Anthropic Report: Claude Was Used to Target US Navy Ships, Build Missiles, and Track Uyghurs

Anthropic published a threat intelligence report on September 12, 2026, documenting five confirmed cases where state-linked and independent actors used its Claude models to support military operations, mass surveillance, and repression. The report covers eight months of tracking and disruption efforts by Anthropic's safety and security teams, according to the company.

Five documented misuse cases

1. Naval targeting. An Iran-linked operation used Claude to build targeting handbooks tracking US ship positions, personnel, aircraft and vessel identifiers, satellite imagery, and websites exposing naval movements. Anthropic says related Iran-linked activity also used the model for propaganda, domestic surveillance, and targeting opposition figures and minorities.

2. Missile guidance software. A weapons cell operating in northern Yemen used Claude Code to develop guidance software for rockets and missiles, according to Anthropic. The team allegedly ran separate Claude instances in parallel — one to write code, one to conduct research, and one to check the others' work — then returned to the model within hours of a failed guided-rocket test to diagnose the malfunction.

3. Targeting Uyghurs in Syria. Anthropic says a China-linked operation used Claude to sift through more than 100 WhatsApp groups and dozens of Telegram channels to identify Uyghurs in Syria who could be pressured or paid into informing on armed Uyghur groups. The model reportedly helped a non-Arabic-speaking operator conduct covert outreach in Syrian Arabic, translating responses and coaching manipulation tactics tied to financial hardship and family separation.

4. Mass phone surveillance. A consultant in Mali allegedly used Claude as the primary engineering resource behind a nationwide surveillance system capable of monitoring roughly 25 million phones — collecting call records, texts, and voice traffic. According to Anthropic, the system could identify individuals by voice across different SIM cards, flag VPN usage, and generate warrantless intelligence dossiers.

5. Virus research routed around safety filters. Researchers on a state-backed grant attempted to use Claude to modify chikungunya, a mosquito-borne virus, to increase transmissibility or evade immune response, for work reportedly destined for a military research institute. Claude blocked the most sensitive requests. Anthropic says the operators then routed the work to a competing model with weaker safeguards — the report does not name which one.

Why it matters

Anthropic frames the findings as evidence that frontier AI is collapsing the resource barriers that once limited sophisticated military, intelligence, and surveillance operations to well-funded state agencies. A handful of operators can now assemble targeting systems, weapons guidance code, and nationwide surveillance infrastructure with a chatbot instead of a technical team.

The report also highlights an unresolved structural problem: safety guardrails at one lab don't stop misuse if another provider's model has weaker filters. Anthropic's chikungunya case is a direct illustration — blocking a request only shifts it elsewhere in a competitive multi-vendor market.

What this means

This report lands amid a broader Washington reckoning over AI safety, with some House lawmakers pushing to delay recess over AI risk and Sen. Bernie Sanders calling for a ban on superintelligence development. President Trump has downplayed existential AI risk, framing competition with China as the bigger threat — a stance that cuts against calls for tighter domestic restrictions.

The report itself contains no independent verification beyond Anthropic's own investigation; the company is both the discloser and the enforcer here, with commercial incentive to demonstrate proactive safety work. Still, the specificity of the cases — naval targeting handbooks, missile guidance iteration cycles, a named virus and a named surveillance scale — suggests these are traceable incidents rather than hypothetical scenarios. The more durable takeaway is structural: as long as multiple AI labs compete on capability with uneven safety enforcement, bad actors will route around whichever model says no.