Anthropic Bioweapons Report Exposes Five Cases of Claude Misuse

What happened

On September 10, Anthropic published what it called its most detailed threat intelligence report so far. The report describes how people tried to use Claude for cyberattacks, influence operations, surveillance, biological research and weapons building, and says the company disrupted every operation it covers.2 It spans December 2025 through August 2026 and sorts the activity into seven areas of harm. Biological misuse is one of them, alongside conventional weapons development and illicit distillation.14 Headlines summed it up as Anthropic stopping bad actors from turning Claude into a bioweapons assistant. The report itself is more careful than that, and the gap between the two is the real story.

The biology section has five case studies. Anthropic says each involved using its models in ways that could support biological weapons development.1 In one, a scientist tied to a military research institute asked Claude for help with a grant application for gain-of-function work on chikungunya, a virus spread by mosquitoes.7 In another, a researcher outside the United States spent weeks using Claude on highly pathogenic avian influenza, partly on how the virus adapts to mammals.17 The other three involved orthopoxviruses, compounds related to venom, and biological toxins.9 In the last case, a researcher computationally redesigned toxins for a national program and asked Claude to keep the agents' identities vague in progress reports.14

In every case, Anthropic banned the accounts involved. It said it used what it learned to improve its safeguards, enforcement and threat intelligence work.14 It also shared its findings with authorities and industry partners.5

"Stopped" is doing a lot of work

The coverage agrees on the basic facts but frames them differently. Some outlets said the company caught scientists covertly using Claude for lethal bioweapons research.9 Gizmodo said Anthropic claims it stopped suspected bioweapons research, which keeps more distance.8 Anthropic's own wording is more cautious than either. The report calls the people involved working scientists and says outright that it does not claim they meant harm.6 Anthropic also did not name the institutions or countries involved.3

The report also complicates the idea that safeguards blocked the work. In the bird flu case, classifiers flagged the activity and limited the researcher to Anthropic's less capable models, so the work slowed rather than stopped.79 In the two venom and toxin cases, the research went ahead largely unimpeded by the biology safety classifier, and Anthropic says that was intended. The classifier exists to keep novices from getting help recreating known catastrophic agents, not to police research on new compounds that could become either medicines or toxins.14 The Eastern Herald reported that the chikungunya request was blocked before it produced anything useful.10 Still, the full set of cases shows enforcement mostly coming after the fact, through investigation and bans, rather than prompts being refused in real time.

In practice, what got these researchers caught was how they accessed Claude more than what they asked. They used Claude from regions where it isn't offered and took steps to hide the purpose of their research.3 One case involved a platform that sent refused biology prompts to other, more permissive models. Claude wrote much of that routing code, after being told it was a fix for over-refusal.14 Anthropic's conclusion says the cases show substantial dual-use research linked to state actors of concern who regularly get around its access controls, often knowing the work is dual-use. It presents this as something other than proof that Claude is currently enabling imminent biological threats.14

The admission that matters more than the bans

The most important line in the report isn't about any single case. Anthropic says evaluations of older models such as Claude Opus 4 and Claude Sonnet 4.5 showed they were clearly below the level needed to meaningfully help a sophisticated user with dangerous biological research. For today's models, it says, that evidence is no longer certain.14 Tech Times called this the first time a major AI company has said publicly that it can't count on a capability gap between its frontier models and the expertise needed for bioweapons work.7 The Eastern Herald expects the statement to carry further in biosafety policy circles than anything else in the report.10

Anthropic says it has responded by launching recent models, especially Claude Fable 5, with stricter safeguards that block a wide range of dual-use biology questions.3 It also says none of the misuse cases involved Fable or Mythos-class models, apart from one illicit distillation case.14 That caveat matters. The state-linked work happened on Haiku, Sonnet and Opus models, which suggests the more capable systems either worked as intended or simply weren't targeted in these cases.

Distillation adds a further worry. Anthropic says its research shows that a model distilled from a frontier model can help reach dangerous biological or cyber capabilities even when the copied conversations have little to do with those topics. It adds that its safeguards don't carry over once an unauthorized lab distills its models.14 Gizmodo reports that Anthropic says it has stopped distillation attacks from seven China-based labs since it first raised the issue in February.8

Experts split on how alarmed to be

Science magazine says the report was the first public acknowledgment by a leading AI company that one of its products may have been asked to help develop bioweapons, and that it divided experts.6 Andrew Weber, a former U.S. Assistant Secretary of Defense for nuclear, chemical and biological defense who reviewed the report before publication, called some cases chilling examples of state-sponsored bioweapons developers tapping into advanced AI.4 Scripps Research virologist Kristian Andersen took the opposite view, saying many if not all of the experiments described were just basic research.6 Others landed in between. Filippa Lentzos of King's College London cautioned against both extremes, and Johns Hopkins' Gigi Gronvall said some online reactions had been overheated.6

Both sides have a point. Andersen is right that the science in several cases, such as building a venom atlas from public data, looks ordinary on its own.6 But the warning signs Anthropic highlights are not the science itself. They are the context around it: a chikungunya project at an institute connected to a military lab, an orthopoxvirus study at a state-associated laboratory, and deliberately vague naming in progress reports.6 Anthropic's head of threat intelligence, Jacob Klein, said nobody announces they want to build a bioweapon in comic-book fashion, and called the situation incredibly nuanced.4 The more defensible reading is that Anthropic found a pattern worth watching, not a set of foiled plots.

The wider misuse picture

Biology was only one part of a broad report. Anthropic detailed six conventional weapons cases, three in China, two in Russia and one in Yemen. One was a Yemen-based cell that used Claude for guidance software and test-fired a guided rocket. The test seems to have failed, and the group came back to Claude within hours to work out why.14 A Russia-based group built a drone swarm system designed to select targets, including people, and order detonations with no human involved.14 CNN reported that suspected Chinese government-linked operators used Claude to surveil Uyghurs and religious communities, and that queries sent to what one user believed was Moonshot's Kimi model were secretly rerouted to Claude.3

The coverage differs on the report's history. ABC News and Tech Times describe it as Anthropic's fourth threat report.17 The Eastern Herald called it the company's first threat intelligence report.10 Anthropic's own page refers to earlier reports in March, August and November 2025, so the fourth-report count is correct.14

Why it matters now: the IPO lens

Six weeks later, the same issue showed up in a different kind of document. Anthropic's IPO filing warns that its most capable models can give meaningful help to people trying to build chemical, biological or other dangerous weapons. It calls its safeguards incomplete and says they have been circumvented before and could be again.19 CNBC notes that the filing also flags possible legal liability if its models are used to develop weapons. CNN and others tie that risk factor directly to the September bans.1115

This is the context that makes the threat report make sense. The Eastern Herald called it partly a lobbying document, and said so without meaning it as a criticism. It also noted that no AI company has an independent oversight body able to audit findings like these.10 Some critics argue Anthropic overstates AI risk to push for rules that would hold back competitors.16 Tech Times points out the obvious limit: the report can only describe what Anthropic caught, not what it missed or what happened on other platforms.7

The report's main contribution is not proof that Claude stopped a bioweapons program. It is a frontier lab saying, in its own threat report and again in a securities filing, that it can no longer guarantee its models fall below the bioweapons-uplift threshold, and that state-linked researchers are already working around its access controls. That shift deserves attention whatever one thinks of the five case studies.