Anthropic详述 Claude 如何被滥用于监控和武器开发

Anthropic 发布了迄今最详细的 Claude 滥用情况说明，列举了人们试图如何利用其模型实施危害。该公司表示，已发现并关闭这些行动。相关活动涵盖网络攻击、国家监控、影响力行动、常规武器研发及生物研究。

该公司在 9 月 10 日发布的一份威胁情报报告中列出了这些案例。报告涵盖其威胁情报团队在 2025 年 12 月至 2026 年 8 月间阻断的活动。

报告覆盖七类危害领域，分别是网络行动、影响力行动、监控、常规武器开发、生物滥用、诈骗与欺诈，以及非法蒸馏。Anthropic 表示，相关滥用涉及其 Claude Haiku、Sonnet 和 Opus 模型。

该公司补充称，除一起蒸馏案例外，没有任何案例涉及其 Fable 或 Mythos 级模型。Anthropic 表示，在每一起事件中，它都封禁了相关账号并加强了安全护栏；在适当情况下，还与有关部门及行业合作伙伴共享了情报。

攻击更便宜，而非出现新攻击

报告篇幅最大的部分聚焦网络行动。其核心观点是，AI 缩小了资源充足的国家级黑客与单独行动者之间的能力差距。Anthropic 指出，一名使用被盗 API 密钥的黑客活动人士、出于经济动机的个人，以及一名从事国家间谍活动的操作者，都曾开展针对多个受害者的行动。

该公司称，一年前，这类工作还需要由多名熟练人员组成的团队完成。公司报告称，有入侵行动可在两到三小时内完成，单名操作者还能并行处理数十名受害者。

Anthropic 追踪为 GTG-20006 的一起案件中，一名俄语操作者针对乌克兰及欧洲政府目标开展间谍活动，外交和国防机构也在其目标之列。

该公司根据关于 Midnight Blizzard 组织的公开报道对该行动进行了归因。Anthropic 表示，该行为者利用 AI 检查安全产品是否已标记其恶意软件，随后自动重构恶意软件以绕过检测。

Anthropic 将另一起行动追溯至两名来自中国湖南、被描述为本科生的人员。该公司称，他们针对约 50 家组织运行所谓的 Agent 群体（agent swarms）。其中包括一家东南亚政府机构，行为者从该机构获取了公民记录。

由单名顾问建成的监控系统

Anthropic 表示，2026 年 1 月至 7 月期间，国家关联行为者和商业间谍软件供应商使用 Claude 构建监控系统。这些案例横跨中国、伊朗和西非。该公司认为，其中一个案例最为突出：一名订阅者将 Claude 当作工程团队，用于开发名为 Lakana 360 的平台。

Anthropic 评估认为，这名订阅者是一名常驻马里巴马科、与马里国家情报机构合作的顾问。

该系统监控了该国三家移动运营商旗下约 2500 万张 SIM 卡。Anthropic 表示，该系统绕过了一项法律要求：运营商在披露某些记录前必须取得法院命令。该系统还在本地部署环境中运行本地模型，因此封禁相关账号并未影响已部署的系统。

其他监控案例包括伊朗行为者部署恶意 Firefox 扩展程序，从社交网络收集用户身份信息。Anthropic 还描述了中国的一个宗教事务情报部门。该公司称，该部门已从由多个分析师团队组成的组织缩减为一个办公室，而该办公室如今借助 AI 助手每月可产出数千份调查报告。

在另一起中国案例中，Anthropic 表示，Claude 被用于根据政治敏感度为社交媒体帖子评分，并标记被运营者视为需要“管控”的人员。该报告延续了 TNW 此前对 AI 出现在警方搜索工具中的报道。

Anthropic 威胁情报负责人 Jacob Klein 对 Axios 表示，AI 正使国家监控变得更便宜、更高效。但他称，AI 并未改变政府的目标对象。

“他们实际上是在将情报机构内部工作的一部分自动化，”他说。他补充称，这种模式已不再只是理论上的可能。“威权国家如今正在利用 AI 开展监控、镇压和影响力行动，”他对 Axios 表示。

一个新类别：武器

报告记录了 Anthropic 所称的一种新型滥用形式，即利用 Claude 为常规武器编写软件。报告详述了六起案例，其中三起在中国、两起在俄罗斯、一起在也门。

在也门案例中，该公司表示，该国北部的一个组织运行了三个武器项目，包括一枚制导火箭、一种目标射程超过 2000 公里的多级弹道导弹，以及一组包含高超音速滑翔飞行器在内的导弹变体。

