Anthropic says it disrupted bioweapons research attempts

On September 10, 2026, Anthropic published its most detailed threat intelligence report to date, disclosing that it had detected users trying to enlist its Claude models in research that could lead to biological weapons, alongside other misuse involving cyberattacks, influence operations, surveillance and weapons-system development. The company said it disrupted every operation described in the report before it could cause real-world harm.

Five documented cases, from avian flu to toxin peptides

The report documents five separate cases in which Claude models were used in activity tied to sensitive biological research. In one, a researcher spent weeks planning "gain-of-function" experiments aimed at adapting avian influenza to mammals with Claude's help. In another, a user built a comprehensive atlas of toxin peptides, then a generative system to optimize molecules targeting paralytic and analgesic toxins with greater precision.

In a third case, Anthropic's own biological-safety classifier flagged a request to use Claude for gain-of-function research on chikungunya virus, including proposed modifications meant to increase the virus's transmissibility and its ability to evade immune responses. Anthropic's threat-intelligence team said the request raised additional concern because the proposed project was linked to a military research institute, according to the Arabic-language outlet aitnews, which first reported the detail.

The misuse cases Anthropic documented were not limited to biology: the report also recorded attempts to exploit its models for other purposes, including surveillance, writing exploit code for security vulnerabilities, producing propaganda, and assisting in the development of conventional weapons systems, according to Anthropic's own report.

Jacob Klein, Anthropic's head of threat intelligence, said catching this kind of malicious activity is not straightforward, noting that real-world cases are often far more ambiguous than someone openly stating an intent to build a bioweapon, according to aitnews.

Why Anthropic won't name the researchers involved

Anthropic acknowledges in the report that catching this kind of misuse is not straightforward: some requests tied to dangerous research look, on the surface, like legitimate science such as vaccine development or infectious-disease study. For that reason, according to Spanish daily ABC, the company said it erred on the side of caution, acting whenever it could not clearly establish the intent behind a request, given the severity of potential consequences. As the report puts it: "While evaluations are useful because they provide evidence of capability, they cannot conclusively demonstrate that this capability would actually be used to develop biological weapons in the real world."

The company declined to name the researchers or institutions tied to the five cases, saying the people involved are scientists formally engaged in research work, that it cannot confirm any intent to cause harm, and that naming them could expose them to harm without conclusive proof of malicious intent. Anthropic instead suspended the relevant accounts and fed its investigation findings into its safety systems to improve future detection and prevention.

Anthropic's report itself describes biological misuse as one of the most serious risks posed by frontier AI models, warning that they could reach a level of capability that lets them increase the danger of existing pathogens or even create entirely new ones — and that without adequate safeguards, such capabilities could have catastrophic consequences, according to ABC's account of the report.

We're publishing our most detailed threat intelligence report to date. It covers how people tried to misuse Claude — for cyberattacks, influence operations, surveillance, biology, and building weapons — and how we found and stopped them. We disrupted every operation in the report.

What it changes for companies betting big on AI

The report lands as governments and companies worldwide race to deploy increasingly autonomous AI agents for coding, research and customer-facing work. The cases Anthropic documented show that the biological risks of frontier models are no longer hypothetical: they are real, observed incidents that a leading lab caught and acted on — which makes model safety a shared concern for anyone deploying or hosting advanced AI, not an issue confined to a handful of US labs.

Regulatory responses remain uneven. The European Union's AI Act already imposes risk-assessment obligations on the most capable models, while other jurisdictions are still building out comparable rules for how frontier systems should be tested before deployment, and how dual-use biological or chemical research requests should be screened. For any organization giving AI agents the ability to browse the web, write code or query scientific databases, this report is a reminder that the safeguards a lab builds for itself are not a substitute for independently verifying how a vendor's model handles these exact scenarios.