Anthropic：胡塞武装曾利用 Claude Code 开发导弹制导软件

也门北部一个组织单元曾使用 Anthropic 的 Claude Code，完成通常需要导弹工程团队才能承担的工作，包括为制导火箭、远程弹道导弹以及一种高超音速滑翔飞行器概念开发软件。

Anthropic 在 9 月发布的威胁报告中描述称，相关操作人员同时运行多个 Claude 实例，在编码、研究和技术审查之间分配任务。

根据所提供材料，Anthropic 评估该组织单元极有可能与胡塞武装有关联。

这项行动是该报告中最明确的案例之一：生成式 AI 被直接应用于常规武器研发，而不只是用于研究或信息收集。

并行 AI Agent 替代专业工作

这些位于也门的操作人员在多项工程职能中使用了 Claude Code。

其项目包括：一款战术制导火箭的制导软件、一枚射程超过 2,000 公里的弹道导弹，以及一种名为“R2000”的高超音速滑翔飞行器变体。

该组织并未将工作按顺序交由单个模型实例处理，而是并行运行多个会话。

一个会话可以生成代码，另一个进行研究，第三个则审查输出结果。

这一工作流使得一个小型团队能够复现通常分布在专业工程团队之间的多项职能。

从飞行计算机到轨迹仿真

技术工作延伸至导航、飞行控制和仿真领域。

操作人员试图将开源自动驾驶软件与一台手机级飞行计算机集成，并使用 Claude 编写导航和控制代码。

他们还开发了六自由度轨迹仿真，这是一种用于模拟物体在空间中移动和旋转的方法。

他们还使用 Claude 开展强化学习工作，以调优飞行控制算法。

操作人员最终将项目编译为可离线运行的独立可执行文件。这意味着开发工作无需直接访问 Claude 也能继续进行。

火箭测试后借助 AI 进行失效分析

相关活动已超出软件开发范围。

根据 Anthropic 记录的材料，该组织在也门试射了一枚制导火箭。这次测试似乎失败了。

然而数小时内，操作人员便重新使用 Claude，开始分析发射遥测数据以调查失败原因。

这一流程——软件开发、实体测试以及测试后的快速分析——表明，该模型被纳入一个迭代式武器工程周期，而非仅用于回答孤立的技术问题。

Anthropic 表示，没有发现该组织成功部署可作战武器的证据。

但在相关账户被处置时，操作人员已经组建了一套不再依赖访问 Claude 的离线工程工具包。

安全措施遭遇规避

Anthropic 的安全措施在项目期间拦截了大量请求。

操作人员随即通过模糊单项任务的预期最终用途、将工作拆分至不同对话，以及采用其他方法来规避限制。

Anthropic 随后封禁了与该活动有关联的账户。

该案例凸显了 AI 安全系统面临的问题：当一个更大的工程项目被刻意拆分到多个会话中时，单个请求可能看起来与武器开发毫无关联。

六起常规武器案例

也门行动是 Anthropic 记录的六起常规武器案例之一。

其中三起与中国有关，两起与俄罗斯有关，一起与也门有关。这些案例涵盖涉及导弹、武装无人机、枪械和炸弹的尝试。

这份更广泛的报告涵盖了 Anthropic 称其在 2025 年 12 月至 2026 年 8 月期间阻断的活动，包括网络行动、影响力活动、监控、常规武器、生物滥用、诈骗与欺诈，以及非法模型蒸馏。

Anthropic 还描述了一些生物研究案例，其中该公司无法确定科学家是在开展合法研究，还是在追求与武器相关的目标。

“你不会看到有人像漫画里那样说，‘嘿，我想制造一种生物武器杀死所有人。’”Anthropic 威胁情报负责人 Jacob Klein 表示，“这是一种极其微妙的情况。”

对于也门案例而言，眼前的结果更为明确：Claude 已被纳入一个覆盖设计、仿真、测试和失效分析的真实研发周期。

没有证据表明该武器已成为可作战装备。但围绕它构建的工程能力，已经开始转向离线环境。

A cell in northern Yemen used Anthropic’s Claude Code to perform work that would ordinarily require a missile engineering team, developing software for guided rockets, a long-range ballistic missile and a hypersonic glide vehicle concept.

Anthropic’s September threat report describes operators running several Claude instances at the same time, dividing tasks between coding, research and technical review.

The company assessed the cell as highly likely to be linked to the Houthis, according to the material provided.

The operation marks one of the clearest examples in the report of generative AI being applied directly to conventional weapons development rather than used simply for research or information gathering.

Parallel AI Agents Replace Specialist Work

The Yemen-based operators used Claude Code across multiple engineering functions.

Their projects included guidance software for a tactical guided rocket, a ballistic missile with a range exceeding 2,000 km, and a hypersonic glide vehicle variant called “R2000.”

Rather than assigning the work sequentially to a single model instance, the group operated several sessions in parallel.

One could produce code while another conducted research and a third reviewed the output.

The workflow let a small group reproduce several functions normally distributed across specialist engineering teams.

From Flight Computers to Trajectory Simulation

The technical work extended into navigation, flight control and simulation.

The operators sought to integrate open-source autopilot software with a phone-class flight computer and used Claude to write navigation and control code.

They also developed six-degree-of-freedom trajectory simulations, a method for modeling an object’s movement and rotation through space.

They also used Claude for reinforcement learning work to tune flight-control algorithms.

The operators ultimately compiled the project into a standalone executable that could run offline. That meant development could continue without direct access to Claude.

Rocket Test Followed by AI Failure Analysis

The activity moved beyond software development.

The group test-fired a guided rocket in Yemen, according to the material documented by Anthropic. The test appears to have failed.

Within hours, however, the operators returned to Claude and began analyzing launch telemetry to investigate the failure.

That sequence, software development, physical testing and rapid post-test analysis, illustrates how the model was incorporated into an iterative weapons-engineering cycle rather than being used for isolated technical questions.

Anthropic said it found no evidence that the group succeeded in fielding an operational weapon.

But by the time the accounts were disrupted, the operators had already assembled an offline engineering toolkit that no longer depended on access to Claude.

Safeguards Met With Evasion

Anthropic’s safeguards blocked numerous requests during the project.

The operators adapted by obscuring the intended end use of individual tasks, dividing work across separate conversations, and using other methods to circumvent restrictions.

Anthropic subsequently banned accounts linked to the activity.

The case highlights a problem for AI safety systems: individual requests may appear disconnected from weapons development when a larger engineering project is deliberately fragmented across sessions.

Six Conventional-Weapons Cases

The Yemen operation was one of six conventional-weapons cases Anthropic documented.

Three were linked to China, two to Russia and one to Yemen. The cases covered attempts involving missiles, armed drones, firearms and bombs.

The wider report covers operations Anthropic said it disrupted between December 2025 and August 2026 across cyber operations, influence activity, surveillance, conventional weapons, biological misuse, scams and fraud, and illicit model distillation.

Anthropic also described biological research cases in which it could not establish whether scientists were conducting legitimate research or pursuing weapons-related objectives.

“You are not seeing someone in a comic book kind of way say, ‘Hey, I want to build a biological weapon to kill everybody,’” Jacob Klein, Anthropic’s head of threat intelligence, said. “It’s an incredibly nuanced situation.”

For the Yemen case, the immediate outcome was more concrete: Claude had been incorporated into a real development cycle spanning design, simulation, testing, and failure analysis.

The weapon itself was not shown to have become operational. The engineering capability assembled around it had already begun moving offline.