Anthropic Says Yemen-Based Actors Used Claude Code for Weapons Programs

Anthropic published a threat report on Oct. 14, 2026, detailing how Yemen-based actors used its Claude Code tool across three weapons programs. The disclosure covers activity between December 2025 and August 2026. This is Anthropic’s own account of misuse it detected and stopped.

The programs included a guided rocket and a multistage ballistic missile with a range exceeding 2,000 kilometers. Anthropic did not provide technical details about the weapons or the exact nature of the code involved. It framed the report as part of its ongoing threat-intelligence practice.

The actors reportedly evaded Anthropic’s safety controls. They did this by obscuring their goals and splitting tasks across multiple sessions. That approach made it harder for the company’s monitoring systems to flag the activity as suspicious. Anthropic said it banned the accounts involved.

Anthropic also shared threat intelligence with partners. It did not specify which partners or what information was shared. The company did not confirm a direct link to the Houthis, the armed group that controls large parts of Yemen. It only said the actors were based in Yemen.

This is not a typical lab safety announcement. Many AI companies publish generic statements about responsible use. Anthropic’s report is different because it names a specific tool, a specific region, and a specific time window. It also describes how the misuse happened.

What Claude Code Is

Claude Code is Anthropic’s coding assistant. It helps developers write, review, and debug code. It is an agentic tool, meaning it can take multiple steps to complete a task. Users give it natural language instructions, and it produces code or edits existing files.

The tool is designed for legitimate software development. But like any powerful tool, it can be misused. Anthropic has built safety controls into the system. Those controls are meant to block requests that could help with weapons development, biological threats, or other dangerous activities.

The Yemen-based actors found a way around those controls. They did not ask Claude Code to build a missile outright. Instead, they broke the work into smaller pieces. Each piece, on its own, might not trigger a safety flag. Across sessions, the pieces added up to something more dangerous.

How the Evasion Worked

Anthropic said the actors obscured their goals. That means they reportedly used vague or indirect language, asking for code that could be used for guidance systems or other components without stating what the code was for.

Splitting tasks across sessions is another evasion technique. A user might ask for one function in one session, then a different function in another session. The system sees each session as separate. It does not automatically connect the dots.

This is a known challenge for AI safety. Models are good at following instructions. They are less good at inferring the broader purpose of a series of requests. Anthropic’s report suggests it is working on this problem, but it is not solved.

The company did not say how many accounts were involved or how many sessions were used. It did not say whether the weapons were actually built or tested.

What Anthropic Did

Anthropic banned the accounts involved. That cuts off access to the tool for those users. It does not undo any work they already did.

The company also shared threat intelligence with partners. This is a standard practice in the security community. Sharing indicators of compromise and techniques helps other organizations defend against similar threats.

Anthropic did not say whether it contacted law enforcement or government agencies. It did not say whether the activity is ongoing. It did not say whether other AI companies were affected.

The report is part of Anthropic’s broader effort to be transparent about real-world misuse. Few AI labs publish specific incident reports like this one. That transparency is useful for the industry, even if it is uncomfortable for the company.

Context on Yemen

Anthropic did not confirm a direct link to the Houthis. That is an important distinction. The report only says the actors were based in Yemen.

The range of the ballistic missile is notable. A range exceeding 2,000 kilometers would reportedly put regional capitals within reach. But the report does not say whether the missile was tested or deployed. It only says the actors worked on it.

Why This Matters

This report is a concrete example of AI misuse in a weapons context. It is not hypothetical. Anthropic detected it and stopped it. That is the good news.

The bad news is that the evasion worked. The actors found a way around the safety controls. That means the controls are not perfect. They can be bypassed by determined users who understand how the system works.

The report also highlights the limits of AI safety. You can build guardrails into a system, but you cannot build guardrails into human intent. A user who wants to do harm will find ways to do it. The best you can do is make it harder.

Anthropic’s decision to publish this report is a step in the right direction. It gives the security community real data to work with. It also sets a precedent for other AI companies. If they see misuse, they should report it too.

What Happens Next

Anthropic did not say what it plans to do differently. It did not say whether it has updated Claude Code’s safety controls. It did not say whether it has added new monitoring for the evasion techniques described in the report.

For now, the key takeaway is simple. AI tools can be misused for weapons development. Companies are aware of this and are taking steps to stop it. But the race between safety and misuse is ongoing. This report is one data point in that race.

It is not a reason to panic. It is not a reason to dismiss AI safety concerns either. It is a reason to pay attention. The technology is powerful. The people who want to misuse it are creative. The people who build it need to be just as creative in defending against that misuse.