Anthropic Reveals Attempts to Use Claude to Create Bioweapons and Distillation by Chinese Companies

Anthropic claims that he has dismantled several operations, which he links to cybercriminals, who tried to use his artificial intelligence Claude to carry out malicious activitiessuch as illicit distillation and creation of biological weapons.

The technology company reveals in its September threat report, which includes actions carried out between December 2025 and August 2026, “examples of the most notable and innovative threats” they have identified to date.

The report includes a section dedicated to biological misusethat is, the attempt by malicious actors to use their models to develop or perfect biological weapons, something that Anthropic prohibits in its conditions of use.

This misuse sought take advantage of scientific research capabilities of Claude, in what Anthropic has cited as “the double use of biology”: legitimate scientific advances that can be diverted to create more dangerous pathogens.

While earlier models (such as Claude Opus 4 and Claude Sonnet 4.5) have capabilities that fall short of “significantly assisting an advanced user in carrying out dangerous biological research,” the situation changes when talking about the most recent and advanced models, such as Claude Fable and Mythos, justifying the implementation of additional security measures that “restrict access to a wide range of dual-use biological research queries.”

The company includes five use cases of actors who used their models as support for the development of biological weapons, although it assures that “there was no direct creation of executed biological weapons.”

The use cases collected in the period analyzed include blocking a request for help from Claude in writing a grant application for funding research related to experiments for increase the transmissibility or virulence of the Chikungunya virus (transmitted by mosquitoes).

In another, queries and research itineraries were identified aimed at analyzing how bird flu variants (H5N1) could be biologically adapted to spread efficiently among mammals.

Malicious actors also attempted to use Anthropic’s model to modify structures of known toxinsseeking to increase its stability, resistance to treatments or cell penetration capacity.

They also detected queries aimed at identifying DNA/RNA synthesis suppliers and biological synthesizers with lax detection mechanisms or vulnerabilities in their order verification protocols.

A final case refers to requests for assistance to optimize communication protocols. cultivation, isolation and handling of dangerous pathogens without having the appropriate credentials or institutional context.

Once these cases were detected, Anthropic immediately suspended the accounts involved as well as the API keys. And it says it implemented stricter classifiers and filters in its most advanced models, to restrict access to a much broader spectrum of dual-use biological research queries.

ILLICIT DISTILLATION

The report also highlights illicit distillation attempts by rival companies, That is, a normally accepted practice that allows the responses of an advanced AI model to be used to train, adjust or replicate the learning applied in it in another.

“Illicit distillation allows unauthorized laboratories to illicitly extract and imitate capabilities of cutting-edge models, in a fraction of the time, computational power and cost of developing them independently,” the company denounces.

In this sense, the report includes cases related to artificial intelligence laboratories in China, and directly cites DeepSeek, Xiaomi, Moonshot and Alibaba. Actors linked to the latter have carried out “the largest distillation attack” ever seen by Anthropic.

As he explains, the distillation campaign targeted Claude Opus 4.6 and 4.7 thought chain reasoning transcripts to train Qwen models and introduce new capabilities into Qwen 3.5, 3.6, and 3.7.

He assures that they observed, between May and July 2026, more than 151 million transactionsand even daily peaks that approached 3 million transactions, launched from more than 3,500 fraudulent accounts.