Anthropic Threat Report: Claude Used for Missile Software, Mass Surveillance, and Systematic Theft by Chinese AI Labs

Anthropic has published a threat intelligence report covering December 2025 through August 2026, documenting cases where Claude was misused for cyberattacks, weapons development, mass surveillance, and unauthorized data extraction by rival AI labs. The report breaks findings into seven categories: cyber operations, influence operations, surveillance, fraud, biological misuse, conventional weapons, and unauthorized model distillation.

According to Anthropic, the models most implicated were Haiku, Sonnet, and Opus. Its newer Fable and Mythos models appeared in only one distillation case each, which Anthropic attributes to strengthened safeguards.

Malware that rewrites itself

Anthropic tracks a Russian-speaking espionage actor, designated GTG-20006, that built a feedback loop: AI agents checked whether deployed malware was flagged by antivirus tools and automatically rewrote and recompiled it until detection failed. Anthropic says the group targeted more than 20 organizations, including government ministries, intelligence services, embassies, and defense contractors, concentrated in Ukraine and Europe. The actor reportedly stole a complete proprietary SDK for a drone vision system and gained access through compromised hotel Wi-Fi providers, a method Microsoft called "CaptiveCrunch" in July 2026.

A separate cluster attributed to the ShinyHunters collective (GTG-50014) used Claude to decompile 1.8 million Android apps in search of hardcoded credentials, a technique Anthropic calls "vibe hacking," where a human sets a goal and the model iterates independently until the task completes.

Chinese labs mined Claude at industrial scale

Anthropic says it identified distillation attacks from seven Chinese labs since its first disclosure in February 2026. The largest, attributed to Alibaba's Qwen team (GTG-16005), used more than 3,500 fraudulent accounts to extract Claude's reasoning traces, peaking at nearly 3 million exchanges per day and totaling over 151 million exchanges between May and July 2026. Anthropic claims the data was used to fine-tune Qwen 3.5, 3.6, and 3.7.

Moonshot AI (GTG-16002) allegedly relayed almost 300,000 customer requests to Claude over ten days across 5,380 fraudulent accounts while users believed they were interacting with a Kimi model. DeepSeek (GTG-16001) reportedly detected requests from coding tools like Claude Code and rerouted select users to Claude Opus, logging more than 12.1 million exchanges in 14 days. Anthropic says rerouted traffic included a user apparently linked to China's People's Liberation Army analyzing CCTV footage from hundreds of cameras in Chengdu, and an operator with live credentials tied to Russia's Ministry of Defense.

Zhipu (Z.ai) rotated through 273 accounts and pushed over 770,000 exchanges in ten days through an automated tool converting reasoning traces into training data, reportedly to train GLM-5.3, after first attempting and abandoning an attack on Anthropic's Fable model. Xiaomi and SenseTime allegedly obtained Claude-derived data through replay and third-party purchase, respectively, while MiniMax ran a proxy network via a shell company, according to Anthropic.

Weapons and surveillance

Anthropic documents its first conventional-weapons case: a cell in northern Yemen (GTG-87001) allegedly used Claude Code in place of human engineers to build guidance, navigation, and control software for three missile programs. Separately, a consultant in Mali reportedly used Claude to build "Lakana 360," a surveillance platform monitoring roughly 25 million SIM cards, identifying users by voice across SIM swaps and linking them to a national biometric registry. Anthropic says suspending the account only halted development, since the platform runs on-premises. Iranian units allegedly used Claude to profile 6,388 individuals over a year.

What this means

This report is Anthropic's own account of misuse of its product, and the attribution claims—including specific PLA and Russian Ministry of Defense links—have not been independently verified. The distillation findings suggest safety guardrails and API monitoring are being treated as a solvable engineering problem by well-resourced labs, not a hard stop. Anthropic's push for verified-user access reflects an industry-wide tension: broad API availability drives adoption but also scales abuse at machine speed, a dynamic likely to recur across every frontier lab, not just Anthropic.