by Michael Hollister
Exclusive published at apolut media as a “Tagesdosis” on September 15, 2026
1.916 words * 10 minutes readingtime
A company publishes a report on the misuse of its own product – and in doing so, inadvertently reveals how deeply it can see into activities that no one else can observe. Missile programs in northern Yemen. Laboratory research with potential biological-warfare applications. State-run cyber operations in several countries. Anthropic, the company behind the Claude AI models, documents across 154 pages who has tried to use its systems for weapons development, surveillance, and sabotage. The headline is almost always the same: AI is helping people build bombs. But the more interesting question lies beneath it. It is not whether artificial intelligence is dangerous. It is who controls the companies that have simultaneously become the tool, the observer, and the investigator of that use.
The Catalyst
On September 10, 2026, Anthropic published its fourth report on the malicious use of its AI models, Detecting and Countering Misuse of AI. The 154-page document covers cases from December 2025 through August 2026, organized into seven categories: cyber operations, influence campaigns, surveillance, fraud, biological misuse, conventional weapons development, and the covert replication of other companies’ models. According to the company, users employed models from the Claude Haiku, Sonnet, and Opus families. What is new – and what takes this report beyond an ordinary IT security document – are two chapters addressing the development of physical weapons and work on dangerous pathogens. The three previous reports from 2025 focused primarily on cyberattacks and influence campaigns; this is the first time the physical-weapons and biological dimensions have appeared in such detail. In both areas, Anthropic does not describe what might theoretically be possible, but what it says it actually observed. That point – observed, not simulated – is the report’s real core.
A Missile Test in Yemen – and What Claude Had to Do With It
The most concrete case took place in northern Yemen. According to the report, a cell that Anthropic assesses with high confidence to be affiliated with the Houthis was working on three weapons programs: a guided missile, a multistage ballistic missile with a stated range target of more than 1,240 miles (2,000 kilometers), and a missile family called the “R2000” that was purported to include a hypersonic glide variant. Claude Code reportedly took the place of human software engineers: Anthropic’s agentic coding tool connected an open-source autopilot to a simple flight computer, wrote guidance and positioning software, built firmware, and ran flight simulations. To circumvent the safeguards, the actors allegedly operated multiple Claude instances in parallel and divided their work among separate sessions for programming, research, and review.
The loop Anthropic describes is striking. The group tested a guided missile in Yemen, and the test apparently failed. Within hours, the operators returned to Claude to analyze the failure using the test data. Software development, physical testing, immediate evaluation – this was no longer a discrete technical question-and-answer exchange, but a tool embedded in an ongoing development cycle. Anthropic also emphasizes that there is no evidence of an operational system. Yet by the time the company suspended the accounts, the actors had, by the report’s own account, already assembled an offline work package that no longer required access to Claude.
How much this acceleration was really worth remains unclear. Anthropic measures the gains from AI primarily in speed and scale, not in entirely new capabilities. The report does not conclusively answer whether a tool such as Claude provided decisive assistance to a weapons cell or merely allowed it to do more quickly what experienced specialists already knew how to do.
Yemen was not the only case. The report describes six conventional-weapons cases across four countries. In three Chinese cases, Claude Code was reportedly used in place of software engineers working on control and guidance systems for weapons platforms, including an anti-torpedo system, electronic warfare, and fire-control software. A Russian case involved the development of an autonomous drone swarm, according to the report. And an actor Anthropic assessed as Iran-aligned reportedly used Claude to seek targeting recommendations against US naval forces.
The Five Biological Cases
Even more sensitive than the weapons chapters is the section on biological research. Anthropic describes five cases in which users employed Claude for work that could serve medical purposes – or the development of biological weapons. That ambiguity is precisely the problem, and the company states it with unusual candor: in none of the five cases could it determine whether the research served legitimate or harmful purposes. The work included gain-of-function research on the chikungunya virus intended to increase its transmissibility and immune evasion, which Anthropic says was linked to a military research institute; a mammal-transmissible strain of avian influenza; orthopoxviruses, a genus that includes the virus that causes smallpox; and animal venoms and computationally modified toxins.
