An Iran-linked actor built US Navy targeting handbooks from public data with Claude's help

Every item in the compiled inventory existed before the actor opened a session. Transponder identifiers are broadcast, commercial satellite imagery is a purchase, and the personnel roster came off captions attached to public military photographs ^[3]. The vulnerability work has the same character: the flaws catalogued in maritime satellite communications terminals, Cisco communications equipment and industrial control products were known ones ^[4]. What Claude added was assembly, plus a Python pipeline it helped write so the collection could run again ^[2].

The northern Yemen case in the same report shows what that speed buys. A cell there used Claude to develop guidance software for a multistage ballistic missile, test-fired a guided rocket, and was back within hours asking Claude to analyse the failure, the report said ^[10]. Iran-linked activity accounts for three of the six state-linked operations the report sets out in detail. The other three are the Russian group consistent with public reporting on Midnight Blizzard, the Chinese government-aligned surveillance of Uyghur diaspora communities in Syria, and the Yemen missile cell ^[16][9].

The remedy is account-level. Anthropic said it banned the account and developed new detections, and that it shared threat intelligence with government authorities and industry partners ^[5][8]. The same report lists what got past the controls: concealed objectives, requests fragmented across multiple sessions, and traffic routed through VPNs to circumvent geographic access limits ^[11]. Anthropic said its safeguards intercepted a significant portion of the attempts it documented while some requests succeeded, and put no figure on that portion ^[12].

The nine months of activity the report covers produced a banned account, a detection update, and disclosures to government ^[15][5][6]. The framing from inside the company runs larger. Evan Hubinger, a scientist at Anthropic, said in his view the company had no viable path to solving alignment before superintelligent systems arrive ^[14]. In a social-media post cited by the Wall Street Journal, he wrote: "We really do earnestly believe AI could kill all humans!" ^[13]

For anyone pricing the risk, the question is whether compilation was the scarce input. If a competent analyst with public sources and a fortnight produces the same handbook, the model provider's marginal contribution to this particular harm is thin. The remediation bill then sits with whoever operates the satellite communications terminals and industrial control products whose known flaws were listed ^[4]. If compilation was scarce, the same pipeline logic reaches every agentic deployment a buyer is underwriting this year, and VPN routing already defeats an account ban ^[11]. The published account supports the first reading more than the second, because the actor already had access to all of the collected material ^[3].