Anthropic: Houthi-linked cell used Claude Code to build guided missile software

What the report describes

Anthropic's September threat report documents a small group in northern Yemen that used Claude Code, the company's command-line coding agent, to perform work that would normally require a missile engineering team, according to Clash Report. Anthropic assessed the cell as highly likely to be linked to the Houthis.

The group's projects included guidance software for a tactical guided rocket, for a ballistic missile with a range above 2,000 kilometers, and for a hypersonic glide vehicle concept designated "R2000".

Parallel sessions, divided labor

Rather than relying on a single conversation, the operators ran several Claude instances at the same time and split the work between them — one session writing code, another handling research, a third reviewing the output. Clash Report notes that this workflow allowed a handful of people to reproduce functions normally distributed across specialist engineering teams.

The technical scope went well beyond basic scripts. The group worked to integrate open-source autopilot software with a phone-class flight computer and used Claude to write navigation and control code. They also built six-degree-of-freedom trajectory simulations, which model how an object both moves and rotates through space, and applied reinforcement learning to tune flight-control algorithms. Finally, they compiled the project into a standalone executable that could run offline, meaning development could continue without further access to Claude.

A test launch and rapid failure analysis

The activity did not stop at software. According to the material documented by Anthropic, the group test-fired a guided rocket in Yemen in what appears to have been a failed test. Within hours, the operators returned to Claude and began analyzing launch telemetry to work out what went wrong.

That sequence — development, physical testing, rapid post-test analysis — shows the model being folded into an iterative weapons-engineering cycle rather than being consulted for isolated technical questions.

Anthropic said it found no evidence that the group succeeded in fielding an operational weapon. But by the time the accounts were disrupted, the operators had already assembled an offline engineering toolkit that no longer depended on access to the model.

Safeguards and evasion

Anthropic's safeguards blocked numerous requests over the course of the project. The operators adapted by obscuring the intended end use of individual tasks, dividing the work across separate conversations, and using other methods to get around the restrictions. Anthropic subsequently banned accounts linked to the activity.

The case points at a structural weakness in AI safety systems: when a large engineering effort is deliberately fragmented across sessions, each individual request can look disconnected from weapons development even though the combined output is anything but.

One of six conventional-weapons cases

The Yemen operation was one of six conventional-weapons cases in the report. Three were linked to China, two to Russia and one to Yemen, and together they covered attempts involving missiles, armed drones, firearms and bombs.

The wider report describes operations Anthropic said it disrupted between December 2025 and August 2026, spanning cyber operations, influence activity, surveillance, biological misuse, scams and fraud, and illicit model distillation. Anthropic also flagged biological research cases where it could not establish whether the scientists involved were conducting legitimate research or pursuing weapons-related objectives. Jacob Klein, Anthropic's head of threat intelligence, said these situations were highly nuanced — researchers rarely announce destructive intent outright, which makes legitimate science hard to distinguish from misuse.

Why it matters

This is one of the clearest documented examples of generative AI being applied directly to conventional weapons development rather than to research or information gathering. A small non-state group used a commercially available coding agent to compress work that once required a specialist team — guidance software, flight simulation, control tuning — into a workflow a few people could run.

Two aspects stand out. First, fragmenting a project across parallel sessions blunts per-request safety reviews, since individual prompts can appear benign in isolation. Second, disruption came too late to undo the capability transfer: the group left with an offline, self-contained toolkit. For AI providers, the case argues for evaluating usage patterns across accounts and sessions, not just single prompts — and for assuming that once generated, weapon-relevant code does not disappear when the account does.