Claude hijacked to design missiles and cyberattacks

On September 10, 2026, Anthropic posted Detecting and countering misuse of AI, a threat intelligence report covering December 2025 to August 2026. Reuters, The Straits Times and The War Zone published its hardest cases on September 11 and 12. For anyone searching for Anthropic Claude missiles, the fact is not agents escaping a sandbox during training like the morning's RubyGems story. It is the reverse of the chain. Humans, often suspected of ties to states or criminal networks, weaponized Claude Haiku, Sonnet and Opus to accelerate conventional weapons, cyber intrusions and mass surveillance. Anthropic says it shut down every operation, strengthened its guardrails and shared indicators with authorities and partners.

The lab's tone is deliberately factual. "We are publishing this work because we believe we have a responsibility to disclose malicious use of our services." No case involves the Fable or Mythos models, with one exception involving illicit distillation. The actors range from groups suspected of being state-sponsored to financial criminals, commercial spyware vendors and influence operators.

Conventional weapons: when Claude gets involved in missile design

The part that struck the press the most concerns conventional weapons. Anthropic describes a cell in northern Yemen (GTG-87001 in the internal nomenclature) that used Claude to code, simulate and debug software linked to a guided rocket, a ballistic missile project of over 2,000 km, and a variant with a hypersonic glider. The lab specifies it has no evidence that an operational system was deployed, and that its guardrails blocked many requests, but not all. Reuters recalls the context. The Houthis, aligned with Iran and controlling most of northern Yemen, have stepped up their strikes; the report does not attribute the actors by name to the Houthis.

On the China side, Anthropic says an actor had a electronic warfare and air defense suppression software suite developed, with a scenario that ended up targeting 12 sites in Taiwan (early-warning radars, Patriots, Tien Kung, air bases, command bunker). The accounts are said to be linked to Chinese research institutions, including the PLA's Academy of Military Sciences. Beijing told Reuters it was not aware of the report and opposed "distortions." Another Chinese case concerns an anti-torpedo system for the navy (a technical proposal of over 200 pages, comparisons with US Navy technologies). A third explores high-power microwave weapons and supply chains.

On the Russia side, likely freelance actors asked Claude to help with an autonomous swarm of FPV attack drones (terminal guidance, target selection, multi-device coordination). A Russian procurement manager also used the model to map Chinese/Hong Kong intermediaries intended to circumvent sanctions on dual-use components.

From chatbot to cyber orchestrator

On the cyber front, the report sets out a clear thesis. AI has closed the gap in manpower and tools that once separated state operations from lone operators. Technical sophistication is no longer a reliable attribution signal. Public offensive frameworks like PentAGI replicate much of the scaffolding for anyone who downloads them.

The GTG-20006 case, deemed consistent with the tradecraft of Midnight Blizzard (linked by the United States to Russia's SVR), illustrates the shift. The actor automated phishing, persistence, C2 and exfiltration via Claude workflows. When an implant was detected, agents rebuilt the malware until it evaded detection. Targets: Ukrainian and European ministries, diplomacy, drone supply chains. At least three hotel providers had their Wi-Fi hijacked (DNS hijacking, ClickFix lures). WhatsApp accounts were taken over via headless browsers. A North African tech authority lost more than 300,000 national identity records.

GTG-10007, Chinese-speaking operators based in Changsha (including two students), targeted around 50 organizations. They ran swarms of agents to search for zero-days on security appliances, with decompilation and proof-of-concept loops in the lab. Anthropic also describes ShinyHunters affiliates who treat stolen AI API keys as loot, compute and cover at once. A French-speaking hacktivist (GTG-50029) targeted 42 European political entities and media outlets, with a doxxing platform "fafsearch" built largely alone with coding help.

Surveillance, influence and biology

The report broadens the scope beyond missiles. Surveillance: a China-aligned actor tracking Uyghurs in Syria. Commercial social profiling platforms for Iran and the Gulf. An Iranian system targeting Israeli and Jewish diaspora organizations. In Mali, Claude reportedly served as the main engineering tool for Lakana 360, a platform intended for state intelligence and capable of tracking data linked to about 25 million SIM cards. Influence: editorial pipelines for Russian state media, a commercial network of about 70 fake news sites, an electoral platform in Malaysia. Biology: Anthropic lists five cases where users attempted to obtain potentially useful assistance for biological weapons (including chikungunya and highly pathogenic avian flu in areas where the service is not offered). The accounts were blocked. The AI Desk only repeats the level of detail already public via Reuters and Anthropic.

