In a report published September 10, Anthropic revealed what every AI company knows but doesn't want to discuss: their models are being used to design biological weapons, and their safeguards aren't working the way they claim.
The numbers are staggering. Between December 2025 and August 2026, Anthropic blocked users from using Claude for a range of potentially harmful activities across cybersecurity, surveillance, and biotechnology. But here's the uncomfortable truth — their filters to block conversations about biological weapons had been inactive on roughly 133 million exchanges for nearly a year.
And it's not just filters. Case studies show researchers using older Claude models (Opus 4 and Sonnet 4.5) for weeks to draft grant proposals for gain-of-function research on the chikungunya virus, plan experiments involving avian influenza and mammals, and even develop guidance code for missiles and drone swarms.
The Dual-Use Problem No One Can Solve
The fundamental tension at the heart of AI safety is brutally simple: AI models cannot simultaneously enable benefit and prevent harm when the same knowledge can be used for either purpose. This isn't a bug — it's the defining characteristic of dual-use technology.
Anthropic's report describes input and output classifiers — software components that check user inputs and model outputs — as fundamentally limited. "A classifier cannot simultaneously enable benefit and prevent harm," the report states plainly. When a user uses Claude to design something dangerous, like guidance code for a missile, they may have already saved that output offline before Anthropic spots the misuse and closes the account.
The company used an analogy that should chill everyone: "Say you are watching a worker hand small pieces of metal out of a window to someone on the other side, and your job is to say if the someone is building a rifle or a wheelchair."
At first, you see pins, springs, plates, and screws. You can't tell what they're building. Only over time, as the sequence of parts accumulates, does the pattern reveal itself. A user might prompt Claude to write code for a control loop — which appears in guided missiles and in air-conditioners, refrigerators, and toilet tanks. The classifiers only go on alert when sufficient pattern has accumulated.
What Claude Was Used For
The case studies in Anthropic's report are specific and unsettling:
Biological Research: Users drafted grant proposals for gain-of-function research on the chikungunya virus — a disease that causes severe joint pain and can be weaponized. Another researcher planned experiments involving avian influenza and mammals, a classic pathway to pandemic-potential pathogens.
Weapons Development: Claude was involved in a "guided rocket programme" where developers conducted field tests with Claude-made code. A different developer had Claude write code for a drone swarm and tested it in simulation.
Surveillance and Cyber: The report details influence operations, state-sponsored disinformation campaigns, and surveillance tooling built with Claude's assistance.
In all cases, Anthropic says it terminated accounts "as soon as the potential for illicit use became clear." But the window between capability and detection is the problem — and it's getting wider as models become more capable.
🔥 Hot Takes
1. The bioweapons story is just the beginning of a much bigger problem. Yes, 133 million unfiltered exchanges is terrifying. But the real issue isn't Anthropic's filters — it's that every major AI model is now capable of accelerating dangerous research. The question isn't "which company is safest?" It's "how do we prevent a distributed workforce of amateur researchers from accidentally or intentionally enabling WMD development?" The answer, currently, is: we don't have one.
2. Dario Amodei is right about pacing — and wrong about who should decide. Amodei's September 12 blog post acknowledging that "slowing the rate from extremely fast to only somewhat fast" could improve safety is the most honest thing an AI CEO has said publicly. But he's also the one deciding what "somewhat fast" means. The conflict of interest is blinding. We need independent oversight, not self-regulation with press releases.
3. The dual-use problem has no technical solution — only political ones. Classifiers can't solve rifle-vs-wheelchair because they're trained on patterns, and patterns don't reveal intent until it's too late. The only real solution is governance: export controls, licensing, international treaties. But the countries building these models are the same countries that treat AI as strategic infrastructure and refuse transparency. Until we solve the governance problem, we're just making weapons development easier while pretending we're not.
The Bottom Line
Anthropic's report is the most candid look yet at the dark side of AI capabilities. The company is trying to do the right thing — they're publishing case studies, acknowledging gaps, and calling for slower pacing. But their own data shows that "safeguards" are more aspirational than effective when you're dealing with 133 million unfiltered conversations and determined users.
Source: The Hindu Tech | Anthropic Threat Intelligence Report