Missiles, drones, viruses: what the extreme cases say about choosing an AI provider

The last two chapters of the report seem irrelevant to an SME in Alsace. They are not. These are the cases where a model's guardrails are put to the test for real, and what can be observed there (what holds, what gives way, and how) is the criterion that should guide the choice of an AI provider. This article closes the series.

First, a note on method. Until now, this kind of activity was brought to light by governments, United Nations expert panels and outside investigators, working from recovered material and public sources. A model provider sees it directly. In parallel, Anthropic's red team has built new evaluations measuring models' capabilities in tactical intelligence targeting and weapons development: they show steady progress. The vendor also says it has deployed new classifiers aimed at high-yield explosives.

Part I: four weapons programmes #

Anthropic lists six cases linked to conventional weapons: three in China, two in Russia, one in Yemen. Four concern the development of weapons software. In every case, the actors already had the expertise and the hardware: the model filled the shortage of software labour.

• Yemen. A cell in the north of the country ran three programmes: a guided rocket controlled by a phone-class flight computer, a multi-stage ballistic missile aiming for a range of more than 2,000 km, and a family of missiles including a hypersonic glider variant. The model was used for software integration and control code, parameter tuning, maintaining the build chain and running a flight simulation. The operators used several instances in parallel with distinct roles: one wrote code, another did research, the third reviewed the first. A test launch took place; it failed; they were back within hours to analyse the cause. A detail to remember: they had already compiled their simulation toolkit into a standalone executable that runs without the model.
• China, submarine. One actor pursued three tracks in parallel on an anti-torpedo system: a specification in Chinese, written to win the approval of a defence manufacturer who would have pushed it towards certification and then trials; a technical proposal of more than 200 pages with a summary presentation; a benchmarking exercise against American programmes based on public information. After each version, it had the model play the role of a hostile expert reviewer, whose criticism was used to harden the next one.
• Russia, drone swarm. A small team of freelancers (not a state service, according to Anthropic) built a complete software stack for a swarm of one-way attack drones: shared memory between devices, fault-tolerant coordination, a small onboard model arbitrating between attack, observation and return to base, camera-based terminal guidance, geolocation of enemy operators, passive acoustic detection and low-level logic for programmable chips. The image classifier had been trained on Ukrainian combat footage, with “enemy” and “friendly” classes; it included a “person” target class, and the platform was designed for autonomous lethal engagement with no human in the loop. The sessions show firmware flashed onto real boards. Of nine accounts identified, eight were used only for ordinary freelance work.
• China, electronic warfare. Another actor had a suite of around sixteen jamming and air defence suppression modules built, over twelve versions. The software analysed enemy radars, surface-to-air missile sites, command posts and communication nodes, calculated their detection coverage, ranked targets by value and vulnerability and spread jamming sorties over several days. Midway through the project, the simulation's default scenario was changed to twelve targets in Taiwan. The actor also ran a self-hosted model on its internal network, connected to the suite through a tool integration.

Part II: intelligence and procurement #

The last two cases produce no weapons software. Yet they are the most instructive: they look like office work.

The first is that of a purchasing manager at a Moscow design bureau, working on five projects: German magnetometers through a Chinese distributor, with a declared civilian biomedical use; several thousand space-grade photovoltaic wafers; oxygen systems for aircrew; a hospital for a National Guard unit; IT and encryption equipment through the state defence procurement platform. The model was used to find intermediaries in mainland China and Hong Kong, to draft requests for quotes in three languages (e-mails presenting the buyer as head of external relations at an unnamed research body, while asking for delivery to Russia), and to map out the grey import chain: unlicensed Russian distributor, import-export company in China, Hong Kong intermediary, costs and routing included.

The briefing notes written for the director explicitly described the setup as a way of getting round European trade controls: they cited the applicable rules, acknowledged that direct supply was blocked and planned to route the goods through a “sanctions-neutral jurisdiction”. In parallel, automated browsing agents handled the back office: price collection, around forty lines per tender, merging spreadsheets. Anthropic acknowledges it frankly: each request taken on its own looks harmless (a price request, a specification, a supplier search), and that is what makes this activity hard to detect.

