Anthropic Says Claude Models Can No Longer Be Assumed Below the Bioweapons Assistance Threshold

Anthropic published its September 2026 threat intelligence report, covering operations its threat intelligence team identified and disrupted between December 2025 and August 2026. The report is organized around seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and unauthorized distillation of Anthropic's own models.

Two disclosures matter most for anyone building on frontier models. Anthropic states that newer Claude versions can no longer be assumed to fall safely below the threshold for meaningful bioweapons assistance, which is a change in the company's own risk assessment rather than an external finding. Separately, the report describes a group of Russia-linked freelancers who used Claude Code to build software for an autonomous drone swarm capable of selecting human targets and issuing detonation commands without a human in the loop.

The influence-operations case is the most quantified. Anthropic says a single operation used Claude to run more than 4,700 dating-application personas that exchanged 2.36 million messages with at least 25,000 users over roughly two weeks in April 2026. On surveillance, the company says it disrupted state-aligned, contractor and commercial spyware uses across China, Iran, West Africa and surveillance-for-hire operators between January and July 2026. Independent write-ups note that the misuse involved Claude Haiku, Sonnet and Opus models, with the Fable and Mythos classes appearing only in a single distillation case.

Every claim here comes from the vendor. Anthropic controls the detection, the disclosure and the framing, and it has a commercial interest in being seen as the lab that catches misuse. There is no independent reproduction of the drone-software case, and the bioweapons statement is a policy posture, not a published capability evaluation. What is verifiable is the pattern: the report is the third in a series, and the described operations have moved from prompt-level abuse toward agentic tool use, where the model writes and operates software rather than producing text.