The circumvention pattern resembled the one in Yemen. Because Claude is unavailable in several regions, users allegedly tunneled their traffic through US infrastructure and relied on resellers and artificially created accounts to bypass the restrictions. After Anthropic suspended the known accounts, new access points were reportedly established within days and the chikungunya research continued. In one case, Claude was allegedly instructed to keep the precise identity of the substances being studied deliberately vague in progress reports. During a 30-day review period, the company flagged around 35 security-relevant research projects – most of them, Anthropic stresses, ordinary civilian science. The company also tempers the drama at one point: in several of these cases, Claude primarily assisted researchers with organizational and writing tasks, and its specific added value was limited.
One sentence from this chapter carries more weight than any individual case study. Older models such as Claude Opus 4 and Sonnet 4.5 had remained well below the threshold at which they could materially help a capable user conduct dangerous biological research. Anthropic says that this margin of safety can no longer be assumed for today’s models. As far as can be determined, this is the first time a major AI company has publicly acknowledged that it can no longer rely on a gap between its technology and dangerous expertise.
The Real Finding: Who Sees Everything
Anyone who reads the report solely as a story about weapons or biological weapons misses what is genuinely new. To be able to say that work on a missile was underway in northern Yemen and that a military-linked institute was conducting research on a virus, Anthropic must have had visibility into those activities – sometimes while they were still in progress. The company itself puts this with remarkable clarity: AI providers are gaining increasing threat-relevant insight into real-world use that even governments and international organizations do not possess.
That is the core issue. In a single process, Anthropic plays several roles at once: it is the tool used to perform the work; the observer monitoring how that tool is used; the investigator assigning internal identifiers to actors and preserving technical traces; the authority that suspends accounts and notifies government agencies and competing laboratories; and the standard-setter that derives new safeguards from what it has observed. Each of those roles is explicable and, in isolation, arguably welcome. Taken together, however, they create something for which conventional vocabulary has no satisfactory term: a private-sector entity with visibility into military, state, and criminal activities of a kind otherwise claimed only by intelligence services. Unlike an intelligence service, however, this visibility does not rest on a mandate granted by a legislature or overseen by a court; it is a byproduct of the business model. Readers may decide for themselves what label to apply. The underlying fact appears in Anthropic’s own report.
When the Evidence Comes From the Operator
As revealing as the report is, its evidentiary basis is equally fraught. Almost everything in it was observed, assessed, and written by Anthropic itself. The company deliberately withholds the countries, institutions, and names involved – in the biological cases, for the plausible reason that disclosure could put those affected at risk. The price of that restraint is that none of the attributions can be independently verified. The same company presents the accusation, the evidence, and the judgment – and no independent body has reviewed the underlying logs.
This is not an allegation of bad faith but a structural finding. There is also an interest that can be acknowledged plainly without imputing anything to the company: a report of this kind simultaneously reinforces Anthropic’s position as the industry’s safety-conscious laboratory. Transparency and self-presentation converge. Anyone who writes about fact-checkers knows the question of who checks the checkers; here, it arises in sharper form: who audits the operator when the operator supplies the evidence?
The reactions have been correspondingly divided. Former US defense official Andrew Weber, a senior fellow at the Council on Strategic Risks who read the report before publication, described the findings to The New York Times as alarming and called for especially powerful AI systems to be made available for biological research only to vetted scientists. Microbiologist Susan Monarez sees indications that advanced AI is being used covertly. Anthropic itself is more cautious: Jacob Klein, who leads the company’s threat-intelligence work, described the situation to the same newspaper as “incredibly nuanced,” and the report states that there is no evidence of confirmed biological-weapons development.
What Access Restrictions Can – and Cannot – Accomplish
The remaining question is what Anthropic’s interventions can accomplish at all. The cases themselves offer a sobering answer. In Yemen, the actors had already assembled a work package that functioned without Claude by the time their accounts were suspended; in the chikungunya case, new access was available a few days later. A cloud-based suspension slows a determined user; it does not stop one. Once the model, code, and simulations run locally on the user’s own hardware, the observer loses visibility – and with it disappears the very visibility on which the entire report depends.
