Spotlight
- Anthropic’s 10 September 2026 report on the misuse of Claude revealed that a Houthi group used the AI in a weapons-development programme.
- The group could not create an operational weapon using Claude, but they were able to test-fire a rocket and create an offline toolkit that can be used without Claude or any other proprietary AI model.
- The failure to regulate AI at a nascent stage echoes the policy mistakes made during the rise of social media in previous decades. Ensuring safe proliferation of AI seems unlikely unless private AI companies are pressured to set up ecosystem-wide security guardrails.
On 10 September 2026, Anthropic released a report on internal investigations carried out by its ‘Threat Intelligence’ team on the misuse of its artificial intelligence (AI) model Claude. One of the case studies in the report details an investigation into a Generative Threat Group (GTG)—Anthropic’s label for threat actors who use its AI products—based in northern Yemen, which has a strong Houthi rebels’ presence. The Houthis (also known as Ansarallah), labelled as GTG-87001 in the report, used Claude to implement three weapons-development programmes: a guided rocket, a ballistic missile with a range of over 2,000 kilometres, and a multi-variant missile that included a hypersonic glide vehicle variant (see Table 1). Anthropic has no evidence that the incident led to the creation of any field operational weapon, but it stated that the group managed to test-fire a rocket.
Debates on AI safety and security have taken on a life of their own in 2026, due to a slew of cyberattacks by rogue AI agents, with calls being made to pace development and allow policy and security guardrails to keep up. The Anthropic report adds another dimension to the debate by demonstrating that apart from creating new threats, AI is also reshaping old ones.
Table 1: GTG-87001 Operational Scope Across Workstreams
| Cluster | What Claude Was Used For | Most Serious Element |
| Tactical guided rocket | Flight control firmware, terminal guidance, post-test telemetry diagnosis | A live field test in Yemen, brought back to Claude for failure analysis within hours |
| Ballistic missile simulation | Multistage, six degrees of freedom trajectory simulation | Medium- and intermediate-range and hypersonic-glide variants |
| Optimisation | Reinforcement learning tuning of flight control | Accelerated development of the guidance algorithms |
| Modelling and simulation | Calibrating simulations against reference implementations | Digital model of an operational weapons system to reduce dependency on physical testing |
| Packaging | Compiling the simulation toolkit into a standalone executable | A deliverable that runs and persists without Claude |
Source: Anthropic
Details of the Incident
How the threat actors gained access to Claude is unclear. Anthropic maintains a list of countries where its services are available, and Yemen is not on it. The report mentions cases in other regions where circumvention took place through synthetic accounts, using intermediaries in approved regions and network routing. There are no official details, however, about how GTG-87001 managed to circumvent Anthropic’s region-blocking measures.
Once the group gained access, they managed to avoid detection by not stating their goals in the prompts outright and dividing their work into separate Claude sessions—one for research, one for writing the code, and one for reviewing it. Although GTG-87001 was largely unsuccessful in weapons development, the report states that it did manage to build an “offline simulation toolkit” that can be used without Claude. The group’s activities were eventually identified and their accounts terminated and reported by Anthropic, although there is no specific information about how.
Too Late to Regulate
AI model capabilities have been growing at breakneck speed since 2023, and the case studies outlined in Anthropic’s report vividly illustrate how AI companies are now operating in a live intelligence and counterintelligence environment. Relying on AI models to identify and refuse to act on dangerous prompts—a measure that largely worked in the GTG-87001 case—is not sufficient protection. AI labs now have to work against elaborate campaigns by resourceful and persistent groups that are actively bypassing safeguards.
AI model capabilities have been growing at breakneck speed since 2023, and the case studies outlined in Anthropic’s report vividly illustrate how AI companies are now operating in a live intelligence and counterintelligence environment.
The Houthis case highlights that adversarial AI campaigns have become an industry-wide issue. For instance, while Anthropic terminated GTG-87001’s Claude accounts and reported them to the relevant authorities, the group could just migrate to another AI platform. Further, the group did not need to rely on one or two critical answers from Anthropic’s frontier-class models; smaller, benign-looking prompts to sub-frontier models worked as well. Even if access to proprietary American AI models is denied, threat actors can access increasingly capable open-weight models that are now widely available. If weapons development happens with the aid of open-weight fine-tuned models on private servers and infrastructure, the visibility into such projects would be negligible.
