, totaling over 151 million exchanges between May and July 2026, mostly on agentic tasks and software development.

Other labs took a different approach: instead of simply mining Claude's outputs, they routed their own customers' requests through it without authorization. Moonshot AI relayed nearly 300,000 customer requests to Anthropic over ten days across 5,380 fraudulent accounts, while users believed they were using a Kimi model. DeepSeek used strings to detect when requests came from harnesses like Claude Code, flagged those users, and routed selected ones to Claude Opus, more than 12.1 million exchanges in 14 days.

Among the rerouted requests, Anthropic found a user likely tied to the People's Liberation Army who had CCTV archive footage analyzed for a single target, video from hundreds of cameras in Chengdu, including cameras outside PLA facilities. DeepSeek also received requests from an operator with live credentials for a database linked to the Russian Ministry of Defense, along with work on a case management system for a Chinese public security bureau that matches movement profiles against police records.

Xiaomi used Claude differently, storing requests and coding sessions from users of its own MiMo models and replaying those conversations through Claude to generate training data. The relayed requests contained personal data such as names, contact details, and company information for hundreds of people in at least a dozen languages. Zhipu rotated through 273 accounts and pushed more than 770,000 exchanges over ten days through a CoT cleaner, a tool that automatically turns captured reasoning traces into usable training data, training GLM-5.3 on cyber tasks after initially targeting Fable but then deliberately switching to models judged to have weaker protections.

Structural Vulnerabilities in API Distribution

The abuse patterns reveal a fundamental architectural problem: API access that enables legitimate commercial use also creates comprehensive surface area for adversaries. Anthropic notes that the core finding from its cyber chapter is that sophisticated attacks no longer require sophisticated attackers, and sophistication is no longer a reliable signal for attribution, because reconnaissance, exploitation, and tool-building now get handed off to models that run in parallel at machine speed.

The weapons cases and distillation campaigns exploit the same underlying reality but for different ends. In weapons development, adversaries use Claude to compress development timelines for systems that would otherwise require large engineering teams. In distillation, competitors extract and recycle Claude's reasoning to train their own models, gaining capabilities without bearing the research cost. Both cases occurred despite Anthropic's published Constitutional AI research and dedicated trust and safety team.

In response, Anthropic launched Claude Fable 5 with stricter safeguards for dual-use biology requests, and against distillation, the "preserved thinking" introduced with Fable 5.1 is meant to keep new API accounts from manipulating the context. However, these are incremental defensive measures against actors with resources to adapt.

Implications for Platform Governance

For developers building on top of Claude, these disclosures raise uncomfortable questions about liability and platform dependence. Developers are implicitly dependent on Anthropic's ability to detect and block misuse in real time—a dependency that is rarely surfaced in standard API terms. The scale of the distillation campaigns suggests that detection itself may be insufficient when coordinated actors can cycle through thousands of fake accounts faster than policy teams can respond.

The asymmetry is now clear: safety filters designed to prevent harmful outputs cannot reliably prevent model outputs from being extracted and repurposed. Anthropic's conclusion in its biology chapter is that classifiers cannot both enable useful work and prevent harm, because a user's intent in dual-use areas cannot be reliably detected. This suggests that governance solutions will require moving beyond output filtering toward either restricted access models or verified-user programs for sensitive applications.