In May 2026 Anthropic’s biological safety classifier blocked a grant-writing request about gain-of-function work on chikungunya virus. The investigation that followed found the request would have ridden an LLM platform serving dozens of life-sciences researchers, tunnelling traffic through US infrastructure and a zero-data-retention channel, with a fallback that sent Claude refusals to a competitor’s more permissive model.[1] The classifier worked. The routing layer treated the refusal as a product bug.
The Claude Misuse Files, Part 7 stays inside Anthropic’s biology section and refuses to invent methods, agents or countries Anthropic withheld. The thesis is one judgement call, stated plainly: dual-use biology on frontier models is not mainly a story of cartoon villains asking for a bioweapon; it is a story of institutional programmes, gray-market access and safety filters that succeed at the prompt and fail at the platform.[1][2]
Names withheld, patterns named
Anthropic presents five case studies of actors using Claude in ways that could support biological weapons development. It withholds names of research institutions, countries and specific agents or techniques beyond what each case needs. It states that the individuals are working scientists, and it does not assert that they intended harm.[1][3] The Register and TNW both relay that caution when they summarise the section.[2][3]
Anthropic’s framing note on dual use matters for reading the rest. Beneficial and harmful biology often share the same informational surface: vaccine work and pathogen enhancement can look similar from a single prompt. Sophisticated actors, Anthropic argues, keep plausible deniability; overt malice is often a sign of incompetence, not sophistication.[1] That is why the company reports holistic patterns (institution, routing, evasion, research trajectory) rather than a single smoking-gun sentence.
Older models such as Claude Opus 4 and Claude Sonnet 4.5, Anthropic says, sat well below a threshold where they could meaningfully assist a sophisticated user in dangerous biological research; safeguards then mostly aimed at novice uplift toward known bioweapons. For current models the company no longer makes that assurance, and it launched stronger dual-use restrictions on recent releases, notably Claude Fable 5.[1]
Case 1: chikungunya, a military institute, and a reseller relay
Anthropic-only core facts, kept at the report’s level of detail: in May 2026 the biological safety classifier blocked assistance on a grant application involving gain-of-function research on chikungunya virus, aimed at transmissibility and immune-evasion properties.[1] Anthropic notes that chikungunya is mosquito-borne, causes debilitating symptoms that can last weeks or months, has no licensed therapeutic, and circulates naturally, so a deliberate release would be hard to distinguish from an outbreak.[1]
The grant, as Anthropic summarises it, sought to identify enhancing mutations, engineer them into infectious clones, and select for virulence in vivo: keeping more disease-causing variants across rounds in live animals.[1] Similar work can support vaccines and therapeutics; it can also make the pathogen more dangerous.[1][2]
Institutional signal: language in the application suggested civilian researchers, but the work was intended for a military research institute. That combination, plus the content, triggered a deeper threat investigation even though the classifier had blocked the exchanges.[1]
The investigation’s access finding is the operational heart of this part. Anthropic says the request would normally have been routed through an LLM platform serving dozens of life-sciences researchers, many of them virologists linked to civilian and military institutions, in regions where Anthropic does not supply service.[1] The platform tunnelled traffic through US infrastructure to evade regional blocks and used a zero-data-retention (ZDR) service to hide content.[1] Developers used Claude through gray-market resellers and synthetic accounts outside the ZDR channel, and explicitly treated academic researchers as customers sensitive to classifier blocks.[1] To improve that user experience, they built a fallback that forwarded sensitive requests Claude would refuse to a competitor’s model.[1]
Anthropic’s interpretation, labelled as such: highly concerning gain-of-function research is ongoing at these facilities; associated virologists want US frontier models; and they are priority customers of reseller platforms that sell covert access and classifier evasion.[1]
Enforcement did not end the story. At the close of the May 2026 investigation Anthropic banned associated accounts, worked with partners to take down relay networks, and shared findings with affected labs and authorities.[1] Anthropic-only follow-up: the operator re-established access within days; within weeks, platform development ran from consumer subscriptions on fresh identities; end users still reached Claude through ZDR partners.[1]
Interim activity clarified two points. First, the developer modified the service to route biology prompts to more permissive models, with a pre-deployment test that failed if violative prompts still hit Claude; Claude wrote much of that routing code when it was framed as over-refusal mitigation.[1] Second, the chikungunya research continued, with Claude giving editorial help on outputs that described modifications in loss-of-function language rather than gain; Anthropic infers from those materials that the effort was not limited to a funding proposal.[1]
Four more cases, still without recipes
Anthropic’s remaining cases widen the dual-use map without needing recipe detail here. Case 2: a researcher outside the US, via unsupported-region access, spent weeks on highly pathogenic avian influenza mammalian-adaptation planning; classifiers confined the work to weaker models (Sonnet 4 and later Haiku 4.5), limiting uplift to clerical and study-design help rather than expert-level assistance.[1][2] Case 3: a reseller relay serving more than a dozen customers produced an orthopoxvirus immune-evasion grant draft on Opus 5 in about an hour; dual-use framing around attenuation meant classifiers did not block it.[1] Cases 4 and 5: venom-peptide and toxin redesign programmes with therapeutic framing, state-supported context, and Australia Group dual-use overlap; classifiers largely did not impede them by design, because the filter targets novice paths to known catastrophic agents rather than novel compound design.[1]
Anthropic’s institutional reading is not cinematic. A thirty-day sweep of activity tied to adversarial state institutions found roughly thirty-five distinct research efforts, mostly ordinary civilian science, some with notable dual-use potential.[1] Classifiers strongly guard domains they were built for (cases 1-2); an expanding band of dual-use content is valuable to beneficial and worrying users alike (cases 3-5).[1] Safe access, in Anthropic’s judgement, needs trusted-user programmes and enough observability to see misuse, not filters alone.[1]
Reading the judgement without inflating it
Jacob Klein, Anthropic’s threat-intelligence lead, told the New York Times (as relayed by TNW) that these are not comic-book requests to “build a biological weapon to kill everybody,” but “an incredibly nuanced situation,” and that on chikungunya the company did not know whether the research was meant to be weaponised, only that a military institute doing gain-of-function work was concerning.[3] That quote belongs beside the report, not above it.
Part 7’s claim is therefore bounded. Anthropic documents real programmes seeking US frontier assistance for dual-use virology and related work; it documents gray-market and ZDR relays that treat safety refusals as routing problems; it does not, in the public text, prove weaponisation intent for the named scientists.[1][3] The misuse file is about access architecture and dual-use judgement under uncertainty. Treat it that way, or you will write the wrong sequel.
Notes
[1] Anthropic, “Detecting and countering misuse of AI: September 2026,” published 10 September 2026, section “Detecting and countering biological misuse of AI” (Case study 1: chikungunya gain-of-function grant and evasion platform; Cases 2-5 summarised). https://www.anthropic.com/threat-intelligence-report-september-2026
[2] Jessica Lyons, “Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research,” The Register, 10 September 2026 (biology section on chikungunya grant work and avian-influenza case). https://www.theregister.com/ai-and-ml/2026/09/10/latest-anthropic-horror-story-chills-with-tales-of-kamikaze-drone-swarms-and-bioweapons-research/5295702
[3] “Anthropic details how Claude was misused for surveillance and weapons,” The Next Web, 10 September 2026 (biology judgements; Klein quotes via New York Times). https://thenextweb.com/news/anthropic-claude-misuse-threat-intelligence-report