Anthropic dropped a report on Thursday, September 10, 2026, that reads less like a corporate transparency document and more like a counter-espionage briefing. Buried in the findings: a Russia-based group used Claude, Anthropic’s flagship AI model, to write targeting and coordination software for a swarm of first-person-view kamikaze drones, according to Reuters. The drones were reportedly designed to select their own targets, including a “person” target class, and detonate without a human confirming the strike. Defense One framed the story bluntly: Russia is weaponizing US-built AI to make killer drones, cyberattack bots, and fake news.
The disclosure lands at a strange moment for the AI industry. Every major US lab has spent 2026 racing to sell enterprise contracts, government pilots, and API access at scale, while insisting their models are guarded against misuse by state-linked hackers. Anthropic’s own report undercuts part of that pitch: despite geographic restrictions on Russia, China, and Iran, a web of fraudulent accounts and intermediary resellers let banned users reach Claude anyway, according to Politico’s account of the same report. This is not a hypothetical about future AI risk. It is a documented account of AI systems already being used to design weapons software, and it is forcing a hard conversation about how export controls and usage restrictions actually work once a model ships as an API.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Anthropic actually found in its September 2026 threat report
Anthropic’s report describes a group it tracks as GTG-27005, which it characterizes as a small, likely freelance team of Russian developers rather than a formal state intelligence unit. According to the AFP summary of the Anthropic misuse disclosure, the team used Claude to build software intended to power autonomous kamikaze drones capable of picking their own targets and crashing into them without a human making the final call. Reuters reported that the same actors used Claude to develop terminal guidance, target selection, and multi-aircraft coordination logic for a swarm of FPV attack drones, a level of technical sophistication that would ordinarily require a defense contractor’s engineering team. That kind of freelance software help arrives as Russia’s own domestic drone industry is scaling up in parallel: the Institute for the Study of War reported that Russian developers moved the Tyuvik target-homing drone into serial production in May 2025, part of a broader push to industrialize target-seeking munitions that GTG-27005’s Claude-assisted code appears to echo.
Separately, Anthropic said it disrupted a suspected Russia-linked cyber espionage campaign aimed at Ukraine, with a particular focus on military drone technology providers and their supply chains. Defense One and Ground News both cited the report’s language describing “a common theme of the targeting was Ukraine and military drone technology providers and supply chains.” The campaign reportedly used Claude to automate portions of the hacking workflow rather than replace human operators entirely, a pattern security researchers have flagged repeatedly this year as AI-assisted intrusion becomes cheaper to run at scale.
The same Anthropic report also detailed a cell of threat actors based in Northern Yemen that used Claude across three separate weapons-development programs: a guided rocket, a multi-stage ballistic missile, and a hypersonic glide missile, according to Politico. Business Insider’s coverage of the report added that Russian and Chinese threat actors also used Claude as what it called a “weapons engineering assistant,” helping develop drone software and anti-torpedo weapons systems. None of this activity involved a single, centralized state operation. Instead, the picture Anthropic paints is of scattered technical actors, some state-linked and some apparently freelance, independently discovering that a general-purpose AI model could shortcut months of specialized engineering work.
The ChatGPT disinformation angle: International Burke Institute
Anthropic’s report was not the first this month to describe Russian misuse of a major US AI model. Roughly two weeks earlier, OpenAI disclosed that Russian-linked actors had used ChatGPT to build a fake think tank called the International Burke Institute, a fabricated “expert community” designed to push Kremlin-aligned talking points to international audiences under the guise of independent analysis, according to Defense One’s account of the OpenAI disclosure. The tactic is a modern update on an old influence-operations playbook: instead of paying a handful of writers to churn out op-eds, an AI model can draft an entire institutional front, complete with plausible-sounding bios and a steady output of “research,” in a fraction of the time.
Anthropic’s own report described a related pattern with Claude. Defense One quoted the report directly: “We’ve seen groups of actors use Claude to build networks of fake social media profiles and entire news sites.” Taken together, the OpenAI and Anthropic disclosures describe the same broad strategy executed on two different platforms: use a frontier chatbot to mass-produce disinformation infrastructure that would once have required a dedicated staff of propagandists.
How attackers got around export and usage restrictions
Both Anthropic and OpenAI restrict direct access to their most capable models from Russia, China, Iran, and other sanctioned jurisdictions. In theory, that should have stopped state-linked actors before they got near the API. In practice, Politico reported that much of the illicit access was facilitated by intermediaries: resellers and account brokers who help customers in restricted countries circumvent geographic blocks and safety filters on US AI models. Politico’s reporting describes the range of buyers as unusually broad, including criminal hacking gangs, Chinese security bureaus, Russia-linked spies, and Yemen-based arms manufacturers, all reportedly reaching Claude through the same kind of fraudulent-account infrastructure that has long been used to route around sanctions on cloud computing and software licenses.
