Anthropic's Claude misuse threat intelligence report

Anthropic released a threat intelligence report on September 10, 2026, covering disrupted misuse of Claude between December 2025 and August 2026 across biological research, cyberattacks, surveillance, weapons development, distillation, and influence operations. The report's sharpest capability admission concerns biology: Anthropic said it can no longer assure that newer Claude models are too limited to meaningfully assist dangerous biological research, a reversal of its prior assessment for older models, and it now restricts a broader range of biological research requests. Five biological cases were documented; one involved a chikungunya grant proposal connected to a military research institute, and a reseller serving those researchers regained access within days of being banned, allowing their research to continue. Anthropic stressed it did not conclude the scientists intended harm. Some actors were located in countries prohibited from accessing Anthropic's models, including Russia, China, and Iran, and users circumvented safety controls or obfuscated their research purpose.

On distillation, the report identified Chinese AI labs running covert extraction campaigns. Alibaba's Qwen used over 3,500 fraudulent accounts, peaking at nearly 3 million exchanges per day and totaling over 151 million exchanges between May and July 2026. Moonshot secretly forwarded approximately 300,000 Kimi customer requests to Claude over ten days, displaying Claude's responses to users who believed they were using Kimi. DeepSeek relayed over 12.1 million exchanges to Claude in 14 days in July 2026 without customer knowledge. Zhipu attempted to extract Claude Fable's cyber capabilities before pivoting to Opus 4.6. Xiaomi also ran a distillation campaign. These transfers exposed sensitive company information and in some cases live credentials to Anthropic without customers' knowledge. Anthropic said these practices likely violate Chinese law including PIPL Article 39 and the Anti-Unfair Competition Law. The report asserts distillation can improve general reasoning enough to increase dangerous capabilities beyond the subjects covered in training conversations, and that Claude's safeguards do not transfer through unauthorized distillation, but provides no quantified evaluations to support these claims.

State-actor misuse spans several areas. A Yemen-based group used Claude Code for rocket and missile guidance work, including a design with a range exceeding 2,000 km; Anthropic banned all linked accounts. GTG-20006, a Russia-linked group tied to Midnight Blizzard, used AI to automate its attack chain and rebuild malware when security tools detected it, targeting Ukraine and more than 20 organizations. An Iran-nexus actor used Claude to collect and analyze publicly accessible data to develop targeting recommendations against U.S. naval forces. A consultant used Claude to build surveillance software for Malian intelligence covering approximately 25 million SIM cards across three carriers; Anthropic banned the account but the deployed system reportedly remained operational. Two units tied to Iranian security organizations built a shared surveillance system; one shipped a Firefox extension disguised as a prayer-times utility that harvested social media identities, and the central system stored national IDs, personal beliefs, criminal records, and social media accounts. Nine influence operations were disrupted, though most proved relatively ineffective at reaching genuine audiences. A fake dating app network designated GTG-15001 ran over 4,700 AI personas that contacted at least 25,000 people within two weeks.

The report produced diplomatic fallout. China's foreign ministry characterized it as smearing China by distorting facts and threatened resolute countermeasures the day before the full report was released. Analyst Ryan Fedasiuk described the report as a world-historic Chinese counterintelligence failure that will fundamentally alter the relationship between Chinese AI labs and the Chinese state. China Daily framed the report and associated corporate coordination as a coordinated strategy to blunt Chinese AI competition and win favorable U.S. regulation. Anthropic is characterized in the report's coverage as the most China-hostile of U.S. AI labs due to its positions on chip controls and distillation.