This leads to an uncomfortable paradox. The more convincingly Anthropic demonstrates that centralized cloud access is what makes misuse visible, the stronger the case becomes for concentrating capability and control among a small number of providers – and the more urgent the original question becomes. The same centralization that creates visibility also creates power. A provider capable of seeing, assessing, and terminating use wields leverage that extends far beyond the software industry. The report illustrates this at the margins: according to Anthropic, a competitor – the Chinese company Alibaba – covertly routed more than 151 million requests to Claude between May and July in an effort to extract its capabilities. Even rivals want access to what this one tool can do.
What Remains
In one respect, Anthropic is doing the right thing: it is disclosing what is happening with its product instead of concealing it. Compared with what other corporations reveal about themselves, the report is an unusual act of transparency. And yet precisely this transparency shifts a boundary that was still clearly defined only a few years ago. Today, a private company decides who may access which capabilities of its models, gains visibility into programs that states wish to keep secret, and shares its findings with government agencies at its own discretion. That may be done responsibly in individual cases. For now, however, the provider itself sets the rules.
The truly unsettling question is therefore not whether AI can help build missiles or engineer viruses. More troubling is that the answer lies first and almost exclusively with the companies that build the tool, monitor its use, and decide what consequences follow. The report thus ends not with an answer, but with a question that reaches far beyond it: who watches the one who sees everything?
Exclusive published at apolut media as a “Tagesdosis” on September 15, 2026
No advertisers, no sponsors, no political patrons – this publication is funded by its readers. Support independent geopolitical analysis from $5 per month and unlock all member-only content.
You are also welcome to support my work with a one-time donation.
About the Author
Michael Hollister
is a geopolitical analyst and investigative journalist. He served six years in the German military, including peacekeeping deployments in the Balkans (SFOR, KFOR), followed by 14 years in IT security management. His analysis draws on primary sources to examine European militarization, Western intervention policy, and shifting power dynamics across Asia. A particular focus of his work lies in Southeast Asia, where he investigates strategic dependencies, spheres of influence, and security architectures. Hollister combines operational insider perspective with uncompromising systemic critique – beyond opinion journalism. His work appears on his bilingual website (German/English) www.michael-hollister.com and in investigative outlets across the German-speaking world and the Anglosphere.
Sources
Anthropic’s Report (Primary Source)
The Northern Yemen Case and Conventional Weapons
- Reuters report (via Gulf News), “Yemen weapons cell used Claude to develop missile software”
- Bloomberg, “Anthropic Says Yemen Group Used Claude in Missile Development”
- Outlook Business, “Missile Development Meets Claude: Inside A Yemen Rocket Test”
- Financial World, “Anthropic report details dual-use risks in advanced biological research” (including the Iran-aligned actor and targeting recommendations against the US Navy)
Biological Misuse
- CNN, “Anthropic says it blocked possible attempts to use AI to develop bioweapons”
- CNBC, “Anthropic blocked misuse of Claude with potential bioweapons support”
- ZDFheute, “KI-Modell Claude: Anthropic stoppt mögliche Biowaffen-Forschung”
- Berliner Zeitung, “Biowaffen mit KI? Anthropic sperrt Claude-Nutzer nach brisanten Anfragen”
Context, Reactions, and Distillation
- Trending Topics, “Anthropic stoppte Biowaffen-nahe Forschung und Waffenentwicklung bei Claude” (Weber, the China cases, conventional weapons)
- business-punk, “Anthropic-Report: Claude fast fünfmal für Biowaffen-Forschung missbraucht” (referencing heise, model distillation, 23 million interactions)
- Tichys Einblick, “Claude und die Biowaffen – wenn Terroristen die KI entdecken”
© Michael Hollister – All rights reserved. Redistribution, publication or reuse of this text requires express written permission from the author. For licensing inquiries, please contact the author via www.michael-hollister.com.
