Iran and Houthi rebels used Anthropic's Claude AI to target US warships and build hypersonic missiles — Houthi rebels also used the bot to code ballistic missile guidance systems

Iran and Houthi Rebels Used Anthropic's Claude AI to Target US Warships and Build Hypersonic Missiles

Anthropic has published a 154-page threat intelligence report documenting how state and non-state actors have used its Claude models for military reconnaissance, weapons development and mass surveillance.

The most serious findings involve Iran-linked actors and Houthi forces in Yemen. But the report also covers Chinese and Russian activity, and the disclosure is unusual less for what it reveals about adversaries than for the fact that an AI company published this level of detail about its own product being misused.

Targeting US Naval Forces

An Iran-linked threat actor used Claude to support military reconnaissance and produce targeting recommendations against US naval forces operating in the Middle East.

The method was open-source intelligence assembly rather than anything exotic. The actor combined publicly available ship and aircraft transponder identifiers with commercial satellite imagery and information on US naval movements. It also extracted the names of US military personnel from captions on publicly available military photographs, and compiled material from a cache of public websites.

The output was described as targeting handbooks for identifying and tracking US naval positions.

The actor went further into technical territory, researching potential vulnerabilities in communications equipment used aboard ships. The report names known flaws affecting Cobham Sailor VSAT terminals, Cisco communications equipment, and Schneider Electric EcoStruxure systems.

Anthropic said it banned the account, introduced additional detection mechanisms, and shared its findings with government authorities.

Missile Development in Yemen

A separate case involved a cell in northern Yemen under Houthi control, which used Claude Code to support three distinct weapons programmes.

The first was a guided rocket using a commodity phone-class flight computer to assist terminal guidance — a low-cost approach that substitutes consumer silicon for purpose-built avionics.

The second was a multistage ballistic missile targeting a range beyond 2,000 kilometres.

The third was the R2000 missile family, which the report says included a hypersonic glide vehicle variant.

The Houthis have proven among the more resilient Iranian-backed groups in the region, and recently took control of the Bab al-Mandeb waterway, a critical energy shipping lane through the Red Sea. Research conducted in Yemen can be shared with allies, and Iran's industrial capacity is available to manufacture what Yemen cannot.

Surveillance of Iranian Citizens

Not all of the Iranian activity was externally directed.

One security-linked unit used Claude to analyse 155,216 tweets in order to profile, identify and surveil 6,388 opposition individuals over a single year.

Another group used the model as an engineering pipeline for building domestic tracking tools, including a Firefox extension named al-Najm al-thāqib that reached production deployment and was designed to mass-harvest user identities across major social platforms.

Anthropic has banned 16 Claude accounts linked to Iranian paramilitary and domestic security agencies. The company has not claimed that figure represents every such account.

The Access Question

Iran is not a supported region for Anthropic's services. The report states that actors circumvented controls meant to prevent users from unsupported regions from accessing the technology.

That detail matters more than the individual cases. Geographic restrictions are among the weakest controls available — VPNs, intermediaries and resold API access route around them routinely. Any safeguard that depends on knowing where a user physically sits is not a safeguard against a state actor.

The report also presented five examples of actors using Anthropic models in ways that could support biological weapons development.

Beyond Iran

China and Russia also appear in the report as active users of Claude for military and intelligence programmes.

Chinese activity described includes surveillance of Uyghurs and of religious figures the Chinese Communist Party regards as a political threat, as well as monitoring of journalists.

Why This Was Published

There is an obvious tension in a company documenting, at length, the ways its own product has been weaponised.

The reasoning appears to be that the threat is systemic rather than specific to one vendor. Nothing in these cases required capabilities unique to Claude — open-source intelligence aggregation, code generation for guidance systems, and large-scale social media analysis are available from any frontier model. Publishing the detail gives other labs and governments a concrete picture of what the misuse actually looks like.

It also lands days after Anthropic CEO Dario Amodei published an essay calling for the industry to slow the pace of capability advancement, citing misuse for cyberattacks and bioterrorism among the risks. The threat report functions as supporting evidence for that argument.

The timing is also politically awkward. The report arrives amid an active military exchange in which Iranian missiles damaged US aircraft at Muwaffaq Salti Air Base in Jordan, following US strikes on Iranian oil tankers that Washington said were a response to IRGC ballistic missile attacks on a US Navy warship.

The Broader Point

The uncomfortable takeaway is not that a chatbot built a hypersonic missile. It did not.

What the report documents is acceleration — tasks that previously required analyst teams and engineering staff being compressed into work a smaller group can do faster. Assembling a targeting handbook from open sources is not new. Doing it at speed, continuously, with automated correlation across transponder data, satellite imagery and photo captions, is a different operational tempo.

That is the capability being transferred, and no amount of regional access control prevents it.