Anthropic has disclosed a series of cases in which threat actors attempted to misuse its Claude AI models for activities ranging from potential biological weapons research to cyber espionage targeting Ukraine.
The disclosures are part of Anthropic's September 2026 Threat Intelligence Report, covering malicious activity identified between December 2025 and August 2026. Anthropic says it disrupted the operations, banned associated accounts, strengthened its safeguards and shared relevant intelligence with authorities and industry partners.
Importantly, these cases do not mean that AI models independently decided to develop biological weapons or conduct espionage. Human operators were behind the activities and attempted to use AI as a force multiplier.
Attempts to use AI for biological weapons research
Anthropic described five cases involving users attempting to use its models in ways that could support biological weapons development.
The cases included attempts to obtain AI assistance related to research involving chikungunya, highly pathogenic avian influenza, orthopoxvirus and novel toxins or venoms.
Anthropic emphasized that these cases involved highly technical, dual-use scientific research. The same scientific knowledge can sometimes have legitimate medical or research applications, making it difficult for automated safety systems to determine intent from an individual request alone.
In one case, a reseller platform allegedly attempted to circumvent Anthropic's regional restrictions and route biological research requests through AI systems with different safeguards. Anthropic said it eventually banned the associated accounts and worked with partners to disrupt the relay infrastructure.
In another case, a researcher in an unsupported region spent weeks using Claude while planning research involving avian influenza. Anthropic said its classifiers restricted this activity to less capable models before the associated accounts were ultimately banned.
No evidence that a biological weapon was created
This distinction is important.
Anthropic's report describes attempts to use AI to support biological weapons-related work, not evidence that the actors successfully developed or deployed a biological weapon.
The company says the cases demonstrate a growing safety challenge as AI models become increasingly capable of assisting with advanced scientific research.
A suspected Russian cyber espionage campaign targeting Ukraine
The report also describes a separate operation attributed by Anthropic to a suspected Russian state-linked actor.
Anthropic designated the activity GTG-20006 and said its assessment is consistent with public reporting connecting the actor to Midnight Blizzard, a threat group widely associated with Russian state-sponsored espionage.
The operator reportedly used Claude throughout significant portions of the cyber operation rather than simply asking an AI model for occasional technical advice.
Anthropic says the activity targeted Ukrainian government, military and diplomatic personnel, as well as European government and defence-related targets. The campaign also focused heavily on Ukraine's military drone ecosystem.
The operators reportedly used AI-assisted workflows for activities including reconnaissance, technical research and processing stolen information.
Anthropic says the group scanned email and remote-access infrastructure across more than two dozen Ukrainian government entities.
The operation also targeted companies involved in drone technology. According to Anthropic, attackers obtained mailboxes from at least two drone-component manufacturers and stole a proprietary software development kit associated with a drone vision system. The attackers then used Claude to help analyse the stolen technology.
AI is becoming more than a chatbot
One of the most important findings from the report is the changing role of AI in cyber operations.
Traditional use of an AI assistant might involve an attacker asking: “How do I perform this task?”
The newer model is closer to: “Carry out the task, analyse the results and determine what should happen next.”
Anthropic says many of the operations it investigated involved AI being used for direct execution or orchestration, including multi-agent workflows performing reconnaissance, exploitation and data processing. Humans remained involved by selecting targets and reviewing results.
This distinction matters because automation changes the economics of cyberattacks.
An attacker no longer necessarily needs a large team of specialists to perform every stage manually. AI can potentially help one operator process much more information, develop tooling faster and operate across a larger number of targets.
Why this matters for businesses
The implications extend well beyond AI companies.
Businesses increasingly use AI systems to interact with:
- Corporate networks
- Source-code repositories
- Cloud environments
- Security tools
- Internal databases
- Customer information
- Business applications
Giving an AI system access to these environments creates a new security question:
What happens if the person controlling the AI has malicious intent?
Traditional security models generally assume that a human operator is making individual decisions. Agentic AI changes that assumption by allowing software to perform multiple actions automatically.
A compromised AI account, stolen API key or malicious user could potentially turn an AI assistant into an operational tool rather than simply an information source.
AI safety needs more than content filtering
Anthropic's report also highlights an important limitation of relying solely on AI safety classifiers.
A classifier can identify suspicious requests and block them. But sophisticated users may:
- Split activities across multiple sessions
- Hide their actual objective
- Use third-party AI platforms
- Route requests through resellers
- Change the wording or context of requests
- Combine several AI systems for different stages of an operation
Anthropic says threat actors attempted several of these approaches in the cases it investigated.
This means AI security increasingly requires layered controls, rather than relying on a single model-level safeguard.
What companies should consider
Companies deploying AI agents should treat them as privileged software components rather than ordinary chat applications.
Important controls include:
✅ Least privilege
AI agents should receive only the permissions required for their specific task.
✅ Strong identity controls
API keys and service identities should be tightly controlled, monitored and rotated.
✅ Network isolation
Agents should not automatically have unrestricted access to the internet or internal systems.
✅ Human approval for high-risk actions
Actions involving production systems, sensitive data, financial transactions or security controls should require appropriate human authorization.
✅ Detailed monitoring
Companies should log agent actions, tool calls, network activity and access to sensitive resources.
✅ Behaviour-based detection
Security teams should look for unusual sequences of activity rather than relying exclusively on known malicious prompts or signatures.
✅ Separate experimentation from production
AI research environments should be isolated from systems containing real customer, employee or business data.
The bigger cybersecurity lesson
The Anthropic cases demonstrate that AI is increasingly becoming part of the operational infrastructure of cyberattacks.
The concern is not simply that AI can explain how something works. The more significant shift is that AI can potentially help an attacker research, automate, execute and analyse multiple stages of an operation.
At the same time, the biological cases demonstrate why AI safety is particularly challenging in dual-use scientific fields. Legitimate research and harmful activity can sometimes involve similar technical concepts, making simple keyword-based blocking insufficient.
Anthropic says it has incorporated lessons from the investigations into its safeguards and shared relevant intelligence with other AI labs, authorities and industry partners.
Final thoughts
These incidents should not be interpreted as evidence that AI systems are independently choosing to develop weapons or attack governments. The documented cases involved human-directed misuse of increasingly capable AI tools.
But that distinction does not make the threat insignificant.
As AI systems become capable of performing longer and more complex sequences of actions, the security boundary increasingly shifts from the model itself to the entire environment in which the model operates.
AI agents must be treated as security-sensitive systems. Strong identity controls, least privilege, network isolation, human oversight and continuous monitoring are essential when AI is given access to real-world tools and data.
