An Iran-linked actor used Anthropic’s Claude artificial intelligence model earlier this year to collect and analyze publicly available data for targeting recommendations against U.S. naval forces in the Middle East, while a group in Houthi-held northern Yemen used the same model to assist with guidance systems for ballistic and hypersonic missiles, according to a threat intelligence report Anthropic released on Sept. 10, 2026.
The 154-page report, which Anthropic describes as its most detailed to date, covers the period between December 2025 and August 2026 and documents misuse of Claude across intelligence gathering, surveillance, cyberattacks, influence operations and biological research. Anthropic said actors behind the activity were based in Iran, Yemen, Russia, China and other countries.
Targeting U.S. naval forces
In a case study designated GTG-30005, Anthropic said it identified and disrupted an Iran-nexus threat actor that used Claude to compile targeting handbooks through a Python pipeline built with the model’s assistance. The compiled material included a roster of U.S. personnel scraped from captions on public military photographs, publicly accessible ship and aircraft transponder identifiers, commercial satellite-imagery query scripts, and an inventory of public websites that exposed U.S. naval movements.
The same actor directed Claude to compile vulnerability research on shipboard systems, cataloging known CVEs in maritime VSAT terminals, Cisco communications equipment and industrial control products. Anthropic said the account was separately tied to domestic mass surveillance software development work for Iranian state systems. The company banned the account, developed detections to reduce future misuse, and shared threat intelligence with government authorities.
Whether the collected data was used in actual attacks on U.S. forces is unknown, according to The War Zone. Recent media reports have described Iran increasingly attempting to strike American warships, raising questions about how Tehran tracks maritime targets far from its shores.
Yemen-based weapons development
In a separate case designated GTG-87001, Anthropic said it identified a cell of threat actors based in northern Yemen running three weapons development programs: a guided rocket using a commodity phone-class flight computer with final-phase homing guidance; a multi-stage ballistic missile with a stated range goal above 2,000 km; and a multi-variant missile referred to as the “R2000” set that included a hypersonic glide vehicle variant.
The actors used Claude Code in place of human software engineers to develop guidance, navigation and control software. They used the model to integrate an open-source autopilot onto a phone-class flight computer, write control and position estimation software, tune control settings, run a firmware build pipeline and perform flight simulations. The actors managed several Claude instances at once, assigning one to write code, another to research, and a third to review the first instance’s output.
Anthropic did not explicitly name the Houthis in the report, but the group in northern Yemen is very likely Iranian-backed Houthi militants, according to The War Zone. The Associated Press reported that northern Yemen is territory controlled by the Iran-backed Houthi rebels.
The report highlights how quickly AI tools are spreading into conflict zones, including among non-state actors with limited engineering capacity. Anthropic said it banned the accounts involved and shared findings with government authorities, but the cases show that commercially available AI models are now being used to compress weapons development timelines and lower the technical barriers for groups seeking advanced military capabilities.
Sources: The War Zone · Military.com · Navy Times