How Threat Actors Bypassed Claude Controls, According to Anthropic

Anthropic’s September 2026 threat-intelligence report describes how suspected state-linked and criminal actors attempted to misuse Claude between December 2025 and August 2026. The company said it disrupted activity across cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit model distillation. Claude Haiku, Sonnet and Opus appeared in the identified cases. 16

The central finding is not that every attempted activity succeeded. Rather, the report shows how AI can reduce the effort required for reconnaissance, surveillance, fraud and cyber operations—and how platform restrictions can be bypassed through account abuse. Anthropic said it found no evidence that an operational weapon developed with Claude had been deployed. 46

How actors reportedly bypassed access controls

The cases involved attempts to evade geographic and platform restrictions through VPNs, fraudulent accounts, compromised credentials and account rotation. These techniques allowed actors to seek access despite provider controls designed to limit misuse. 4

Anthropic also reported related abuse of the surrounding AI ecosystem. That included compromised or resold API keys and session tokens, as well as websites impersonating AI products or providers—including Claude Code—to distribute credential-stealing malware. 412

The implication is that model safety measures cannot be evaluated only at the prompt level. Account creation, identity verification, payment abuse, credential security and detection of coordinated account activity are also part of the security boundary.

The reported misuse cases

Weapons-related engineering and drone research

Anthropic described a Yemen-based guided-weapons engineering cell that used Claude in work on software associated with a guided rocket, a multi-stage ballistic missile and a hypersonic glide missile. The company said it had no evidence that an operational weapon developed with Claude was deployed. 6

A separate Russia-linked actor reportedly sought help related to an autonomous kamikaze-drone swarm. The available reporting characterizes this as attempted AI-assisted development rather than evidence of a completed or fielded system. 5

Surveillance, repression and influence operations

The report also described AI-assisted surveillance and intelligence collection. In a China-linked case, an engineer working on a municipal Public Security Bureau case-management system reportedly developed a tool to compare a person’s movements with police records using a national ID number. 4

Other reported cases included a Mali-linked effort to intercept communications across mobile operators and an Iranian operation involving social-network identity harvesting and analysis of more than 155,000 tweets for intelligence or influence purposes. The material available supports Anthropic’s detection claims, but does not establish the real-world effectiveness or operational impact of every campaign. 4

Anthropic’s warning is that AI can make established surveillance and repression practices cheaper, faster and easier to scale—not necessarily by creating entirely new harms, but by lowering the labor and expertise required to carry them out. 4

Cyber espionage, fraud and model theft

The report documented cyber-related activity ranging from credential theft and intrusion support to semi-autonomous AI-assisted attack workflows. It also described operations targeting government, financial and commercial entities across Asia. 4

Russia-linked activity reportedly included cyber espionage and exposure of credentials connected to a Russian defense-related government database through model-query routing. 5

China-linked cases included efforts to extract or distill Claude’s capabilities, reportedly using large numbers of fraudulent accounts. Anthropic said that illicit distillation was one of the seven harm areas covered by its investigation. 416

What Anthropic said it did

Anthropic said it disrupted the identified operations, banned associated accounts, updated safeguards based on the cases, and shared relevant intelligence with appropriate government authorities and industry partners. 4

Those actions can cut off a particular route to a commercial model and provide useful indicators for other defenders. They do not, however, remove the underlying tools or motivation behind the activity.

The limit of account bans

Anthropic explicitly framed the challenge as broader than access to Claude. Actors removed from one service may seek stolen accounts, move to another provider or use open-source models. 4

That limitation matters because the report is best read as evidence of a shifting threat environment, not proof that banning a set of accounts permanently resolves misuse. Provider enforcement can raise the cost of abuse, expose campaigns and help protect legitimate users, but it must be paired with stronger identity controls, credential protection, coordinated threat sharing and defenses that account for AI tools beyond any single platform.

Bottom line

Anthropic’s report portrays AI misuse as an operational scaling problem: actors reportedly used familiar evasion techniques—VPNs, fraudulent accounts and stolen credentials—to apply general-purpose models to weapons-related research, surveillance, influence operations, cyber activity and fraud. 416

The company’s disruption efforts limited access to Claude in the identified cases. Its larger warning is that increasingly capable AI is lowering barriers to harmful work across the ecosystem, while the available evidence does not show that every reported attempt, including weapons-related work, reached operational deployment. 46