This is the uncomfortable part of the story for the AI industry: geo-blocking and know-your-customer checks were the primary technical defense against exactly this scenario, and reports now describe them as porous. Unlike physical export controls on semiconductors, which require moving crates of hardware across a real border, an AI model’s defenses live entirely in software, in a login form, a payment processor, and a usage-monitoring pipeline. Anthropic’s report frames its response as a detection-and-shutdown model rather than a prevention model: it says it identified and cut off the accounts involved in these operations after the fact, rather than blocking them beforehand.
Why this differs from earlier AI misuse stories
AI misuse disclosures are not new. Over the past two years, US labs have periodically published reports describing state-linked actors using chatbots for translation, code debugging, phishing-email drafting, and open-source reconnaissance. What sets the September 2026 disclosures apart is the jump from language-and-research assistance to physical weapons engineering. Writing targeting logic for an autonomous drone swarm, or drafting design parameters for a hypersonic glide vehicle, is a categorically different use case than asking a chatbot to translate a phishing email into fluent English.
Anthropic’s report also disclosed that it stopped attempts by users to get Claude to assist with dangerous-pathogen research, in cases it said numbered five this year and that carried potential bioweapons implications, according to Politico’s summary. That detail, combined with the drone-targeting and ballistic-missile findings, moves the conversation about AI safety away from abstract long-term risk scenarios and into a set of concrete, dated, named incidents that happened in 2026 to companies whose products millions of ordinary developers use every day for coding assistance and customer support.
Market and industry impact
For Anthropic and OpenAI, the immediate business risk is reputational rather than financial. Both companies chose to publish these findings themselves, a move that reads as an attempt to control the narrative before investigative journalists or a congressional committee did it for them. That strategy has a cost: every enterprise sales conversation Anthropic has for the rest of 2026 will now include a question about how a defense contractor, a bank, or a hospital system can be confident that safeguards which failed to stop a freelance Russian drone developer will stop a more sophisticated internal threat.
There is also a policy dimension. Politico’s reporting notes that the Trump administration has not moved to impose new binding requirements on frontier AI companies despite repeated warnings from the companies themselves and from outside policy researchers. That leaves the current safeguard regime almost entirely voluntary and self-policed. Congress has held hearings on AI safety throughout 2026, but no comprehensive federal statute governing frontier model export controls or usage monitoring has passed. Defense-focused lawmakers on both sides of the aisle have cited exactly this kind of disclosure as evidence that voluntary self-reporting is not a substitute for enforceable rules, though no specific legislation has advanced far enough to warrant a name-check here.
For the broader defense-tech sector, the disclosure adds urgency to a trend already underway: militaries and defense contractors racing to build AI-specific safeguards into weapons platforms before adversaries build AI-assisted ones first. Ukraine, which has spent more than three years developing FPV drone programs to offset Russia’s material advantages, now faces a mirror-image problem, with reports describing Russian-linked actors using the very same category of consumer AI tool against Ukrainian drone suppliers and officials. The stakes of that mismatch keep climbing: the Institute for the Study of War reported in June 2025 that Russia had set a production target of roughly 2 million tactical drones a year, and the BBC reported that Ukraine logged around 350 Russian jet-drone attacks in June 2026, a monthly rate that had climbed to roughly 2,800 by August 2026.
Competitive comparison: how the major AI labs are responding
Anthropic and OpenAI are not the only companies exposed to this problem, but they are the only two that have gone public with specifics in September 2026. The table below compares what each company has disclosed and how their public posture differs.
| Company | Disclosed misuse (Sept 2026) | Actors named | Public response |
|---|---|---|---|
| Anthropic (Claude) | Drone-targeting software, cyber espionage against Ukraine, weapons-program assistance, fake social media/news networks, flagged bioweapons-research attempts | GTG-27005 (Russia), Northern Yemen cell, unnamed Chinese security bureaus | Published a detailed threat-intelligence report; says it detected and banned the accounts involved |
| OpenAI (ChatGPT) | Fake think tank (“International Burke Institute”) used for disinformation targeting international audiences | Unnamed Russian-linked actors | Disclosed the fake-institute operation roughly two weeks before Anthropic’s report, per Defense One |
| Google (Gemini) | No comparable September 2026 disclosure identified in current reporting | Not applicable | No public statement tied to this specific news cycle |
| Meta (Llama) | No comparable September 2026 disclosure identified in current reporting | Not applicable | No public statement tied to this specific news cycle |
The gap in the table is notable on its own. Open-weight models like Llama are, in principle, harder for any one company to monitor for misuse because they can be downloaded and run entirely offline, outside any centralized API log. That means the absence of a Meta disclosure in this news cycle does not indicate the absence of misuse, only the absence of the kind of centralized telemetry that let Anthropic and OpenAI detect it in the first place.
