Anthropic threat report says it disrupted Claude misuse including biological weapons cases

Anthropic published its third artificial intelligence misuse threat intelligence report on September 10, 2026, disclosing that it detected and disrupted malicious use of its Claude models across seven harm areas during the eight months between December 2025 and August 2026. The document, titled Detecting and countering misuse of AI: September 2026, describes what the company calls the most notable and novel threat activity it has identified to date, and it arrives while the safety practices of frontier AI laboratories face unusually intense public scrutiny.

The report is organized around a set of adversary clusters that Anthropic calls Generative Threat Groups, or GTGs, and it sorts the activity into categories that include cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation. The biological section presents five case studies, one of which involved a blocked request to help author a grant application for gain-of-function research on the chikungunya virus. A separate section describes six cases in which Claude was used to develop software for conventional weapons, including firearms, missiles, armed drones, bombs and the targeting and control systems that operate them.

Anthropic develops the Claude family of large language models, which includes the Haiku, Sonnet and Opus lines along with the newer Fable and Mythos classes. The company has published versions of this misuse report since March 2025, and the September 2026 edition is its first of this year. Across the period covered, Anthropic says it disrupted each operation it identified, strengthened safeguards, and shared intelligence with authorities and industry partners.

Context matters here. BBC News reported on September 11 that the disclosure lands against a widening AI safety backlash, one in which Anthropic researcher Jacob Coxon announced he was resigning with a warning that Anthropic and OpenAI are racing straight toward self-improving superintelligence, and that there is a greater than 10 percent chance that AI could kill all humans within a decade. The same reporting notes that United States Senator Bernie Sanders has introduced legislation to ban AI superintelligence and pause advanced development, while President Donald Trump has rejected such fears.

Key Facts

Anthropic said Claude Haiku, Sonnet and Opus models were used in the misuse cases it catalogued, and that none of the cases involved Claude Fable or Mythos-class models except for one illicit distillation instance. That single case is described in the report as an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization. The report covers activity disrupted between December 2025 and August 2026 across the seven harm areas, and the company frames the collection as the most notable and novel threat activity it has found to date.

The most detailed cyber case is GTG-20006, which the report attributes, consistent with public reporting, to the Russia-linked group Midnight Blizzard. Anthropic says the operation amounted to an AI-automated espionage campaign against more than 20 organizations, including Ukrainian and European government, defense and drone supply-chain targets. According to the report, the intrusion exfiltrated more than 300,000 national identity records along with commercial registry data on over half a million companies.

A second cluster, GTG-50014, covers suspected affiliates of ShinyHunters. In one operation tracked under that label, Anthropic says the actor mass-downloaded and decompiled 1.8 million Android APKs in a hunt for hardcoded secrets. A third cluster, GTG-10007, covers Chinese-speaking operators who built autonomous exploit foundries. BBC News reported on September 11 that Claude was also used by actors linked to a Russia-based cyber espionage campaign and by an Iranian propaganda institution, and that the cases ranged from fake dating apps and hotel WiFi scams to surveillance systems built to identify dissidents.

On the biological side, five case studies anchor the report. NPR reported on September 10 that one involved research into how to make a mosquito-borne disease more transmissible, and that another involved redesigning toxins for what Anthropic says was a national program. Anthropic says it is hard to know definitively whether the cases were connected to plans to build biological weapons, but it adds that it disrupted the activity and shared the information with authorities and industry partners.

The Associated Press reported on September 11 that Anthropic blocked a request for Claude's assistance in authoring a grant application for scientific funding, quoting the report's description of work that involved gain-of-function research, meaning research that genetically alters an organism to create a new or enhanced biological property, on the chikungunya virus. Chikungunya is a mosquito-borne virus that causes severe pain and fever, and the request sought to enhance mutations that would make the virus progressively more harmful. The same wire story notes that the report was published two days after Coxon announced his resignation, and that Anthropic is planning an IPO this fall.

Analysis

The bigger picture here is that the most consequential finding is not any single blocked request but Anthropic's own admission that the safety margin it once relied on has narrowed. The report states that older 2025 models such as Claude Opus 4 and Claude Sonnet 4.5 were below the threshold to meaningfully assist dangerous biological research, but that for current models the evidence is no longer certain. That sentence is the quiet center of gravity in an otherwise technical document, because it converts a philosophical debate about dual-use biology into a concrete engineering problem about model capability thresholds.

Jacob Klein, head of threat intelligence at Anthropic, told the New York Times that the situation was incredibly nuanced, and he pushed back on the idea that the actors resemble comic book villains announcing a desire to build a biological weapon to kill everybody. The nuance is real, and it cuts in two directions. It is a fair caution against alarmism, since much of what was flagged reads like ambitious or ambiguous research. It is also a fair caution against complacency, because that same ambiguity is exactly what makes dual-use screening so difficult to automate.

Anthropic's response has been to add stronger safeguards in its newest models, restricting a wide range of dual-use biological research queries in models such as Claude Fable 5. The company has not published its thresholds in detail, and that opacity is a legitimate point of contention. Still, moving from a claim that a model sits below threshold to an admission that the evidence is no longer certain, and then shipping a restriction layer, is a more honest sequence than many laboratories have offered in public.

The framing around Generative Threat Groups also deserves scrutiny. Naming adversary clusters is useful for defenders, because it lets them compare notes and track persistence across campaigns. It is also a presentation choice, and presentation choices shape how much credit a publisher receives for disrupting activity that its own models, in some cases, helped enable in the first place. The report does disclose that Claude models were used in the misuse cases, which is the minimum standard for credibility.

Why It Matters

The stakes are unusually high for a corporate disclosure. Anthropic calls biological misuse one of the most serious risks of frontier AI models and says it could have catastrophic consequences without correct safeguards, which places the company's own product decisions inside a national security frame. When a private laboratory both ships the capability and sets the guardrail, the public has to trust a self-assessment published by the party with the strongest commercial interest in a favorable reading.

NPR reported on September 10 that the report sits inside a broader industry pattern in which AI laboratories publish periodic misuse reports to demonstrate that they detect and disrupt abuse of their models, even as critics argue that governments, not companies, should set the safety bar. That tension is unlikely to resolve on its own. The scientific knowledge that makes advanced AI useful for developing cures for diseases is the same knowledge that could be turned toward weapons, and no model policy can fully separate the two.

The geopolitical dimension compounds the problem. A Russian-linked espionage campaign, suspected ShinyHunters affiliates, Chinese-speaking operators building exploit foundries and an Iranian propaganda institution all appear in the same eight-month window, which suggests that AI-assisted operations are becoming a standard tool rather than an exotic one. Anthropic also says elaborate cyberattacks no longer require sophisticated skills, and that even lone individuals can now create threats that would not have been possible a year ago.

Next Up

Anthropic is planning an IPO this fall, which means the next edition of this report will land while the company is courting public market investors and facing questions about risk disclosures. The safeguards added to Claude Fable 5 will be tested in production, and the company says it will continue sharing intelligence with authorities and industry partners.

The policy track is moving in parallel. Senator Bernie Sanders has introduced legislation to ban AI superintelligence and pause advanced development, and President Donald Trump has rejected those fears, so the question of who sets the safety bar remains open. Anthropic has also accused Chinese AI firms of trying to replicate Claude's capabilities, a charge that seems certain to feature in the next round of this debate.