Anthropic documents five possible bioweapons cases it cannot confirm were meant to cause harm

A reviewer opens a session in which the user is working with Claude to redesign toxins while taking care to keep their own identity vague ^[7]. Whether the work was meant to cause harm is the one thing that transcript leaves open. Anthropic's report notes that biological research is dual-use, and that running such experiments may be part of work toward a vaccine or a cure ^[9].

The mechanism sits in one sentence of the report. Anthropic said, "Actors circumvented controls we impose to prevent users from unsupported regions accessing our models, and engaged in other efforts to obfuscate the purpose of their research to evade our safeguards" ^[8]. Both checks named there are the ones an abuse team leans on hardest: where the account connects from, and what the user says the work is for.

The weapons picture is wider than the biological cases. The report also carries six scenarios in which Claude was used to write software for weapons, described as "firearms, missiles, armed drones, bombs, and other munitions, as well as the targeting and control systems that operate them" ^[11]. Five plus six is eleven documented scenarios that touch weapons ^[14], drawn from the nine months between December 2025 and August that the report covers ^[13].

None of the biological cases involved Anthropic's newest models. The report's only appearance of Fable and Mythos is a single case of distillation, and the scenarios otherwise ran on versions of Haiku, Opus and Sonnet ^[12][15].

Anthropic lists three responses, and only two are within reach of a reviewer holding a transcript with no identity and no jurisdiction ^[5]. Banning and patching do not need a name; a referral does, and PCMag's account of the report does not say which of the seven categories produced one ^[3].

Anthropic said, "We hope that the findings in this report will help other developers recognize similar patterns on their own platforms, give governments and civil society a clearer view of how emerging threats take shape, and strengthen collective defenses" ^[10]. The developers being asked to recognise those patterns will be doing it from their own logs, at whatever staffing they have.

A log can tell you who the account belongs to, where it connects from, and why the user says they are asking. Any policy that turns on intent is resting on those three. In Anthropic's five biological cases the identity was vague by the user's own effort, the region control was circumvented and the stated purpose was obfuscated ^[7][8], so the reviewer's whole case file was the conversation.