Historical context: from chatbot jailbreaks to weapons engineering
The trajectory of AI misuse reporting has moved fast. In 2023 and 2024, most public misuse disclosures involved relatively low-stakes cases: jailbreak prompts used to generate spam, basic phishing templates, or crude malware snippets that a competent junior developer could have written anyway. By 2025, disclosures started describing more coordinated state-linked campaigns using chatbots for reconnaissance and influence-operation content at scale. The September 2026 reports mark the first time two separate frontier labs have gone public in the same month describing AI-assisted contributions to physical weapons systems, including autonomous target selection for lethal drones and design support for a hypersonic glide vehicle.
That progression tracks closely with the broader trajectory of the war in Ukraine, where FPV drone warfare has become the defining feature of the front line since 2023. Ukraine and Russia have both invested heavily in low-cost, AI-assisted drone targeting to offset artillery shortages and manned-aircraft losses, and the scale of that buildup has become starker in the past year: the Institute for the Study of War reported that Russia’s annual output of long-range drones roughly doubled to about 30,000 by June 2025, while Ukraine’s military intelligence agency, the GUR, put Russian production at more than 5,000 long-range drones a month that same period, including an estimated 2,700 Geran-2 attack drones a month, per Forbes Ukraine, and roughly 2,500 Gerbera decoys a month. What Anthropic’s report adds to that picture is evidence that at least one part of that arms race, on the Russian side, has been quietly outsourced to a commercial US chatbot rather than built entirely from in-house engineering.
What the experts and companies are saying
Anthropic’s own report language, as quoted by outlets covering the disclosure, is unusually direct about what its safeguards did and did not catch. According to AFP’s summary of the report, Anthropic described the Russian drone case in stark terms: “a small team of likely freelance developers in Russia used Claude to build software intended to power autonomous ‘kamikaze’ drones.” AFP’s account also detailed the mechanics of the payload logic Anthropic says it found: “the drone swarm was programmed to pick its own targets and crash into them to detonate, without a human making the final call.”
Reuters’ independent reporting on the same disclosure corroborated the technical description, noting that “Anthropic said likely freelance Russia-based actors used Claude to develop software for an autonomous swarm of first-person-view attack drones, including terminal guidance, target selection and coordination between multiple aircraft,” in a report published September 11, 2026. Politico’s coverage added detail on the geographically separate Yemen case, reporting that “Anthropic said it stopped ‘a cell of threat actors based in Northern Yemen’ who had been using Claude in a trio of weapons development programs, including a guided rocket, a multi-stage ballistic missile and a hypersonic glide missile,” in its September 10, 2026 report.
Business Insider’s summary of the broader findings framed the scope of the misuse plainly, reporting that “Anthropic found Russian and Chinese threat actors using its artificial intelligence chatbot Claude as a weapons engineering assistant, helping develop drone software, anti-torpedo weapons systems, and more,” in its coverage published in September 2026. None of the three outlets identified a named individual spokesperson quoted directly; all three attributed their reporting to Anthropic’s written threat-intelligence report itself.
Key numbers from the disclosure
The table below pulls together the specific, sourced figures from the reporting on Anthropic’s September 2026 threat report. Where an outlet did not provide an exact figure, that is noted rather than estimated.
| Metric | Figure | Source |
|---|---|---|
| Timeframe of documented misuse patterns | Last eight months (per Anthropic’s report) | Politico |
| Bioweapons-adjacent pathogen research cases flagged | 5 cases this year | Politico |
| Weapons-development programs tied to Yemen-based cell | 3 (guided rocket, multi-stage ballistic missile, hypersonic glide missile) | Politico |
| Russia-linked group building drone-targeting software | Tracked by Anthropic as GTG-27005 | Defense One, Reuters |
| Time between OpenAI’s ChatGPT disinformation disclosure and Anthropic’s report | Approximately 2 weeks | Defense One |
| Anthropic report publication date | September 10-11, 2026 | Reuters, Politico, Defense One |
The Ukraine angle: drone supply chains as a specific target
The most operationally significant detail in the disclosure may be the narrowest one: the reported focus on Ukraine’s military drone technology providers and supply chains as a specific espionage target. Defense One and Ground News both cited Anthropic’s report language identifying this as “a common theme of the targeting.” That detail suggests the campaign was not a generic intelligence-gathering exercise but a targeted effort to map, and potentially disrupt, the vendor network that keeps Ukrainian drone units supplied with parts, software, and replacement hardware. The industrial base on the other side of that fight has grown accordingly: ISW reported that Russia had funneled roughly 243 billion rubles, about $3 billion, into 407 aircraft companies by June 2025. Given that FPV drones have become one of the cheapest and most effective weapons systems in the war, a successful espionage campaign against that supply chain would carry outsized tactical value relative to its cost.
