Anthropic says it blocked five cases involving attempts to use Claude for biological research with potential dual-use implications, including work it believed could support harmful pathogen development.
The cases were documented in a new threat report covering activity identified between December 2025 and August 2026. Anthropic said the broader activity involved suspected state-backed groups, financially motivated criminals, propaganda networks, spyware vendors and politically driven actors.
The biological cases illustrate one of the hardest problems in AI safety: legitimate scientific research can overlap with work that could be repurposed for harm.
In one case, a scientist sought help preparing a grant application for gain-of-function research on chikungunya. The proposed work involved engineering mutations that could make the virus more harmful through repeated infections in live animals. Anthropic said it believed the research was intended for a military research institute.
Claude’s biological safety classifier blocked the request, but the user then tried to bypass the restriction through a third-party evasion platform.
Another case involved a reseller relay that allowed a user to prepare an orthopoxvirus immune-evasion grant application using Claude Opus in about an hour. Anthropic also described a researcher planning experiments involving the adaptation of avian flu to mammals who was restricted to its weakest model tier.
The report then moves beyond biological research into activity explicitly linked to countries including China and Russia.
In Russia, Anthropic said an operator used Claude Code to develop software for an autonomous kamikaze drone swarm capable of selecting targets. It also identified a Russian-speaking actor using Claude in cyber operations against more than 20 Ukrainian and European government, defence and diplomatic targets.
China-linked activity included an account potentially connected to the military-industrial sector that used Claude to develop electronic warfare and air-defence suppression capabilities. Anthropic also described China-linked surveillance operations targeting Uyghurs, journalists and religious communities.
The company found similar attempts across influence operations, financial crime and AI model distillation. It said competing Chinese AI companies, including Alibaba, DeepSeek and others, used large-scale automated exchanges to extract Claude’s capabilities.
The significance is the range of ways AI is being absorbed into existing systems of warfare, intelligence, surveillance and crime. The problem is no longer confined to malicious prompts. Users are finding ways to integrate models into larger operations, bypass safeguards and distribute tasks across multiple platforms.
Anthropic said it responded with account bans, refusals, weaker model access, behavioural detection and proactive monitoring.