The second case is a three-person cell in China, led by a defence intelligence writer. Over dozens of sessions, it collected open-source information on directed energy weapons, including a vehicle-mounted microwave system designed to counter drone swarms, made public a few days earlier. The aim: to identify a specific device and its supplier through successive probabilistic attributions, then map the public shareholding of those suppliers to see through an opaque supply chain. Deliverables: a 23-page report for management, annexes of around 45 pages, a twelve-month watch list, and analytical frameworks borrowed from Western intelligence agencies.

How the guardrails were bypassed #

This is the useful part for anyone deploying an assistant in a company: the same mechanisms apply to your internal rules.

1. Splitting the work. The actors “split their work across many sessions to conceal the full nature of their programs.” No session revealed the full intent. In the Iranian tool development case, the model refused nine out of ten openly malicious requests; the protections held up far less well once the work was cut into small tasks over later sessions.
2. Concealing the purpose. The actors hid the objective and the product the software was intended for. A command module, a control loop, a trajectory simulation: none of these, on its own, bears the mark of a weapon.
3. Rephrasing. A correct refusal was overturned at the second attempt in at least two documented cases, one in the surveillance chapter, the other in the influence chapter, where the actor negotiated sanitised wording to build the same capability.
4. Geographic workarounds. VPNs, virtual private servers, foreign phone numbers, resellers, third-party relays: almost all actors located in unsupported regions went this way.
5. Falling back on a more permissive model. This is the most striking case in the biology chapter. A relay platform serving dozens of researchers set up a mechanism that sent on to a competitor's model the sensitive requests Claude refused. A pre-deployment test had even been written to fail if a forbidden request reached Claude instead of the permissive model. And the report adds: “Claude wrote much of this code, which was presented to it as over-refusal mitigation.”

Biology, or the admission that the classifier is not enough #

The biology chapter is the most cautious in the report, and the most interesting methodologically. Five cases, all dual-use. Anthropic makes a remark there that applies elsewhere too: “Overt malicious intent is, therefore, often evidence that a particular actor is not all that sophisticated”, since such an actor operates in the open; serious actors obtain help through exchanges that, taken one by one, look legitimate.

• Case 1: where the classifier blocks, and people get round it. In May 2026, a request for help with a funding application was blocked: the project was presented as civilian but was to be carried out at a military research institute. The investigation led back to a relay platform serving dozens of life sciences researchers, which routed its traffic through American infrastructure to get round regional blocks and used a service without data retention to hide the content. Accounts banned, relays dismantled, and the operator regained access within a few days, through consumer subscriptions opened under new identities.
• Case 2: where the protections hold. A researcher working on a highly pathogenic avian virus exchanged thousands of messages over several weeks, from an unsupported region. But the biosafety classifiers confined him to the weakest models in the range. Anthropic assesses the real contribution as “primarily clerical assistance in data analysis, study ideation and design”. The guardrails worked by degrading the tool.
• Case 3: where framing is enough to get through. An account created from a disposable address turned out to be a reseller relay serving more than a dozen unrelated customers, with tens of thousands of messages in a few days. One of them had a funding application drafted end to end, in about an hour and on the most capable model, on viruses of the smallpox family. The work was explicitly about attenuating the virus, a defensive purpose, and was not blocked.
• Cases 4 and 5: where the protections do not apply by design. Two researchers worked on computer-assisted design in protein and toxin research, within a stated therapeutic framework (painkillers, antidepressants) but with structures usable in both directions, some of them covered by export control lists. In the second case, the identities of the compounds studied had been deliberately obscured at the researcher's request, who required the model to use imprecise descriptions in the quarterly reports.

Hence the conclusion Anthropic draws itself, which goes well beyond biology: “since it is not possible to reliably identify the intent of the user in highly technical dual-use areas”, “a classifier cannot simultaneously enable benefit and prevent harm”, and “the only safe way to serve frontier biological capabilities is to offer them in trusted user programs”. That requires, it adds, account and institution signals to verify the user's legitimacy, and data retention, the only source of observability that makes it possible to spot misuse. In other words: automated filtering has a structural limit; beyond it, what protects you is knowing who is on the other side.