Anthropic 表示，这些行为者以 Claude Code 替代软件工程师，开发制导与控制代码。该公司补充称，他们曾试射一枚制导火箭，但这次测试似乎失败了。

俄罗斯案例则包括为自主自杀式无人机集群项目工作的自由职业行为者。

生物学，以及判断难题

Anthropic 表示，报告列出了五起人们以可能支持生物武器开发的方式使用其模型的案例。该公司强调，对此类情况作出判断非常困难。

该公司未披露所涉机构、国家和具体生物制剂的名称。它表示，相关人员都是在职科学家，且并未断言他们意图造成伤害。

该公司称，在一项发生于 5 月的案例中，有人请求协助撰写一份资助申请，涉及对基孔肯雅病毒开展功能获得研究。这项工作原计划在一家军事研究机构进行。

“你看到的并不是漫画书中那种人说，‘嘿，我想造一件生物武器杀死所有人，’”Klein 对《纽约时报》表示，“这是一种极其微妙的情况。”

关于基孔肯雅病毒案例，他告诉该报，Anthropic 并不清楚该研究是否意在被武器化，但军事机构开展功能获得研究令人担忧。Anthropic 表示，Claude Opus 4 等旧模型的能力远低于能够为这类工作提供有意义协助的水平。

该公司称，已推出安全护栏更强的新近模型。这一转变呼应了此前的一份报告：Anthropic 曾在测试期间关闭其生物武器分类器。与此同时，蒸馏问题可追溯至白宫有关Moonshot 蒸馏 Anthropic Fable的说法。

中国蒸馏案例

报告还进一步阐述了非法蒸馏。Anthropic 将其定义为秘密提取模型能力，以训练竞争对手的模型。

该公司表示，已发现来自七家中国实验室的行动，所有行动都瞄准其公开可用模型，而非 Mythos。它点名 Moonshot AI，称该公司悄然将客户请求转发给 Claude，并将回复显示为仿佛来自其自有 Kimi 模型。

Anthropic 表示，在一个为期十天的时间段内，Moonshot 通过由 5380 个欺诈账号组成的网络转发了近 30 万个请求。该公司将 5 月至 7 月期间超过 2300 万次交互归因于 Moonshot。该公司还对 DeepSeek、智谱、Xiaomi、SenseTime 和 MiniMax 提出了类似指控。

该公司称，一些被转发的查询暴露了敏感用户数据，其中一起案例涉及与俄罗斯国防机构相关的有效凭据。

这些蒸馏调查结果与美国情报机构发布的、点名六家中国企业的警告，以及北京对这些说法的否认同时出现。Anthropic 表示，其发现的大多数影响力行动在被其阻断前几乎没有或完全没有获得真实互动。其他平台也提出过相同的限定。

Anthropic 表示，发布这份报告是出于披露滥用情况的义务，并希望让政府和公民社会更清晰地了解这类威胁如何形成。

Anthropic has published its most detailed account of Claude misuse, laying out how people tried to use its models for harm. The company said it detected and shut down these operations. They ran across cyberattacks, state surveillance, influence campaigns, conventional weapons work and biological research.

It set out the cases in a threat intelligence report released on 10 September. The report covers activity its Threat Intelligence team disrupted between December 2025 and August 2026.

The report spans seven harm areas. They are cyber operations, influence operations, surveillance, conventional weapons development, biological misuse, scams and fraud, and illicit distillation. Anthropic said the misuse involved its Claude Haiku, Sonnet and Opus models.

None of the cases involved its Fable or Mythos-class models, it added, with the exception of one distillation case. In each instance the company said it banned the accounts and strengthened its safeguards. It also shared intelligence with authorities and industry partners where appropriate.

Cheaper attacks, not new ones

The largest section covers cyber operations. Its central claim is that AI has narrowed the gap between well-resourced state hackers and lone operators. Anthropic pointed to a hacktivist using stolen API keys, financially motivated individuals, and a state espionage operator. Each ran multi-victim campaigns.

A year earlier, it said, that work would have required teams of skilled people. The company reported breaches completed in two to three hours, with dozens of victims handled in parallel by single operators.

One case, which Anthropic tracks as GTG-20006, involved a Russian-speaking operator running espionage against Ukrainian and European government targets. Diplomatic and defence organisations were among the targets too.