It also illustrates why AI-assisted cyber operations are attractive to under-resourced actors. A freelance developer or small team does not need a state intelligence agency’s budget to run reconnaissance against a supply chain when a commercial chatbot can automate large parts of that workflow, from drafting phishing lures to organizing scraped data on suppliers and personnel.
Predictions: what happens next
- More labs will publish misuse reports. Now that Anthropic and OpenAI have both gone public in the same month, expect Google and Meta to face pressure to disclose comparable findings about Gemini and Llama, even if none surface in the immediate aftermath of this news cycle.
- Congressional hearings will reference these disclosures by name. Given that Politico’s reporting already frames this as a test of the current administration’s hands-off approach to frontier-model regulation, expect lawmakers pushing for binding AI export and monitoring rules to cite the GTG-27005 case directly in the next hearing cycle.
- Account verification will get stricter, and messier. Expect Anthropic and OpenAI to tighten know-your-customer checks for accounts originating near sanctioned regions, which will likely create friction and false positives for legitimate users in bordering or diaspora communities.
- Open-weight models will face renewed scrutiny. Because models like Llama can run offline without centralized logging, expect policymakers to ask pointed questions about whether open-weight releases make this kind of misuse harder to detect, even if no comparable Meta-specific incident has been disclosed yet.
- Defense-sector AI monitoring contracts will grow. Expect increased interest from defense and intelligence agencies in tools that can detect AI-assisted weapons engineering activity across commercial cloud infrastructure, building on the same detection methodology Anthropic says it used internally.
What this means for enterprise AI customers
For the vast majority of Claude and ChatGPT customers, none of this changes daily usage. Coding assistants, customer support bots, and document summarization tools are unaffected by an unrelated account-fraud problem on the other side of the world. But enterprise security teams evaluating AI vendors now have a concrete case study to bring into vendor-risk conversations. The relevant question is no longer whether a frontier lab has an acceptable-use policy on paper; it is how quickly that lab detects and shuts down abuse once fraudulent accounts get past its onboarding checks, and how transparently it reports what it found.
That transparency point cuts both ways. Anthropic deserves credit for publishing detailed findings rather than quietly banning the accounts and staying silent, a choice that invites short-term reputational risk in exchange for what the company frames as an accountability precedent. Whether OpenAI, Google, and Meta follow that precedent with their own model-specific disclosures will likely shape how the industry, and regulators, evaluate AI safety claims for the rest of 2026.
Frequently asked questions
What exactly did Anthropic disclose about Russia and Claude?
Anthropic’s September 10, 2026 threat-intelligence report describes a group it tracks as GTG-27005, made up of likely freelance Russian developers, using Claude to write targeting, guidance, and coordination software for a swarm of first-person-view kamikaze drones, according to reporting from Reuters, AFP, and Defense One.
Did Anthropic say Russia’s government was directly responsible?
No. Anthropic’s report describes GTG-27005 as a small, likely freelance team rather than confirming direct state control, according to Reuters and AFP’s coverage of the report.
Was OpenAI’s ChatGPT also implicated?
Yes, separately. Defense One reported that roughly two weeks before Anthropic’s disclosure, OpenAI revealed that Russian-linked actors used ChatGPT to build a fake think tank called the International Burke Institute for disinformation targeting international audiences.
What other weapons programs were mentioned in the report?
Politico reported that Anthropic’s disclosure also described a Northern Yemen-based cell using Claude across three weapons-development programs: a guided rocket, a multi-stage ballistic missile, and a hypersonic glide missile.
How did restricted users access Claude if Russia is geo-blocked?
Politico reported that much of the illicit access was facilitated by intermediaries who help customers in restricted countries circumvent geographic blocks and safety filters using fraudulent accounts.
Did this campaign target Ukraine specifically?
Yes. Defense One and Ground News both cited Anthropic’s report describing a suspected Russia-linked cyber espionage campaign with a common focus on Ukraine’s military drone technology providers and supply chains, including reported access to Ukrainian officials’ WhatsApp accounts.
Is Meta’s Llama or Google’s Gemini implicated in this specific case?
Current reporting on this September 2026 disclosure does not identify a comparable Gemini or Llama misuse case. Open-weight models like Llama are harder to monitor centrally since they can run offline, which may explain the absence of a comparable disclosure rather than the absence of misuse.
What is Anthropic doing in response?
Anthropic says it identified and banned the accounts and infrastructure involved once discovered, and published a detailed threat-intelligence report describing the specific misuse cases, according to Reuters and Politico.
