SAN FRANCISCO — The scientist who asked Claude about chikungunya was not drafting a manifesto. The grant application was genuine, the mosquito-borne pathogen was real, and the request to help design experiments that would increase the virus’s lethality was, according to Anthropic, blocked before it could yield anything useful.
That case is the sharpest detail in a threat intelligence report Anthropic published Thursday covering nine months of Claude misuse from December 2025 through August 2026. The company describes seven harm categories, five case studies involving biological research alone, and a quiet but significant finding about its own technology: newer Claude models are no longer comfortably below the threshold that would allow them to meaningfully assist in weapons development.
The report arrives as a growing body of evidence challenges one of the more optimistic assumptions in AI development: that frontier language models are inherently limited by what they know and therefore incapable of filling the gap between a bad idea and a working weapon. Anthropic’s researchers are no longer certain that gap exists for biological threats.
The chikungunya case, flagged internally in May 2026, involved a scientist who asked Claude to help write a grant application for gain-of-function research on the pathogen. The work would have engineered mutations to increase the virus’s lethality through successive live animal infections, a methodology researchers use to study pathogen evolution but one that biosafety advocates have long argued carries unacceptable risks. Anthropic said it blocked the conversation and referred the case to law enforcement.
“Older models were well below the threshold where they could meaningfully assist in bioweapons development,” the report states. “This is no longer a certainty with newer models.”
That sentence is likely to reverberate in biosafety policy circles in a way that most of the report’s other findings will not. Cyber operations, influence campaigns and conventional weapons misuse have defined precedents and regulatory frameworks. The idea that a commercial AI company’s own public documentation might serve as a reference point for biological threat assessment has no clear institutional home.
Beyond biology, the report identifies a pattern of state-linked or politically motivated misuse across three continents. Russian state media, the report says, used Claude to produce content designed to look like independent journalism while embedding fabricated claims, including false reporting on the Moldovan election. Anthropic does not specify which media entities it identified, but characterizes the volume as consistent with a structured disinformation operation rather than isolated individual actors.
Chinese and Iranian users, the report says, attempted to use Claude to identify and track diaspora communities and individuals who dissent from their governments’ positions. The language Anthropic uses is careful, “suspected government-linked actors,” stopping short of attributing the surveillance attempts to specific state agencies, a limitation the company acknowledges reflects the inherent difficulty of attribution in commercial AI deployments.
What the report makes explicit is the conventional weapons finding. Three instances involved users in China, two involved Russia, and one involved Yemen, attributed to actors affiliated with Ansar Allah, the Houthi movement that has sustained strikes against energy infrastructure and commercial shipping throughout 2026. The requests spanned software for autonomous firearms, guidance systems for missiles, and design assistance for armed drones and improvised bombs.
Anthropic has stopped these conversations. What it cannot demonstrate, in a report that necessarily describes only what it caught, is the scope of what it missed.
That limitation sits at the center of a structural tension the report exposes but does not resolve: the company that built Claude is also the entity investigating Claude’s misuse, writing the threat assessments, and deciding what to publish. Other AI companies have published similar reports. None has established an independent oversight mechanism that would allow outsiders to audit those findings, assess methodology, or evaluate what the companies chose not to disclose.
For researchers and public health authorities trying to understand how AI is changing biosecurity, Thursday’s report is the clearest data point available. It is also data produced and filtered by a private US company with commercial interests in demonstrating both its safety measures and the continuing utility of its product. That combination of transparency and opacity is not unique to Anthropic. It is, at this stage, the defining condition of AI threat intelligence as a field.
Anthropic’s broader response has been to implement what it describes as stricter safeguards on dual-use biological research queries, a restriction applied to its newer models specifically. The company has faced growing pressure from researchers and civil society groups to be more specific about what those restrictions cover, concerns that sharpened after the August White House AI safety summit where frontier model companies discussed voluntary safety commitments. What “stricter” means in operational terms, which queries are blocked, which are flagged for human review, which pass through with a warning, remains proprietary.
The report does not say how many of the seven harm categories generated the most attempts. It does not say whether the Houthi-linked drone request was a test or an active development effort. It does not say what law enforcement did with the chikungunya referral. Those gaps are not necessarily evidence of concealment. They are the ordinary limits of what a company can publish about ongoing investigations and relationships with government agencies.
What Anthropic can publish, and has, is a document that will almost certainly be cited in every Congressional hearing, regulatory proceeding, and biosecurity conference where AI misuse comes up for the next twelve months. The report is, among other things, a lobbying document, and that is not a criticism. It is an acknowledgment that threat intelligence, when produced by the company facing the threat, is never entirely separable from the interests that company has in how the threat is understood.
