Anthropic Threat Report: Claude Used for Missile Software, Mass Surveillance, and Systematic Theft by Chinese AI Labs
Anthropic's latest threat intelligence report covers December 2025 through August 2026, documenting Claude's misuse in espionage, weapons development, and nationwide surveillance operations. The report also details how seven Chinese AI labs ran covert networks—some routing their own customers' requests through Claude—to extract training data at industrial scale.
Anthropic has published a threat intelligence report covering December 2025 through August 2026, documenting cases where Claude was misused for cyberattacks, weapons development, mass surveillance, and unauthorized data extraction by rival AI labs. The report breaks findings into seven categories: cyber operations, influence operations, surveillance, fraud, biological misuse, conventional weapons, and unauthorized model distillation.
According to Anthropic, the models most implicated were Haiku, Sonnet, and Opus. Its newer Fable and Mythos models appeared in only one distillation case each, which Anthropic attributes to strengthened safeguards.
Malware that rewrites itself
Anthropic tracks a Russian-speaking espionage actor, designated GTG-20006, that built a feedback loop: AI agents checked whether deployed malware was flagged by antivirus tools and automatically rewrote and recompiled it until detection failed. Anthropic says the group targeted more than 20 organizations, including government ministries, intelligence services, embassies, and defense contractors, concentrated in Ukraine and Europe. The actor reportedly stole a complete proprietary SDK for a drone vision system and gained access through compromised hotel Wi-Fi providers, a method Microsoft called "CaptiveCrunch" in July 2026.
A separate cluster attributed to the ShinyHunters collective (GTG-50014) used Claude to decompile 1.8 million Android apps in search of hardcoded credentials, a technique Anthropic calls "vibe hacking," where a human sets a goal and the model iterates independently until the task completes.
Chinese labs mined Claude at industrial scale
Anthropic says it identified distillation attacks from seven Chinese labs since its first disclosure in February 2026. The largest, attributed to Alibaba's Qwen team (GTG-16005), used more than 3,500 fraudulent accounts to extract Claude's reasoning traces, peaking at nearly 3 million exchanges per day and totaling over 151 million exchanges between May and July 2026. Anthropic claims the data was used to fine-tune Qwen 3.5, 3.6, and 3.7.
Moonshot AI (GTG-16002) allegedly relayed almost 300,000 customer requests to Claude over ten days across 5,380 fraudulent accounts while users believed they were interacting with a Kimi model. DeepSeek (GTG-16001) reportedly detected requests from coding tools like Claude Code and rerouted select users to Claude Opus, logging more than 12.1 million exchanges in 14 days. Anthropic says rerouted traffic included a user apparently linked to China's People's Liberation Army analyzing CCTV footage from hundreds of cameras in Chengdu, and an operator with live credentials tied to Russia's Ministry of Defense.
Zhipu (Z.ai) rotated through 273 accounts and pushed over 770,000 exchanges in ten days through an automated tool converting reasoning traces into training data, reportedly to train GLM-5.3, after first attempting and abandoning an attack on Anthropic's Fable model. Xiaomi and SenseTime allegedly obtained Claude-derived data through replay and third-party purchase, respectively, while MiniMax ran a proxy network via a shell company, according to Anthropic.
Weapons and surveillance
Anthropic documents its first conventional-weapons case: a cell in northern Yemen (GTG-87001) allegedly used Claude Code in place of human engineers to build guidance, navigation, and control software for three missile programs. Separately, a consultant in Mali reportedly used Claude to build "Lakana 360," a surveillance platform monitoring roughly 25 million SIM cards, identifying users by voice across SIM swaps and linking them to a national biometric registry. Anthropic says suspending the account only halted development, since the platform runs on-premises. Iranian units allegedly used Claude to profile 6,388 individuals over a year.
What this means
This report is Anthropic's own account of misuse of its product, and the attribution claims—including specific PLA and Russian Ministry of Defense links—have not been independently verified. The distillation findings suggest safety guardrails and API monitoring are being treated as a solvable engineering problem by well-resourced labs, not a hard stop. Anthropic's push for verified-user access reflects an industry-wide tension: broad API availability drives adoption but also scales abuse at machine speed, a dynamic likely to recur across every frontier lab, not just Anthropic.
Related Articles
Anthropic Opens Cyber Verification Program to More Security Teams With Reduced Claude Safety Filters
Anthropic is expanding its Cyber Verification Program (CVP) to a much larger pool of vetted security professionals, giving them access to Claude's most powerful models with reduced safety filters. Access is split into three tiers: Defense, Red Team, and Specialized. Anthropic claims partners in its predecessor program, Project Glasswing, found at least 129,000 confirmed vulnerabilities between April and July 2026.
Anthropic Says New Defenses Cut Claude Reasoning-Token Extraction by 90–99%
Anthropic says new defenses have reduced the volume of Claude reasoning tokens extracted through distillation attacks by 90 to 99 percent. The company restricts access to internal reasoning steps, runs an extraction classifier, and has banned tens of thousands of accounts. It also names Zhipu and Moonshot as participants, and concedes that legitimate users are being caught too.
Anthropic study: GLM-5.2 completes full AI self-replication chain on $55 TV boxes in 4 of 5 runs
An Anthropic study found that GLM-5.2 completed a full self-replication chain across all eight test nodes, built from $55 Android TV boxes, in four of five runs. The researchers say no current model is both small and capable enough to spread in the wild, but expect that gap could close by the end of 2026.
Anthropic cuts internal evals off from the live internet after its AI agents exploited government sites
Anthropic says it has turned off live internet access for all internal evaluations after its AI agents exploited websites, including some run by U.S. government agencies. The lab attributes the behavior to flawed training environments that rewarded reward hacking, and says it will not restore access until it is certain it can monitor and control its agents.
Comments
Loading...