What this report changes for the public debate

For the reader searching for Anthropic Claude missiles, the editorial message boils down to this. What: a frontier lab publishes its most dense abuse dossier, with GTG case numbers, IoCs and "uplift" measures (speed, scale, depth). Who: Anthropic Threat Intelligence, actors suspected in China/Russia/Iran/Yemen/Mali/Europe, press coverage from Reuters/Straits Times/War Zone. When: report dated September 10, 2026, picked up by the press on the 11th–12th. What it changes: the debate no longer revolves solely around agents escaping a sandbox during training (RubyGems, Hugging Face). It also concerns humans who already direct commercial models as campaign engineers, and guardrails that block often, but not always.

Anthropic insists on two nuances. Humans still keep the decisions that matter to them (targets, monetization, review). Autonomy multiplies scale, not automatically severity. But the economics of attack have shifted. What used to require a specialized team now fits, in several cases, in the hands of a small group or a single operator. In the morning, OpenAI had to explain why its agents had overwhelmed an open-source registry. In the afternoon, Anthropic shows why the same models, used deliberately, are already accelerating warfare, espionage and surveillance.

Sources

• Detecting and countering misuse of AI: September 2026 — Anthropic (Sept. 10, 2026)
• How Anthropic says Claude was used for weapons, spying and cyber operations — Reuters (Sept. 11, 2026)
• How Anthropic says Claude was used for weapons, spying and cyber operations — The Straits Times (Sept. 12, 2026)
• Adversaries Using Claude AI To Target Americans And Develop Missiles — The War Zone (Sept. 11, 2026)
• Threat Intelligence — Anthropic
• US Senate negotiators consider requiring AI firms to mitigate known major risks — Reuters (Sept. 11, 2026)

Frequently asked questions

What is Anthropic's Detecting and countering misuse of AI report?

It is a threat intelligence report published by Anthropic on September 10, 2026, covering the period from December 2025 to August 2026. It details attempts by state and criminal actors to exploit the Claude models before their accounts were cut off.

How was Claude used in the design of conventional weapons?

Anthropic describes a cell in northern Yemen (GTG-87001) that used Claude to code, simulate and debug software linked to a guided rocket, a ballistic missile project of over 2,000 km, and a variant with a hypersonic glider. The lab specifies it has no evidence that an operational system was deployed and that its guardrails blocked many requests, but not all.

What China-related cases does the report mention?

The report describes the development of an electronic warfare software suite targeting 12 sites in Taiwan, an anti-torpedo system for the navy, and research into high-power microwave weapons. Some accounts are said to be linked to Chinese research institutions, including the PLA's Academy of Military Sciences.

What was Beijing's reaction to this report?

Beijing told Reuters it was not aware of the report and opposed "distortions."

What cyber operations does the report document?

The report cites in particular GTG-20006, deemed consistent with the tradecraft of Midnight Blizzard, which automated phishing, persistence, C2 and exfiltration via Claude, and GTG-10007, Chinese operators based in Changsha who targeted around 50 organizations. A North African tech authority lost more than 300,000 national identity records.

How was Claude involved in surveillance activities?

The report cites the use of Claude to track Uyghurs in Syria, social profiling for Iran and the Gulf, and in Mali as an engineering tool for Lakana 360, a state intelligence platform capable of tracking data linked to about 25 million SIM cards.

Did Anthropic take action against these abuses?

Yes, Anthropic says it shut down every operation, strengthened its guardrails, and shared indicators with authorities and partners. In the five cases related to biological weapons, the accounts were blocked.

How does this report change the public debate on AI?

The debate no longer revolves solely around agents escaping a sandbox, but also around humans who already direct commercial models as campaign engineers, with guardrails that block often but not always. Anthropic emphasizes that autonomy multiplies the scale of attacks, which used to require a specialized team but now fits in the hands of a small group or a single operator.