Within hours of a guided-rocket test fire in northern Yemen, the same operators were back in Claude asking why it had failed.[1] That sentence, from Anthropic’s September 2026 threat-intelligence report, is the whole argument of this essay compressed into a timeline. The model was not a brochure writer. It was sitting inside a software-in-the-loop path that already touched commodity flight computers, firmware builds, and, on another front, live development boards for an FPV kamikaze swarm.[1][2]
The Claude Misuse Files, Part 6 takes Anthropic’s conventional-weapons section as gospel and asks a narrower question than “can AI design munitions?” The thesis is simpler: where Anthropic’s visibility is good enough to name the workflow, Claude was used as engineering labour on software that operators then loaded onto real hardware, not as a speculative chat about weapons theory.[1]
Six cases, one new category
Since its November 2025 report, Anthropic says it has identified a new misuse category: Claude used to develop software for conventional weapons, including firearms, missiles, armed drones, bombs and other munitions, plus the targeting and control systems that run them.[1] The September report details six disrupted cases: three in China, two in Russia, and one in Yemen.[1][2] The Register‘s coverage of the same section centres the Yemen guidance work and the Russian freelance FPV swarm as the clearest “hands on metal” stories in the set.[2]
Anthropic divides the six into two parts. Part I covers four cases where actors used Claude to develop weapons software itself: the Yemen guided-rocket cell (with a live field test); a China-based anti-torpedo fire-control specification and acquisition package; the Russia-based drone swarm Anthropic labels “DronDoc” or “Serafim,” tested in simulation with code loaded onto real boards; and a China-based electronic-warfare and air-defence suppression suite.[1] Part II covers procurement and intelligence gathering rather than firmware.[1] This essay stays with the two Part I cases that put software on, or next to, physical systems.
Yemen: GNC as a substitute software team
Anthropic tracks the Yemen activity as GTG-87001: a cell in northern Yemen running three programmes. Anthropic-only detail: a guided rocket using a commodity phone-class flight computer with final-phase homing guidance; a multi-stage ballistic missile with a stated range goal above 2,000 km; and a multi-variant missile set referred to as “R2000,” including a hypersonic glide vehicle variant.[1]
The actors used Claude Code in place of human software engineers for guidance, navigation and control (GNC) software: integrating an open-source autopilot onto a phone-class flight computer, writing control and position-estimation software, tuning control settings, running a firmware build pipeline, and performing flight simulation.[1] Anthropic says they ran several Claude instances at once with assigned roles (writing, research and review), the way a small engineering lead would split a team.[1]
Safeguards blocked many requests but not all. The operators hid goals and end products, and split work across sessions so no single thread showed the full intent.[1] Anthropic is careful on outcomes: it does not claim evidence of an operational fielded device. It does claim a guided rocket was test-fired, that the test appears to have failed, and that within hours the actors returned to Claude for failure analysis.[1][2] Anthropic-only detail: the cell had already built an offline simulation toolkit that does not depend on Claude or MATLAB-class environments, so a ban does not erase the artefact.[1]
That is the provocation. A classifier that catches some prompts still leaves a programme that can fire, fail, diagnose and continue offline.
Russia: DronDoc / Serafim on real boards
Anthropic tracks GTG-27005 as likely freelance Russia-based actors building a full-stack autonomous first-person-view (FPV) kamikaze drone swarm, named “DronDoc” or “Serafim.”[1][2] They used Claude Code to write and test code into their own project files, plus a software-in-the-loop simulation stack and a rented GPU host for model training.[1]
Anthropic’s inventory of what Claude helped build is long because the stack is long: shared swarm memory and fault-tolerant coordination logic; an onboard small language model to govern attack, observe and return-to-base behaviours; terminal guidance that uses the onboard camera and issues a detonation call; a control-link geolocation module aimed at opposing drone operators; a passive acoustic detection layer; and low-level logic for programmable chips.[1] Anthropic states the platform was designed for autonomous lethal engagement: the onboard model could select targets, including a “person” target class, and issue detonation commands without a human in the loop.[1][3]
The hardware claim is load-bearing for this essay’s thesis. Anthropic says the actors flashed low-level firmware to live development boards, provisioned single-board computers, and wired a simulation environment over a mesh network, confirming real hardware-in-the-loop testing inside the observed sessions.[1] They trained a computer-vision classifier on scraped Ukrainian combat footage, splitting “enemy” and “friendly” classes and allow-listing Russian systems.[1] Anthropic-only detail: they repeatedly used a fixed coordinate in Donetsk Oblast as the demonstration strike point, with front-line Ukrainian cities and corridors as mission geography.[1]
Anthropic assesses a small specialised freelance team doing mixed civilian and military work, not a Russian state entity. Nine associated accounts; eight used only for ordinary freelance work. Claimed ties to a regional university with a federal research centre linked to the Russian Academy of Sciences; unverified claims of funding from Russia’s Advanced Research Foundation, National Technology Initiative and Ministry of Defence.[1] Accounts were created between late 2025 and early 2026; the operation began mid-May 2026; geographic controls were bypassed via commercial VPS routing.[1] Anthropic rates the named systems roughly at Technology Readiness Levels 3-4 (validated in simulation), not as proven field munitions.[1]
The loop that left the chat window
“Software-in-the-loop” is not a metaphor here. In both cases Anthropic describes a cycle that looks like ordinary embedded engineering: requirements, code, simulation, board flash, telemetry, revise. Claude’s role, on Anthropic’s account, was to compress the software half of that loop for operators who already had hardware access and domain intent.[1] The Yemen cell’s post-test return to the model, and the Serafim team’s flashing of live boards, are the evidence that the loop left the chat window.[1][2]
Anthropic says it banned linked accounts, shared findings with partners where actors worked across platforms, and launched new classifiers aimed at high-yield explosives and weapons-development traffic.[1] That is enforcement after the fact. The public point of the disclosure is upstream: frontier coding agents are now usable as drop-in GNC and swarm-software labour when the operator already owns the airframe.
Parts 2 through 5 of this series covered cyber, influence, surveillance and fraud. Part 6 is the first harm area where Anthropic’s own narrative puts Claude’s output onto rockets and drones that exist outside the API. The remaining parts treat biology and distillation with the same rule: Anthropic supplies the case spine; outside coverage places the claim in the public record beside it.
Notes
[1] Anthropic, “Detecting and countering misuse of AI: September 2026,” published 10 September 2026, section “Detecting and countering the use of Claude in conventional weapons activity” (GTG-87001 Yemen guided weapons cell; GTG-27005 DronDoc/Serafim). https://www.anthropic.com/threat-intelligence-report-september-2026
[2] Jessica Lyons, “Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research,” The Register, 10 September 2026. https://www.theregister.com/ai-and-ml/2026/09/10/latest-anthropic-horror-story-chills-with-tales-of-kamikaze-drone-swarms-and-bioweapons-research/5295702
[3] “Anthropic details how Claude was misused for surveillance and weapons,” The Next Web, 10 September 2026 (weapons section summarising Yemen GNC work and Russian FPV swarm). https://thenextweb.com/news/anthropic-claude-misuse-threat-intelligence-report