Anthropic discloses how Claude was misused - biological weapons, missiles and surveillance of 25 million SIM cards

Technology companies rarely tell you what went wrong. On Thursday, September 10, Anthropic published a long report on what people tried to use Claude for over the past eight months. By yesterday the company's post on X had 36 million views, and David Agranovich, who ran threat disruption at Meta for eight years, wrote: "Breaking my X hiatus because this is fascinating (...). It's noteworthy that Anthropic is being this transparent."

The report covers December 2025 to August 2026 and seven areas: cyber operations, influence operations, surveillance, conventional weapons, biology, scams and illicit distillation. The most striking case comes from Mali. An independent consultant in Bamako, probably working on his own, built "Lakana 360" for the country's intelligence service (ANSE), a platform that monitors roughly 25 million SIM cards across all three national mobile operators. The system records calls, texts and voice traffic, identifies people by voice even after they swap SIM cards, flags VPN users and joins the data to the national biometric registry. At the operator's request, the warrant requirement was removed from the component that writes an intelligence dossier on any phone number.

This is where it gets interesting. Anthropic banned the account, but the report says plainly: "Account enforcement actions do not affect the deployed product." The finished system runs on local servers, on local models. Claude was only the engineering team that wrote the code.

The second case is a cell in northern Yemen running three weapons programs: a guided rocket with an onboard controller built from ordinary smartphone parts, a ballistic missile with a stated range goal above 2,000 km, and the "R2000" family including a hypersonic glide vehicle variant. They wrote the guidance software in Claude Code instead of hiring engineers, running several instances at once with divided roles: one wrote code, another did research, a third reviewed. Safeguards blocked some of their requests, so they split the work across many sessions, so that no single one revealed the whole picture. They ran a field test of the rocket. It appears to have failed - and within hours they were back with Claude working out why.

The biology section describes five cases, and the same problem returns in each: dual-use research looks innocent until you place it in context. In May a classifier blocked help with a grant application for gain-of-function work on the chikungunya virus, aimed at increasing transmissibility and immune evasion. The applicants were civilian scientists, but the work was to be carried out at a military research institute. The platform routing the requests tunnelled traffic through US infrastructure, and after the ban its operator regained access within days and added a mechanism that forwarded refused prompts to a competitor's model. Jacob Klein, who leads threat intelligence at Anthropic, put it this way: "You are not seeing someone in a comic book kind of way say, 'Hey, I want to build a biological weapon.'"

Sometimes safeguards work in ways headlines do not show. A researcher working on mammalian adaptation of H5 avian influenza exchanged thousands of messages with Claude over several weeks - but classifiers pushed him down to the company's weakest models, Sonnet 4 and Haiku 4.5. Anthropic estimates the researcher got mainly clerical help with study design and data analysis. In another case Opus 5 wrote an entire orthopoxvirus grant application from scratch in about an hour: hypothesis, experimental design, dosing and statistics. It went through because research on weakening a virus does not look dangerous.

A separate chapter covers seven Chinese labs that extracted Claude's reasoning. The largest operation was run by Alibaba: 151 million requests from May to July, peaking at almost 3 million a day from more than 3,500 fraudulent accounts, with the harvested transcripts going into training the Qwen models. Over ten days Moonshot relayed about 300,000 of its own customers' requests to Claude and showed them Claude's answers as if they came from Kimi; from May to July it collected more than 23 million requests in total. DeepSeek did the same, and over fourteen days in July 12.1 million requests were attributed to it. Users had no idea, and the relayed conversations contained a pharmaceutical company's financial forecasts, working access keys, footage from several hundred cameras in Chengdu and credentials to a database of a government agency linked to Russia's defence ministry.

It is worth reading this report with some reserve, and Agranovich says so himself: "Anthropic notes that some of the impact numbers for some of the ops come from the attacker's own metrics. We've seen a lot of inflation there." Some commenters on Hacker News accused the company of a double standard: Anthropic names Chinese firms and identifies the countries the weapons cells operated from, but withholds institutions and states for the biology researchers, because "we do not assert that they intended harm". The day before the report came out, China's Ministry of Commerce rejected earlier accusations by US agencies as politicising an ordinary technique and promised a response if Washington moves against Chinese companies.

One thing holds regardless of whom you believe. A model provider has given us another, far more detailed list of concrete uses with numbers, instead of speculation about what AI might one day make possible. In the biology section Anthropic writes that no company, in AI or outside it, has publicly shared evidence of this kind of use of its own platform before. Kimi's customers were sure they were talking to Kimi. An engineer at a Chinese company pasted internal code and working keys into it, and all of it went to Claude and was saved for training. And the most practical conclusion is this: if you use a cheap model through an intermediary, you may not know whose model is really reading your data.

Distillation - training a smaller model on a larger one's answers so it picks up its abilities at a fraction of the price. It is a standard training method; Anthropic calls "illicit distillation" the industrial-scale harvesting of someone else's answers without permission and against the terms of access. Gain-of-function - research that deliberately alters an organism so it gains a new or stronger property, for example higher transmissibility. Classifier - a separate model watching whether a request breaks the rules; it blocks the answer before it reaches the user.