The company attributed it in line with public reporting on the group known as Midnight Blizzard. It said the actor used AI to check whether security products had flagged their malware, then automatically rebuilt it to slip past detection.

Anthropic traced a separate operation to two people it described as undergraduate students in Hunan, China. It said they ran what it called agent swarms against roughly fifty organisations. Those included a Southeast Asian government agency, from which the actor retrieved citizen records.

Surveillance built by a single consultant

Anthropic said state-aligned actors and commercial spyware vendors used Claude to build surveillance systems between January and July. The cases spanned China, Iran and West Africa. It presented one as the most striking. A single subscriber used Claude as the engineering workforce for a platform named Lakana 360.

The company assessed the subscriber to be a Bamako-based consultant working with Mali’s state intelligence service.

The system monitored roughly 25 million SIM cards across all three of the country’s mobile operators. Anthropic said it bypassed a legal requirement for a court order before an operator could disclose certain records. It also ran on local models on-premises, so banning the account did not affect the deployed system.

Other surveillance cases named Iranian actors deploying a malicious Firefox extension that harvested users’ identities from social networks. Anthropic also described a religious affairs intelligence unit in China. It said the unit had shrunk from many teams of analysts to a single office. That office now produces thousands of investigations a month with an AI assistant.

In another Chinese case, the company said Claude scored social media posts by political sensitivity and flagged people for what the operators termed control. The report follows earlier TNW coverage of AI turning up in police search tools.

Jacob Klein, who leads threat intelligence at Anthropic, told Axios that AI was making state surveillance cheaper and more efficient. It was not changing who governments target, he said.

“They’re effectively automating parts of the job within the intel apparatus,” he said. He added that the pattern was no longer theoretical. “Authoritarian states are using AI for surveillance, repression and influence operations today,” he told Axios.

A new category: weapons

The report documents what Anthropic described as a new form of misuse. That is the use of Claude to write software for conventional weapons. It detailed six cases, three in China, two in Russia and one in Yemen.

In the Yemen case, the company said a cell in the north of the country ran three weapons programmes. They included a guided rocket, a multi-stage ballistic missile with a stated range goal above 2,000 kilometres, and a set of missile variants that included a hypersonic glide vehicle.

Anthropic said the actors used Claude Code in place of software engineers to develop guidance and control code. It added that they test-fired a guided rocket, a test that appears to have failed.

The Russian cases included freelance actors working on an autonomous kamikaze drone swarm.

Biology, and the judgement calls

Anthropic said it presented five cases of people using its models in ways that could support biological weapons development. It stressed how hard those judgements are to make.

The company withheld the names of the institutions, the countries and the specific biological agents involved. It said the individuals were working scientists, and it did not assert that they intended harm.

In one example from May, it said a request for help writing a grant application involved gain-of-function research on the chikungunya virus. That work was intended to be carried out at a military research institute.

“You are not seeing someone in a comic book kind of way say, ‘Hey, I want to build a biological weapon to kill everybody,’” Klein told The New York Times. “It’s an incredibly nuanced situation.”

On the chikungunya case, he told the paper the company did not know whether the research was meant to be weaponised, but that a military institution doing gain-of-function research was concerning. Anthropic said older models such as Claude Opus 4 were well below the level where they could meaningfully assist such work.

It said it had launched more recent models with stronger safeguards. That shift echoes an earlier report in which the company ran its bioweapon classifiers off during testing. The distillation thread, meanwhile, runs back to White House claims that Moonshot distilled Anthropic’s Fable.

The Chinese distillation cases

The report also expands on illicit distillation. Anthropic defines that as covertly extracting a model’s capabilities to train a rival.

The company said it had identified campaigns from seven China-based labs, all targeting its generally available models rather than Mythos. It named Moonshot AI, which it said silently forwarded customer requests to Claude and displayed the responses as though they came from its own Kimi model.

Over one ten-day period, Anthropic said, Moonshot relayed almost 300,000 requests through a network of 5,380 fraudulent accounts. It attributed more than 23 million exchanges to Moonshot between May and July. The company made similar allegations against DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax.

Some of the relayed queries exposed sensitive user data, it said, in one instance live credentials tied to a Russian defence agency.

The distillation findings land alongside a US intelligence advisory naming six Chinese firms and Beijing’s rejection of those claims. Anthropic said most of the influence operations it caught drew little or no authentic engagement before it disrupted them. Other platforms have made the same caveat.

Anthropic said it published the report out of an obligation to disclose the misuse, and to give governments and civil society a clearer view of how such threats take shape.