Anthropic Threat Report Reveals AI Misuse in Bioweapons, Cyber Ops, and Influence Campaigns

Anthropic Threat Report Caught AI Fueling Bioweapons Research

Estimated reading time: 10 minutes

Key Takeaways

• Anthropic's threat report confirmed AI is being used operationally to accelerate dangerous activities including biological weapons research, cyberattacks, and propaganda.
• The 154-page report covers disrupted misuse from December 2025 through August 2026 across seven harm categories.
• Anthropic identified more than 3,500 fraudulent accounts tied to these operations and documented large-scale illicit distillation activity.
• The biological weapons cases were described as among the most serious risks of frontier AI models, highlighting the dual-use challenge.
• Anthropic says it is refining policies, terminating accounts, conducting Frontier Red Team evaluations, and sharing intelligence with partners and law enforcement.

Anthropic's threat report just confirmed what many security researchers feared: AI isn't just being tested by bad actors anymore. It's being used operationally, right now, to accelerate some of the most dangerous activities on earth.

Released in September 2026, Anthropic's first threat intelligence report of the year covers eight months of disrupted misuse — from December 2025 through August 2026. The 154-page document details how its Claude AI models were used in biological weapons research, state-sponsored cyberattacks, drone and missile development, and coordinated propaganda campaigns.

This isn't theoretical. The people behind these activities weren't hobbyists. They included suspected government-backed hackers, scientists linked to military research institutes, and one of the largest illicit AI data-scraping campaigns ever recorded.

Here's what the Anthropic threat report actually found — and why it matters for anyone paying attention to where AI is heading.

---

What the Anthropic Threat Report Actually Covers

The report spans seven distinct harm categories, documented across a tight eight-month window. Anthropic's threat intelligence team identified and disrupted misuse of its Claude Haiku, Claude Sonnet, and Claude Opus models. Notably, Claude Fable and the more powerful Mythos-class models were not involved in any of the cases — with one narrow exception involving a process called distillation.

The seven harm categories covered in the report include:

• Biological weapons development
• Conventional weapons development (firearms, missiles, drones, bombs)
• Cyberattacks and malware operations
• State-sponsored espionage
• Influence and propaganda operations
• Surveillance tools targeting dissidents
• Fraud and scams (fake dating apps, hotel Wi-Fi hijacking, financial fraud)

The sheer breadth here is significant. This isn't a narrow technical document about one misuse type. It's a map of how frontier AI is now being deployed across nearly every major category of harmful activity.

The report also confirmed that Anthropic discovered more than 3,500 fraudulent accounts tied to these operations, and that a single 30-day sweep turned up roughly 35 distinct research efforts that raised red flags. These aren't isolated incidents — they represent a pattern of organized, deliberate misuse.

Sources: Anthropic Threat Intelligence Report, September 2026 | Reuters

---

The Biological Weapons Cases — The Most Serious Risk

Of everything in the report, the biological misuse section carries the heaviest weight. Anthropic called it "one of the most serious risks of frontier AI model" — and the five case studies they published make it easy to understand why.

What Researchers Were Actually Doing

The cases weren't crude attempts. These were technically sophisticated actors using Claude to push into genuinely dangerous scientific territory.

Two cases stand out as especially alarming:

1. Avian influenza mammalian-adaptation research: One actor used VPN infrastructure to mask their location and identity while planning experiments to adapt avian influenza — commonly known as bird flu — for mammalian transmission. This is exactly the kind of research that, if done outside of a controlled, regulated environment, could produce a pathogen capable of spreading from animals to humans at scale.

2. Chikungunya gain-of-function grant application: Another actor used Claude to help write a research grant application focused on gain-of-function experiments for chikungunya virus. The actor was tied to a military research institute. Gain-of-function research, in simple terms, means deliberately modifying a virus to make it more transmissible, more lethal, or more resistant to treatment.

The Dual-Use Problem

This is where the situation gets genuinely complex. Anthropic's head of threat intelligence, Jacob Klein, was direct about it when speaking to the New York Times: "You are not seeing someone in a comic book kind of way say, 'Hey, I want to build a biological weapon to kill everybody.'"

The reality is messier. The same biological knowledge that helps someone engineer a weapon is often the same knowledge needed to develop a vaccine or design a cure. A researcher asking about how a virus adapts to new hosts might be working on a public health defense — or something far worse.

Anthropic acknowledged this tension directly, stating: "The same information that can be used to develop a biological weapon could also be used to develop, for example, a vaccine or a cure for a disease."

