Blab AI
Anthropic Exposes Yemeni and Iranian Use of Claude AI in Ballistic Missile Development and Biological Weapon Research
On Thursday, September 10 2026, Anthropic published a 154‑page threat‑intelligence dossier that exposed how the company’s Claude AI was weaponized by a Yemeni terror cell and Iran‑backed actors.
The report, part of Anthropic’s September 2026 threat‑intelligence series, catalogues misuse across seven harm domains—cyber operations, influence campaigns, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. According to the company, it halted every operation described and banned the accounts involved.
In a striking case, a group of threat actors based in northern Yemen used Claude Code to craft guidance, navigation, and control software for a multi‑stage ballistic missile that could travel beyond 2,000 kilometers. They merged an open‑source autopilot with a phone‑class flight computer, wrote position‑estimation code, tuned controls, built firmware, and ran flight simulations. The dossier notes the cell test‑fired a guided rocket that failed within hours, prompting the actors to return to Claude for troubleshooting.
Another episode involved an Iran‑aligned threat actor that leveraged Claude to assemble open‑source intelligence on U.S. Navy facilities in the Middle East. The compilation included a roster of U.S. personnel scraped from captions on public military photos, publicly accessible ship and aircraft transponder identifiers, commercial satellite‑imagery query scripts, and a catalog of websites exposing U.S. naval movements.
The report also flags suspected attempts to develop biological weapons and to use Claude to support a propaganda campaign from Iran’s Ministry of Culture and Islamic Guidance aimed at “explanatory jihad.” Anthropic said it had evidence that actors had built an offline simulation toolkit that did not rely on Claude or other engineering computing environments.
Anthropic announced it had disrupted the Yemeni cell and informed public‑ and private‑sector partners to mitigate risks. The company also stated it had no evidence the actors succeeded in fielding an operational device, but it had evidence that they had built an offline simulation toolkit.
The disclosure follows a broader trend of AI misuse for weapon development. Anthropic’s report is the most detailed public casebook to date on how large language models can be repurposed for harmful applications. The company emphasized that as models become increasingly capable, their risks will rise unless developers and society’s defenders act to make them safer.
At present, Anthropic has banned the accounts involved and has no evidence of an operational missile or biological weapon. The report does not mention any regulatory action, but it highlights the need for continued monitoring of AI misuse and for tighter safeguards in the deployment of advanced language models.
The dossier underscores that while AI tools like Claude can accelerate software development, they also lower the barrier for actors lacking traditional engineering expertise. Anthropic’s proactive disclosure and disruption of these misuse cases aim to deter future attempts and to inform stakeholders about the evolving threat landscape.
The report, part of Anthropic’s September 2026 threat‑intelligence series, catalogues misuse across seven harm domains—cyber operations, influence campaigns, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. According to the company, it halted every operation described and banned the accounts involved.
In a striking case, a group of threat actors based in northern Yemen used Claude Code to craft guidance, navigation, and control software for a multi‑stage ballistic missile that could travel beyond 2,000 kilometers. They merged an open‑source autopilot with a phone‑class flight computer, wrote position‑estimation code, tuned controls, built firmware, and ran flight simulations. The dossier notes the cell test‑fired a guided rocket that failed within hours, prompting the actors to return to Claude for troubleshooting.
Another episode involved an Iran‑aligned threat actor that leveraged Claude to assemble open‑source intelligence on U.S. Navy facilities in the Middle East. The compilation included a roster of U.S. personnel scraped from captions on public military photos, publicly accessible ship and aircraft transponder identifiers, commercial satellite‑imagery query scripts, and a catalog of websites exposing U.S. naval movements.
The report also flags suspected attempts to develop biological weapons and to use Claude to support a propaganda campaign from Iran’s Ministry of Culture and Islamic Guidance aimed at “explanatory jihad.” Anthropic said it had evidence that actors had built an offline simulation toolkit that did not rely on Claude or other engineering computing environments.
Anthropic announced it had disrupted the Yemeni cell and informed public‑ and private‑sector partners to mitigate risks. The company also stated it had no evidence the actors succeeded in fielding an operational device, but it had evidence that they had built an offline simulation toolkit.
The disclosure follows a broader trend of AI misuse for weapon development. Anthropic’s report is the most detailed public casebook to date on how large language models can be repurposed for harmful applications. The company emphasized that as models become increasingly capable, their risks will rise unless developers and society’s defenders act to make them safer.
At present, Anthropic has banned the accounts involved and has no evidence of an operational missile or biological weapon. The report does not mention any regulatory action, but it highlights the need for continued monitoring of AI misuse and for tighter safeguards in the deployment of advanced language models.
The dossier underscores that while AI tools like Claude can accelerate software development, they also lower the barrier for actors lacking traditional engineering expertise. Anthropic’s proactive disclosure and disruption of these misuse cases aim to deter future attempts and to inform stakeholders about the evolving threat landscape.
