Anthropic’s latest threat-intelligence report makes for uncomfortable reading.

Published on 10 September, the report details real-world attempts to misuse Claude across cyber operations, surveillance, conventional weapons, biological research, fraud and model distillation.

The significance isn’t simply that people are trying to misuse frontier AI. We already knew that would happen.

It’s how far some of them got.

Anthropic identified a cell in northern Yemen using Claude Code “in place of human software engineers” while developing guidance, navigation and control software for guided weapons. The group ran multiple Claude instances simultaneously, effectively treating them like a small engineering team. Anthropic says the group conducted a live test of a guided rocket, although it found no evidence that an operational weapon was successfully fielded.

Elsewhere, a Russia-based group used Claude while developing software for an autonomous FPV kamikaze-drone swarm. Anthropic assessed the group as a small specialist freelance team rather than a Russian state entity, although the actors claimed links to Russian defence funding that Anthropic says it could not independently verify.

Then there is cyber.

Anthropic describes actors using Claude not simply as a coding assistant, but as an orchestration layer for offensive operations. One China-linked operation targeted roughly 50 organisations across sectors including energy, healthcare, finance, technology and government, while maintaining vulnerability-research and intelligence-collection capabilities that could continue operating while their human operators were away.

Biological misuse adds another dimension. Anthropic says its investigation uncovered attempts to access frontier models in connection with highly concerning dual-use biological research, including through intermediaries designed to circumvent geographic restrictions and model safeguards. Reuters separately reported that the cases involved research concerning pathogens including chikungunya and avian influenza.

This is bigger than Claude.

The important part of the report is arguably not that Anthropic’s safeguards were tested or occasionally circumvented.

It is that Anthropic published what happened.

Frontier model providers increasingly sit in a position that looks less like traditional software and more like critical infrastructure. They can observe emerging misuse patterns, investigate coordinated activity, disable accounts, strengthen safeguards and share intelligence with governments and industry.

Anthropic says every operation documented in the report was disrupted, with associated accounts banned and intelligence shared with relevant partners where appropriate. It has also introduced additional detection mechanisms, including classifiers targeting weapons development.

That creates a new question for enterprise AI procurement.

Not just: How capable is your model?

But: What happens when somebody misuses it?

Organisations assessing AI providers increasingly need to understand monitoring, incident detection, escalation, disclosure, access controls and how quickly safeguards evolve when new threats emerge.

Responsible AI cannot only describe how a model behaves when everybody follows the rules.

It also has to describe what happens when they don’t.

And Anthropic may just have moved the benchmark.