Claude AI wrote code for a missile group in Yemen. Will Anthropic limit its use?

What happened

Anthropic’s September threat intelligence report says a cell of actors based in northern Yemen ran three weapons programmes and used Claude Code in place of human software engineers to write the guidance, navigation and control software for a guided rocket and a multi-stage ballistic missile with a stated range goal above 2,000km; the company banned the accounts, launched new classifiers for high-yield explosives and weapons development, and shared its findings with public and private partners.

Anthropic’s report names a group that was building weapons. It says the group, based in northern Yemen, ran three programmes at once: a guided rocket that homes in on its target at the end of its flight, a ballistic missile with several stages and a stated range goal above 2,000km, and a set of related designs that includes a hypersonic glide vehicle.

The group used Claude Code in place of human software engineers, running several copies at once and giving each a role. The Financial Times identified the group as Houthi. No leading AI developer had reported before that its own product was used on a ballistic missile programme.

The Yemen case is one part of a much larger report. The 154-page report covers activity Anthropic stopped between December 2025 and August 2026 in seven areas of harm. They include six cases of conventional weapons, three in China, two in Russia and one in Yemen, as well as Russian-linked spying, Chinese surveillance work and five studies of scientists whose research could support biological weapons.

Anthropic said its safeguards blocked many of the Yemeni requests but not all. The operators hid their goals and split tasks across separate sessions. The company found no evidence of a working weapon, although an apparent test-fire failed.

What Anthropic did next is the part we can count. Besides the bans, new filters and sharing its findings, it fed what it learned into its safeguards. The misuse involved Claude Haiku, Sonnet and Opus. There was no case on the Fable or Mythos-class models, apart from one attempt at distillation, which means copying a model by training another one on its answers.

Every step Anthropic took was inside its own platform. The open question is whether a report like this has ever been followed by a change in who is allowed to use the model at all.

Sources: Anthropic, Financial Times, Guardian, Al Jazeera, BBC

The Pattern

We found seven such reports since February 2024. In each, a leading AI developer said publicly that state-linked or armed groups had used its own model for attacks or weapons work. We checked whether, within 30 days, the developer limited who may use the model: by blocking a country or region, by asking users or organisations to prove who they are, or by taking a model or feature off general release. Banning the named accounts and adding filters did not count.

The Read

History says nothing will change about who can use Claude. Seven times since February 2024 a leading developer has reported that state-linked groups used its model. Each time the answer was the same three steps: ban the accounts, improve the filters, brief the partners. Anthropic has already taken all three here, and its own report calls them the response. The market sits at 22% rather than lower because Anthropic is under more pressure in 2026 than any earlier company in the list.

The case against rests on the two times this year when access did change. Under a US order, Anthropic turned off Claude Fable 5 and Mythos 5 for foreign nationals on 13 June, and in July it moved to close gaps that gave Chinese users access to Claude. This is also the first report in the list that involves a ballistic missile rather than phishing or fraud, and it comes while Anthropic is trying to lift a Pentagon supply-chain risk label. If Washington treats the Yemen case as a failure of export controls, a change in access could follow within days.

The record has one known weakness. It measures the 30 days after a report, and in 2026 access rules have moved when the US government acted, on its own timetable. A step from Anthropic before 11 October that blocks a country, asks users to prove who they are or takes a model off general release would settle the first market.