This dual-use problem is one of the hardest challenges in AI biosecurity. There's no clean line between dangerous knowledge and lifesaving knowledge. What the Anthropic threat report shows is that the company is now actively trying to draw that line in real time — and that the stakes of getting it wrong are catastrophic.

Sources: Anthropic Threat Intelligence Report, September 2026 | New York Times

---

Cyberattacks, Espionage, and State-Sponsored Misuse

The biological weapons cases grabbed headlines, but the cyber and espionage findings in the Anthropic threat report are arguably more immediately operational. These aren't future risks. They are active, ongoing operations that were disrupted — meaning similar ones likely still exist elsewhere.

Russia-Linked Midnight Blizzard Activity

One of the most technically advanced cases in the report involves a hacking group whose behavior aligns with Midnight Blizzard, a Russia-based cyber espionage operation with a long track record of targeting governments and diplomatic institutions.

According to the report and Reuters, this group used Claude to:

• Automate phishing campaigns targeting Ukrainian government officials and diplomatic staff
• Execute hotel Wi-Fi hijacking attacks, intercepting communications of targets staying at specific hotels
• Conduct WhatsApp account takeover operations
• Build a system that automatically rewrote malware whenever it was detected by security defenses — essentially an AI-powered evasion engine that kept refreshing its own code to stay invisible

That last capability is particularly significant. Writing malware that evades detection has always required skilled, time-intensive work from experienced hackers. AI compresses that time and reduces the skill floor. Anthropic's threat intelligence team quoted in Reuters noted that AI is now demonstrably compressing attacker costs across operations like these.

Iranian Influence Operations

The report also named an Iranian propaganda institution that used Claude as part of a broader influence operation. While the report is careful about the level of detail it shares publicly on active operations, the inclusion of a state propaganda body confirms that AI-assisted information warfare is no longer speculative — it's documented.

Chinese Labs and the Distillation Campaign

Perhaps the most staggering numbers in the entire report relate to China-based actors. Anthropic says it identified and disrupted attacks from seven China-based labs engaged in what it describes as illicit distillation — the process of using a large, expensive AI model to train a smaller, cheaper one.

Distillation itself is a legitimate and widely-used AI technique. The issue here is that these labs were doing it without authorization, essentially reverse-engineering Claude's capabilities into their own models.

The scale was enormous:

• More than 151 million exchanges were attributed to Alibaba in just the May-to-July 2026 period
• At peak activity, that works out to nearly 3 million exchanges per day
• Anthropic called this the largest illicit distillation campaign it had ever measured

This represents a different kind of threat than the bioweapons or cyberattack cases. It's not about causing immediate harm — it's about systematically stealing the intellectual and technical value baked into a frontier AI model and replicating it at scale without the same safety infrastructure, the same usage policies, or the same safeguards.

Sources: Reuters | Anthropic Threat Intelligence Report, September 2026

---

Ready to Stop Doing Everything Manually?

Most businesses are still running on a patchwork of repetitive tasks — manual data entry, follow-up emails, spreadsheet updates, status reports that take hours to compile. While your team handles those tasks by hand, competitors are using automation to scale faster with fewer people.

Flowgrammer helps businesses build smart automation workflows that eliminate the grunt work, so your team can focus on what actually moves the needle.

👉 See What Flowgrammer Can Automate for You

---

Conventional Weapons, Surveillance, and Fraud

Beyond the biological and cyber cases, the Anthropic threat report documented six additional cases involving conventional weapons development. Actors used Claude to get help with:

• Firearms modifications and design
• Missile optimization and targeting systems
• Armed drone development
• Bomb and munitions construction
• Targeting and control software for weapons platforms

Reuters noted that Anthropic's own threat-intelligence team confirmed AI is now being used to speed up drone and missile optimization — not just to write code or answer general questions, but to actively accelerate engineering work on weapons systems.

Surveillance Tools Targeting Dissidents

The report also highlighted the use of Claude to build surveillance infrastructure specifically designed to identify and track political dissidents. This category of misuse is less about large-scale physical harm and more about enabling authoritarian actors to silence opposition — but the human cost can be just as severe for those targeted.

Scams, Fake Apps, and Hotel Wi-Fi Fraud

At the lower end of the severity scale — though still materially harmful — the report catalogued a range of fraud operations:

• Fake dating apps designed to extract money from users
• Hotel Wi-Fi interception scams
• Financial fraud schemes of various types

These may seem minor next to bioweapons research, but they represent the democratization of AI-enabled crime — lower-skill actors using Claude to run operations that previously would have required technical expertise they didn't have.

