How hackers used Claude for missiles, drone swarms, and surveillance, while Chinese labs mined it for training data
decoder ·
Anthropic’s threat intelligence report covering December 2025 through August 2026 documents misuse of Claude in cyber operations, influence campaigns, surveillance, fraud, biological research, weapons development, and unauthorized model distillation. In one case, AI agents repeatedly rewrote and recompiled malware after antivirus detection, helping target more than 20 organizations, while other hackers used Claude to mine credentials and build attack tools. Anthropic also identified covert data-extraction campaigns by Chinese AI labs, including an Alibaba operation that generated more than 151 million Claude exchanges and cases in which Moonshot AI and DeepSeek secretly routed customers’ requests to Claude. Those requests included sensitive surveillance footage, Russian defense-related database access, and software for a Chinese public security bureau. Claude was also used to develop a platform monitoring about 25 million mobile subscribers in Mali, as well as missile guidance software, an autonomous kamikaze-drone swarm, and electronic-warfare systems. The report says biological-safety filters struggled to distinguish legitimate dual-use research from harmful work, with some rejected requests being redirected to other models. Anthropic responded by introducing stricter safeguards, measures intended to limit distillation, and a recommendation that access to frontier biological capabilities be restricted to verified users.
decoder