Two days after Anthropic’s report was published, CEO Dario Amodei released an essay calling to slow down frontier AI development. OpenAI CEO Sam Altman and SpaceX CEO Elon Musk publicly echoed the call shortly after. Whether or not their pleas are heard, AI risks have already crossed a threshold. It seems unlikely that any national or international regulatory effort can put the AI genie back in the bottle without governments integrating private-sector frontier AI laboratories into their national security architectures.
Learnings from the Social Media Era
The use of technology by bad actors, criminals, and terrorists is not new. This intersection has gained attention over the past decade due to the rapid rise in popularity of digital technologies, from messaging apps and streaming to 3D printing and drones. However, conceptually, technology has always been attractive to bad actors as a means of inflicting damage. Moreover, damage without publicity is counterproductive for such entities.
The Islamic State’s (ISIS or Daesh in Arabic) rise in the early 2010s was one of the most significant events in the post-9/11 era of extremism. The group not only took over vast swathes of territory at a rapid pace, but also utilised online platforms such as Facebook, Twitter (now X), Telegram and others to recruit members and distribute well-curated and produced propaganda to a global audience. In the initial stages of the group’s ascent on the periphery of the Syrian civil war, livestreams by its members—many of whom were young Western nationals well versed with these technologies—were broadcast unabated. The platform owners were taken by surprise, as they did not have the expertise or the capacity to understand or address such use. Smaller outlets, especially those only in the business of encrypted messaging, such as Kik and SureSpot, had bigger crisis points, including a lack of human capital to deploy on security issues. This led to a challenge on how to control the use of online spaces. In response, tech companies, research groups, and civil society organisations created ecosystems such as the Global Internet Forum to Counter Terrorism to gather under one roof and find solutions.
These ecosystems also brought to the fore other stark and fundamental realities, such as the fact that ‘social media’ was already an archaic term, and the technologies and outlets that had started out as such were now tech behemoths influencing every facet of life, from security to democracy and electoral politics, both domestic and beyond borders. Propaganda and its dissemination became an even harder problem to fix. Arbitrary de-platforming of accounts, based, for example, on “hash sharing,” and promoting extremist content, came with a separate set of challenges as far as business indicators went. Allowing law enforcement greater oversight was seen as a problematic bridging of space between the state and business, one that often expanded into a transnational diplomatic issue over criminality, terrorism, and violent extremism.
Futureproofing Challenges
Policy, by design, is ill-equipped and therefore unable to keep up with technology. This gap was never plugged during the height of the social media security debate. The debate around guardrails for AI is of a similar nature, just multiplied by a factor of thousands.
AI’s disruptive power is multimodal. The Houthi incident was not the first time when this issue was highlighted. Terror groups in Africa used AI to learn certain tactics a couple of years ago. “We saw in a movie how motorcycles can jump over bridges. We used AI to learn how to do this,” a former Boko Haram commander explained.
Policy, by design, is ill-equipped and therefore unable to keep up with technology. This gap was never plugged during the height of the social media security debate. The debate around guardrails for AI is of a similar nature, just multiplied by a factor of thousands.
Ensuring the safe proliferation of AI, a technology that keeps evolving in a matter of weeks and months, requires the swift emergence of a global consensus on interoperable security protocols, transparency standards, institutional readiness, and willingness to share intelligence among cybersecurity entities across jurisdictions in real time. That is unlikely to happen soon. Given the economic turmoil caused by supply-chain attacks and regional volatility amidst the US–Israel–Iran conflict, however, AI companies can be pressured to forego their free-market instincts and cooperate with each other to implement not just company-wide but ecosystem-wide guardrails. Creation of threat intelligence units in all major AI labs and mandating industry-wide sharing of threat assessments and intelligence amongst such units may be a viable step forward.
The social media era has provided a multitude of examples on what worked and what didn’t in the gap between technology, society, and polities. Whether the political and social momentum needed to address emerging risks rises, or whether mistakes of that era are repeated, remains to be seen.
Kabir Taneja is Executive Director, ORF Middle East
Siddharth Yadav is Fellow, Technology, ORF Middle East
Leave a Reply