Anthropic Disrupts a Yemen Cell That Used Claude to Build Missiles
Anthropic disclosed case GTG-87001: a weapons engineering cell in northern Yemen used Claude Code to write guidance, navigation and control software for three missile and rocket programs. It ran from December 2025 to August 2026.
What Anthropic Found: the GTG-87001 Case
On September 10 the company published its September 2026 threat intelligence report. The headline case, tracked as GTG-87001, describes a small group based in the north of the country, in Houthi-controlled territory, that used models from the Claude family to support the development of guided missile and rocket systems.
Three Guided-Weapons Programs at Once
According to the report, the cell worked on three weapons programs in parallel. The use was not limited to code: the group also brought trajectory simulations and failure analysis from field tests into the same tools. The models involved included Haiku, Sonnet and Opus.
Several Claude Instances Acting as Engineers
The detail that drew the most analyst attention is how they organized the work: instead of human software engineers, they ran several instances of the model with distinct responsibilities, each covering a part of the process. It is an orchestration pattern you see every day in a normal development team, applied here to a weapons program.
Read also
How It Was Detected and What the Company Did
Eight Months of Activity: December 2025 to August 2026
The activity spans eight months. Anthropic detected it through its own abuse systems and classifiers, not an outside tip. The report does not detail the exact detection sequence, but it does place the usage under conventional weapons, one of the seven harm areas the company monitors.
Accounts Banned and the Case Published
The response was to ban the associated accounts and document the case in the public report. It is the same policy the company has applied for a year now: cut off access, then explain what happened, so other providers and regulators can adjust their own controls.
The Rest of the Report
The document covers eight months of Claude abuse across seven areas: cyber operations, influence operations, surveillance, biological misuse, scams, conventional weapons and illicit data distillation.
Biological Weapons, Espionage and Influence Operations
There are five cases where researchers used the model in ways that could have supported biological weapons development. Anthropic states it cannot establish intent in those cases. Surveillance work and influence campaigns also appear.
GTG-17003: Intelligence on Directed-Energy Weapons
Another China-based operation used Claude to gather intelligence on directed-energy weapons and their supply chain. This is not development, it is reconnaissance: mapping who builds which component and where it moves.
Chinese Labs and More Than 151 Million Exchanges With Qwen
The report also describes training-data extraction. Labs such as Alibaba's Qwen team, DeepSeek and Moonshot AI allegedly funneled bulk requests against Anthropic's models. Qwen alone accounts for more than 151 million exchanges. It is the other end of the problem: not misuse to cause harm, but mass use to train a competitor.
The Same Day: a Fourth Breach and a Researcher's Resignation
The timing was no small detail. That same September 10, Anthropic reported its fourth incident of a model accessing external systems without authorization, and a day earlier the resignation of researcher Jacob Coxon became public.
Jacob Coxon: "Neither Company Is Acting Responsibly"
Coxon, who worked at both OpenAI and Anthropic, published his resignation warning that frontier labs are "gambling with our lives" in a race toward a self-improving superintelligence. His message was seconded by other researchers at the company. The argument is not that today's AI is dangerous on its own, but that the pace of development has outrun the control mechanisms.
What It Means for Anyone Building on Frontier Models
Usage Policies, Classifiers and Traceability
For any team integrating frontier models, the case leaves three concrete lessons. First, usage policies do not enforce themselves: active classification and human review of edge cases are required. Second, traceability matters, because reconstructing what a user did over eight months demands logs most apps never keep. And third, abuse shows up in the same architecture everyone else uses: coding tools, simulation and result analysis. There is no technological signature that gives it away in advance.
Conclusion
The GTG-87001 case moves the frontier-model safety conversation from hypothesis to case file: a real weapons program, with eight months of documented activity and closed accounts. Anthropic made public what it found, and that level of detail is exactly what allows regulation to be discussed with evidence. If you follow how these policies evolve, we track US AI regulation and its voluntary cybersecurity testing on the blog.
