Anthropic blocked Claude use in risky biological research and cyberattacks

A research request triggered an investigation

One request blocked in May 2026 looked like a grant proposal. Inside it was a plan to alter chikungunya virus in ways connected to transmission and immune evasion. Anthropic's biological safety classifier stopped the request, and its threat team began investigating who was behind it.

According to the threat intelligence report published on September 10, the request passed through an intermediary service that supplied models to life sciences researchers in a region where Claude was not officially available. Anthropic linked the work to a military research institute, banned accounts and shared information with authorities and other companies. Within days, the report says, the intermediary returned under fresh identities and routed refused requests to more permissive models.

Five biological cases

The report presents five cases. In another, a researcher spent weeks planning experiments concerning mammalian adaptation of avian influenza. Thousands of messages covered study design, data analysis and experimental priorities. Anthropic says its safeguards confined the work to weaker models and judges that the assistance was largely clerical and limited research support.

A third case involved a relay serving more than a dozen customers. A powerful Claude model produced an end to end grant application for orthopoxvirus research in about an hour. The final two cases concerned toxin maps and computational design of molecules that could support drug discovery or harmful compounds.

That overlap is the operational problem. The same question about a protein or a virus can serve a vaccine, a treatment or a weapon. A filter looking for dangerous words does not always see the full programme.

What the company can see

Anthropic does not name the researchers, countries or institutions. It also says it is not asserting that the scientists intended harm. The core evidence is therefore the company's account of activity it observed inside its service, not an independent inspection of the laboratories and not proof that a biological weapon was produced.

The company holds data the public cannot examine: sequences of requests, account records, access patterns and links between users and intermediaries. That vantage point can reveal activity that would never appear in a normal academic paper. It also leaves readers dependent on the company's choices about what to disclose and what to withhold. The Associated Press reported the findings and the disruptions, but did not provide independent identification of the redacted users.

The model is no longer merely answering

Biology is only one section of the report. In the cyber cases, Anthropic describes a shift from a chatbot answering questions to systems managing a chain of actions. Agents searched for targets, tested weaknesses, processed stolen information and modified attack tools after security products detected them. People still selected targets and reviewed results, but much of the work ran in parallel at machine speed.

The clearest picture is malware being detected. An operator once had to return to the code and alter it. The report describes a workflow in which an agent notices the block, rebuilds the tool and tries again. The interval between detection and adaptation shrinks while a human defender has to follow several paths moving at once.

Anthropic says the activity covered in the report occurred from December 2025 through August 2026. It banned accounts, updated detection systems and shared intelligence with partners and authorities where appropriate.

Blocking one account did not end the work

The report does not describe a model acting on an independent desire. It describes people building workflows around models, sometimes hiding identities, bypassing regional restrictions or moving between providers. The picture is less cinematic and more practical: a person chooses an objective, several agents divide the work, and the output returns for review.

The detail to watch is what happens after a block. In the first biological case, the intermediary was operating again within days. If one provider refuses a request and it simply moves to another model, the safeguard remains local while the activity crosses companies. The next test is whether providers and authorities can recognize the same path again before work moves from a proposal into a laboratory, or from code into a live system.