Anthropic Says Iran-Linked Actors Used Claude to Build U.S. Navy Targeting Guides

Anthropic’s September 2026 threat-intelligence report describes how malicious actors allegedly tried to use Claude across seven harm areas between December 2025 and August 2026. Its most consequential Iran-related case involved an account that used the model to collect and analyze public information for targeting recommendations against U.S. naval forces in the Middle East. Anthropic says it disrupted the activity. 1518

The key distinction matters: the report documents alleged misuse of an AI system to support research and planning. It does not establish that an attack occurred, that Navy systems were compromised, or that the resulting material produced a real-world operational effect.

What the Navy-targeting case involved

Anthropic said an Iran-nexus actor used Claude to compile open-source targeting handbooks and track naval positions. Reporting based on the company’s findings says the inputs included personnel names drawn from captions on public military photographs, publicly accessible ship and aircraft transponder identifiers, commercial satellite-imagery query scripts, and websites that exposed naval-movement information. 182326

The actor also reportedly researched potential weaknesses in maritime communications and shipboard systems. That makes the episode an example of AI-assisted intelligence preparation: using a model to aggregate, organize, and analyze information that was already publicly accessible. 2051

This is not evidence that Claude independently conducted surveillance or enabled an attack. The reported value of the model was speed and synthesis—helping turn disparate public data into structured research and targeting material.

A separate reported surveillance effort

Anthropic also described a separate Iran-linked account that used Claude while developing a domestic surveillance system combining automatic license-plate recognition with mobile-device identifier interception or tracking. 51

The available reporting does not establish whether that platform was deployed, how broadly it operated, who was targeted, or whether it produced surveillance at scale. Those unanswered questions are important: designing or refining a capability is not the same as proving its field use or effectiveness.

Propaganda campaigns and false independence

The report also identified three Iranian state-aligned influence operations that described their work as “soft war” or “cognitive warfare,” aimed at shaping opinion inside Iran and abroad. Anthropic-linked reporting named the Islamic Culture and Communications Organization, the Islamic Propaganda Office of Khorasan Razavi, and the Bina Cultural Observatory of the Islamic Propaganda Organization. 27

According to that reporting, the accounts used Claude for campaign plans, doctrine and planning documents, persona systems, target databases, and multilingual content production. 27

A central tactic was attribution laundering: presenting state-backed narratives as though they originated with independent analysts or Western think tanks. The evidence supports the existence of an effort to disguise the origin of content, but it does not demonstrate that the campaigns reached large audiences, changed public opinion, or materially influenced events. 7

Anthropic’s response and the limits of the findings

Anthropic says its Threat Intelligence team identified and disrupted the operations covered by the report. The company’s report spans cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional-weapons development, and model distillation. 1538

The report also describes alleged Russian-linked cyber activity against Ukrainian targets, Chinese-linked activity, and a Yemen-based cell’s use of Claude in work related to ballistic-missile guidance. These cases broaden the report’s warning about AI misuse, but the available material does not support firm conclusions about operational success in each case. 45

The larger security lesson

The report’s strongest takeaway is not that AI has replaced traditional intelligence or military operations. It is that capable models can lower the time and organizational burden required to research targets, assemble open-source data, draft code and documents, build surveillance concepts, and produce persuasive content in multiple languages.

For military organizations and other high-value institutions, that raises the practical importance of reducing unnecessary public exposure of personnel, movement, technical, and operational information. For AI providers, it reinforces the need for detection, account enforcement, and threat-intelligence sharing. The cases described by Anthropic show attempted misuse and accelerated workflows—not verified autonomous attacks or demonstrated battlefield outcomes. 1518