Anthropic says it blocked multiple accounts that used its artificial intelligence models in ways that could potentially support the development of biological weapons, highlighting the growing challenge of controlling increasingly capable AI systems.
In a threat intelligence report published Thursday, the company behind the Claude chatbot said it considered biological misuse one of the “most serious risks” posed by advanced AI models.
Anthropic said it identified about 35 “distinct research efforts” involving potentially concerning activity during a 30-day period. The company said it could not determine with certainty whether the users “intended harm” or were conducting legitimate scientific research.
The cases included possible gain-of-function research involving infectious diseases, including bird flu, as well as research into novel venoms and toxins.
Anthropic said five case studies involved users who “circumvented controls” restricting access to certain regions or “engaged in other efforts to obfuscate the purpose of their research to evade our safeguards.”
The company said the people described in the cases were “working scientists”, but it did not identify their institutions or countries.
“Sophisticated attacks no longer require sophisticated attackers,” Anthropic said in the report. “The cybersecurity skills of AI models means that AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.”
One case involved a request for help writing a grant application to fund gain-of-function research into the transmissibility and immune evasion of chikungunya virus, Anthropic said.
In another case, a researcher outside the United States used Claude in research involving bird flu, including the adaptation of viruses to mammals and the causes of severe disease, the company said.
Other cases involved research into orthopoxviruses, a group that includes the viruses responsible for smallpox and mpox, as well as venom toxins.
AI companies and drug researchers have identified biology and medicine as areas where increasingly capable models could accelerate drug discovery and scientific research. But the same capabilities could potentially be exploited to develop biological weapons, creating a dual-use problem for AI developers.
Anthropic said malicious actors could attempt to exploit legitimate biological applications of AI to “maintain a kind of ‘plausible deniability’” about potentially harmful research.
“As our models become increasingly capable, approaching or exceeding expert performance at challenging scientific tasks, we expect their impact will only increase, both in beneficial and potentially harmful contexts,” the Anthropic report said. “As AI models become more widely used, providers will continue to acquire threat-relevant visibility into real-world use that even governments and intergovernmental organizations lack.”
The company said newer models, including Claude Fable 5, have “stronger safeguards that restrict access to a wide range of dual-use biological research queries.”
Anthropic has progressively tightened and refined safeguards around its most capable models. In August, the company said an update to Fable 5’s biology safeguards reduced false-positive interventions on benign biology requests by about 85%, while retaining restrictions on dual-use professional biology and drug-development queries.
Fable 5’s underlying capabilities are based on Anthropic’s Mythos 5 model, which the company has described as capable of advanced work in biology and cybersecurity. Anthropic has said it uses automated classifiers to identify potentially harmful requests and route some of them to less capable models.
Anthropic said its report also identified attempts to use its models for surveillance, scams and the development of conventional weapons.
The company said suspected Chinese government-linked operators used Claude in surveillance targeting Uyghur minorities in Xinjiang and religious communities, including Catholic cardinals in Asia, the Presbyterian Church in Taiwan and Tibetan Buddhists.
In another case, a user believed to be linked to the Chinese military used what the person thought was Moonshot AI’s Kimi model for surveillance-related work. Anthropic said requests, including sensitive information concerning Moonshot customers, were instead routed to Claude.
Anthropic also said it had identified similar attempts by Chinese companies, including DeepSeek, to secretly divert user requests to its models.
Anthropic also said parties based in northern Yemen had used Claude to develop guidance software for missile systems. The report did not identify the groups directly.
The report says older models such as Claude Opus 4 and Claude Sonnet 4.5, released in 2025, were assessed as being well below the level needed to meaningfully assist sophisticated users with dangerous biological research.
As newer models become capable of performing more complex scientific tasks, however, Anthropic said it could no longer offer the same assurance.
It has therefore introduced “stronger safeguards that restrict access to a wide range of dual-use biological research queries,” particularly in recent models including Claude Fable 5.
The disclosures come as AI developers face growing scrutiny over whether their safety systems can keep pace with increasingly capable models.
Anthropic launched Fable 5 in June with safeguards designed to restrict potentially dangerous applications in areas including biology and cybersecurity. The company said more than 95% of Fable sessions initially involved no fallback to a less capable model.
The company has since introduced Fable 5.1, while keeping its most capable Mythos models for biology and cybersecurity research available only to vetted organizations through trusted-access programs.
The issue has also intensified debate within the AI industry over whether the companies developing frontier models can adequately monitor and control them.
In July, nearly 1,400 AI industry employees signed an open letter urging the U.S. government to regulate the technology and slow its development to address safety concerns.
Former Anthropic researcher Jacob Coxon says increasingly capable AI systems could cause “extreme havoc” and potentially be used to attack critical infrastructure or develop “extinction-level bioweapons.”
In a resignation post on X this week, Coxon said “the people building AI earnestly believe that it could kill us all by the end of the decade.”
OpenAI chief scientist Jakub Pachocki also warned this week that AI capabilities were advancing faster than researchers’ ability to reliably monitor and control them.
For now, AI companies remain largely responsible for policing the use of their models in the United States, as the Trump administration has sought to limit state-level AI regulation and Congress has yet to establish comprehensive federal rules governing the technology.
“We believe the world would benefit from the industry adopting a lawful, verifiable way to work together to pace how we release powerful models,” Anthropic said in a statement.
Stay ahead of the Stories shaping our world. Subscribe to Impact Newswire and join our
WhatsApp Channel for updates on global tech, business, and innovation—all in one place.
Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.
Got a story to share? Contact Us to reach a global audience with Impact Newswire.
Discover more from Impact AI News
Subscribe to get the latest posts sent to your email.