One last figure gives the scale. Anthropic reviewed thirty days of activity linked to institutions in states of concern and found around 35 distinct research projects, mostly ordinary civilian science, some with notable dual-use potential. That is not proof of an imminent threat; it is a measure of what a provider sees and has to sort through.

The three questions to put to an AI provider #

We are integrators, not model vendors: we choose providers for our clients, and this reading has changed our criteria.

1. Do you publish what you detect? A vendor that documents misuse of its product has a team that looks, the means to act, and accepts the reputational cost of transparency. A silent vendor is not cleaner: it is less observable.
2. Where do the requests go, and who keeps them? A direct contract, no undeclared intermediary, a documented location, retention and use for training explicitly settled. The instalment from two days ago shows what a vague answer is worth. And the biology chapter adds an unexpected argument: it is data retention that makes it possible to detect abuse. Zero retention is not free; it is a trade-off.
3. What are the guardrails worth, and what do you lose without them? A model “with no limits” is not freer: it is less supervised. The report gives an unintentional demonstration of this in the distillation chapter: one lab gave up extracting the cyber capabilities of the most tightly locked-down model because the protections degraded the attack, and switched to less protected models. Guardrails are part of the product, just like latency or the price per million tokens.

The ten-day checklist #

Here is what we take away from the 154 pages, reduced to what gets decided in an SME. One line per instalment.

1. Set the frame. None of the attacks described is new; their cost has collapsed. Nobody is too small, because targeting costs nothing any more. Instalment 1.
2. Take inventory of API keys and rotate them, AI keys included; get them out of code and applications; cap and monitor consumption. Instalment 2.
3. Treat the choice of suppliers as a security decision: contractual notification deadline, token lifetime, list of sub-processors, independent data export, review of connected applications. Instalment 3.
4. Centralise logs and alert on behaviour, not on signatures: persistence created, SSH key added, privileged account generated, security agent gone silent. Instalment 4.
5. Run the website like a production system: updates, must-use plugins inspected, file integrity monitoring, no execution in upload directories, and immutable backups, actually restored, on a clean machine. Instalment 5.
6. Reduce the exposed surface: quarterly external scan, administration behind a bastion host, edge patches within days, end of support treated as an outage, segmentation verified. Instalment 6.
7. Write the rule on what never goes into an assistant, buy access directly, move sensitive processing to a model hosted on your own infrastructure. Instalment 7.
8. Minimise and purge. Collect only what is useful, keep it only as long as necessary, log access to personal data. This is a security measure, not a formality. Instalment 8.
9. Display the second-channel rule: no bank transfer, no change of bank details or access without calling back on a number you already know. Neither image, nor voice, nor video is proof of identity. Instalment 9.
10. Provide an authorised, convenient AI path, otherwise your rules will be got round through friction, and choose a provider on its transparency, its data path and its guardrails. (This instalment.)

If you want to know where you stand without buying an audit, start with the self-audit of ANSSI's 42 measures, then look at the ReCyF framework, which now structures what the French state expects. And if you would rather do it with someone, write to us: the first conversation is free.

Sources #

• Anthropic, Detecting and countering misuse of AI: September 2026 (10 September 2026): Conventional weapons (pages 111-128) and Biological misuse (pages 129-138) chapters.
• Cases cited: GTG-87001, GTG-17001, GTG-27005, GTG-17002, GTG-27006, GTG-17003, and the five biology case studies.
• Anthropic, Detecting and countering misuse of AI: August 2025 and Disrupting the first reported AI-orchestrated cyber espionage campaign.
• ANSSI / CERT-FR, Panorama de la cybermenace 2025 (2025 cyber threat overview, 11 March 2026).
• The whole series: 1 · 2 · 3 · 4 · 5 · 6 · 7 · 8 · 9.