Anthropic's September threat report: Claude was used to build missiles, drones and state-linked cyberattacks

The report's central judgment is that the bar has collapsed. Anthropic writes that AI's cybersecurity capability has erased the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators. In the cases it recounts, a hacktivist using stolen API keys, disparate financially motivated individuals, and a state espionage operator each sustained multi-victim campaigns that, even just a year ago, would have required many skilled operators and specialist knowledge. For threat intelligence investigators the consequence is that sophistication is no longer a reliable signal of who is behind an operation. Anthropic goes further: every layer of offensive operations has been uplifted by AI, from reconnaissance and tool development to data processing and exploitation. That explains a commonly misread point — public debate tends to focus on whether AI can auto-discover exploits at scale, while the report argues the real risk is more diffuse: adversaries can operate faster, across a broader and deeper surface area, with fewer resources.

The second block is conventional weapons development, a category never disclosed in the report series before. Anthropic says that since its previous threat report in November 2025 it has identified actors using Claude to develop software for conventional weapons including firearms, missiles, armed drones, bombs and other munitions, as well as the targeting and control systems that operate them. It lists six cases and expands in detail on one designated GTG-87001, a weapons engineering cell based in northern Yemen running three programs at once: a guided rocket using a commodity phone-class flight computer with final-phase homing guidance; a multi-stage ballistic missile with a stated range goal above 2,000 km; and a multi-variant missile set referred to as R2000 that includes a hypersonic glide vehicle variant. According to Anthropic, the cell used Claude Code in place of human software engineers to develop guidance, navigation and control (GNC) software: integrating an open-source autopilot onto a phone-class flight computer, writing control and position-estimation software, tuning control settings, running a firmware build pipeline, performing flight simulation, and managing several Claude instances at once with a role assigned to each, much as a lead would delegate work. The report also notes the group's rocket program had been through a live field test, and that a drone swarm project was tested in simulation with its code loaded onto real hardware boards.

The third block is cyber operations, where the largest numbers illustrate how efficiency changes with AI. Anthropic says that in one compromise of a technology provider, the operators exfiltrated more than a terabyte of data including hundreds of thousands of national identifiers and millions of payment card records, then staged the stolen material on a public website to pressure the victim into paying a ransom. At an airline, the actors accessed systems holding tens of millions of passenger records. At an energy company, they claimed they could remotely control the charging current of electric vehicle chargers installed in customers' homes. Another set of cases involves supply-chain theft: one actor breached a software-as-a-service provider and used that foothold to extract data belonging to roughly 200 of the SaaS company's downstream customer organizations; it then conducted a session-store dump containing over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours. The report explicitly notes that AI agents performed nearly all of the work. Anthropic says it has launched a new set of classifiers to better detect and block traffic related to high-yield explosives and weapons development, and shared findings with public- and private-sector partners.

Finally, a few methodological points that matter most to people doing security work. First, Anthropic introduces two of its own analytical tools: the Generative Threat Groups (GTG) numbering system for labeling actors observed abusing AI, and a measure of uplift — how much more harm was caused with AI versus without it — assessed along three dimensions: speed, scale and depth. Second, the report acknowledges that the traditional division of labor in this kind of investigation is shifting: historically governments, UN panels and outside investigators pieced these programs together from recovered hardware and public sources; now a frontier model provider can identify such activity itself, for the simple reason that it sits on the traffic. Third, in the conventional weapons section Anthropic publishes a new set of capability evaluations developed by its Frontier Red Team, measuring AI on tactical intelligence targeting (for example inferring where people are from fragmentary information) and conventional weapons development (for example engineering drones to strike a moving target); the finding is that models are making consistent progress on simulated intelligence and weapons development tasks. That half-sentence deserves more rereading than any case study — because it is a defender admitting the capability curve is still climbing.