ShinyHunters Named in the Report

The cybercriminal group ShinyHunters, which has previously been linked to major data breaches affecting millions of people, was among the named actors in the report. Their inclusion alongside suspected state-sponsored groups underscores that the misuse landscape is not just a government-vs-government story. Organized crime is now part of the picture too.

Sources: The Guardian | Anthropic Threat Intelligence Report, September 2026

---

What Google's Gemini Report Adds to the Picture

Anthropic wasn't alone in releasing threat intelligence this week. On Tuesday — two days before Anthropic's report dropped — Google published its own findings about attempted misuse of Gemini, its AI model.

Google's report described a case where a person attempted to use Gemini to obtain a "complete, step-by-step technical guide for synthesizing weaponised biological agents." This language is notably more explicit than most of the Anthropic cases described publicly — and it makes clear that the biological weapons risk is not specific to one company or one model.

Taken together, the Google and Anthropic reports paint a consistent picture: multiple frontier AI models are being probed and exploited for weapons-relevant information, not by one-off bad actors, but by organized entities with clear intent.

This convergence of findings across two separate companies — with independent threat intelligence teams — significantly strengthens the credibility of both reports. The threat isn't a single anomaly. It's a trend.

Sources: Google Cloud Blog

---

The Legislative and Industry Response

The Anthropic threat report landed in the middle of an already heated policy debate about AI safety and governance.

OpenAI's Chief Scientist Calls for Voluntary Slowdowns

In an article published on September 6, just days before the Anthropic report, OpenAI's chief scientist Jakub Pachocki called on the AI industry to implement "voluntary slowdowns" until better safeguards are in place. His words were direct: "I am concerned no one is prepared for the consequences of a continued rapid rise in machine intelligence."

Pachocki confirmed OpenAI would continue its own safeguard development but stressed that voluntary company-level action is not enough — broader interventions are needed.

His statement triggered an open letter to UK Prime Minister Andy Burnham calling for a new multinational treaty to govern AI development, specifically addressing the trajectory toward artificial superintelligence (ASI).

Senator Sanders Introduces Legislation

In the United States, Senator Bernie Sanders took an even harder line, introducing legislation that would:

• Ban artificial superintelligence outright
• Temporarily pause advanced AI development

Speaking on BBC's Newsnight, Sanders didn't mince words: "When scientists tell you there is a chance, a chance that it could have a cataclysmic impact on humanity, you've got be a moron not to say, slow it down."

The Trump Administration's Position

President Donald Trump has pushed back against the slowdown argument. Speaking on Thursday, he framed AI leadership as a national security imperative: "If we don't win AI, we're going to be put in a very bad position." The administration's position appears to be that falling behind rivals — particularly China — poses a greater risk than the dangers cited in reports like Anthropic's.

Anthropic's Own Safety Alarm

The timing of the report also matters in the context of internal signals. A top safety researcher at Anthropic published a warning estimating a greater than 10% chance that AI "could kill all humans" within the next decade. That's not a fringe voice — it's a senior researcher at the company that just published this threat report.

The fact that Anthropic is both developing frontier AI and publicly documenting its misuse reflects the complicated position these companies occupy: simultaneously the source of the risk and the primary defenders against it.

Sources: BBC News | BBC Newsnight

---

What Anthropic Says It Is Doing About It

Anthropic did not publish the threat report simply to document problems. The company said it has incorporated findings from every case into its internal processes — specifically to improve its ability to prevent, detect, and disrupt future misuse.

The company also confirmed it has shared intelligence with law enforcement authorities and industry partners where appropriate.

Specific protective measures referenced or implied in the report include:

• Frontier Red Team evaluations focused on tactical intelligence targeting and conventional weapons development
• Ongoing refinement of the Anthropic Usage Policy and its Supported Regions Policy
• Account detection and termination — more than 3,500 fraudulent accounts were identified across the reporting window
• Intelligence sharing with other AI companies and relevant authorities

The fact that none of the misuse involved the Claude Fable or Mythos-class models (except one distillation case) suggests that Anthropic applies its most stringent access controls to its highest-capability systems — though this also raises questions about whether those models were simply not targeted, or whether the access controls genuinely held.

Sources: Anthropic Threat Intelligence Report, September 2026

---

FAQ: Anthropic Threat Report and AI Misuse

Sources: Anthropic Threat Intelligence Report, September 2026 | Reuters | New York Times | The Guardian