Anthropic said Thursday it has blocked efforts by bad actors to use its artificial intelligence models for malicious activity such as cyberattacks, surveillance, and research that could have led to biological weapons.
As AI models grow more powerful, elaborate cyberattacks no longer require sophisticated skills and even lone individuals can create threats that would not have been possible even a year ago, Anthropic said. The company said it has added stronger safeguards in its latest models to restrict biological research that could also be used to make weapons.
“The cases we share here aren’t typical misuse, but rather examples of the most notable and novel threat activity we’ve identified to date,” Anthropic said in its third report since March 2025 describing AI misuse. The report includes snippets of the malicious code and AI prompts Anthropic said it found, and urges governments and AI competitors to identify and prevent similar abuse.
“We’re publishing this work because we believe we have a responsibility to disclose malicious misuse of our services. As models become increasingly capable, their risks will increase, unless AI developers and society’s defenders act to make them safer,” the company said.
The lengthy report by the AI startup, which is planning an initial public offering this fall, was published two days after one of its researchers announced he's resigning over concerns that Anthropic and its competitors are not acting responsibly in AI development. He echoed concerns raised inside and outside of the industry about the technology’s potential to elude human control.
Between December 2025 and August 2026, researchers at Anthropic found misuse by actors ranging from spyware vendors and “politically motivated individuals” to state-sponsored groups spreading propaganda.
Among the findings in the company's report are unnamed actors attempting to use its models for research that could have led to biological weapons. In one instance, Anthropic said its systems blocked a request for Claude’s assistance in authoring a grant application for scientific funding.
“The work discussed in the application involved gain-of-function research (that is, research that genetically alters an organism to create a new or enhanced biological property) on the chikungunya virus. This gain of function research was aimed at the virus’ transmissibility and immune evasion properties,” the report said.
Chikungunya is a mosquito-borne virus that causes debilitating symptoms such as severe pain and fever. The request involved a grant proposal for research seeking to enhance mutations to make the virus progressively more harmful. While such research could “certainly” be used to develop better vaccines and treatments, Anthropic said, “it could also be used to make the pathogen more dangerous.”
None of the cases Anthropic included in its report were found to be using its newer, more powerful Claude Fable or Mythos-class models, with the exception of one illicit distillation case that Anthropic described as “an industrial-scale, covert campaign to extract a model’s capabilities and replicate them in another model without authorization.”
Anthropic said its older models, such as Claude Opus 4 and Claude Sonnet 4.5, from 2025, “were well below the threshold where they could meaningfully assist a sophisticated user in carrying out dangerous biological research.”
“As a result, safeguards on these models were less stringent, directed mostly at preventing access to content that might uplift novices in recreating known bioweapons,” the report said. “But for today’s models — which are capable of assisting in a range of complex scientific research tasks — the evidence is no longer certain, and we cannot make that same assurance.”
Because of this, Anthropic has applied “stronger safeguards that restrict access to a wide range of dual-use biological research queries” in its more recent models, such as Claude Fable 5, the report said.
As companies introduce increasingly powerful AI models, experts have called on governments to regulate the technology, rather than relying on the industry to police itself.
John Thickstun, an assistant professor of computer science at Cornell University, said it is an uncomfortable position for companies like Anthropic and OpenAI to be in when they are expected to determine what is safe vs. unsafe behavior and make "value judgments at societal scale without any kind of democratic or deliberative oversight.”
Anthropic also found groups that created hundreds of social media accounts that look like they belong to ordinary people and then posted material amplifying the same political view over the course of a week. The company outlined nine such cases it found, originating in Russia, Iran, Turkey and across the Persian Gulf, South Asia, Africa and Europe.
While social media companies can detect influence operations on their platforms once posts are circulating, “we may see it on Claude while the operation is still being built.”
Anthropic released this report after one of its researchers, Jacob Coxon, announced he's resigning amid fears the company and its chief rival OpenAI “are racing straight to self-improving superintelligence and gambling with our lives.” Coxon's post warned that some of his colleagues now believe AI could threaten human life by the end of the decade.
But Anthropic said it has blocked each of the malicious activities it identified, used the experience to strengthen safeguards and shared information with government authorities and industry partners.
“We hope that the findings in this report will help other developers recognize similar patterns on their own platforms, give governments and civil society a clearer view of how emerging threats take shape, and strengthen collective defenses,” Anthropic said.
FILE - Pages from the Anthropic website and the company's logos are displayed on a computer screen in New York, Feb. 26, 2026. (AP Photo/Patrick Sison, File)
