On September 10, 2026, Anthropic published its third report on malicious uses of its artificial intelligence models since March 2025. One passage drew the attention of foreign ministries and weapons specialists alike. Anthropic states that it identified a cell of malicious actors based in northern Yemen, running three weapons development programs.
I want to be clear from the outset about what the report establishes and what it does not, because several accounts of the story, including the Daily Mail’s, go further than the original text. This distinction matters for gauging the real scope of the affair.
What Anthropic’s report says
According to AFP, the three programs were a guided rocket using a commodity phone-class flight computer with terminal guidance, a multi-stage ballistic missile with a stated range goal of more than 2,000 kilometers, and a multi-variant missile that included a hypersonic glide vehicle version.
The contribution attributed to Claude is specific. The cell reportedly used Claude Code in place of software engineers to write the guidance, navigation and control software, meaning the software that steers and stabilizes a vehicle in flight. According to the report, the tool notably helped estimate the vehicle’s position, tune control parameters and run a firmware build pipeline. After a failed shot, it also helped analyze the failure.
Anthropic describes a methodical circumvention of its safeguards. Its security mechanisms blocked some of the requests, but not all of them. The actors used various tactics and spread their work across several sessions, so that no single request looked suspicious.
A test firing that apparently failed
The most important point is also the one most often left out. Anthropic writes that it has no evidence the actors succeeded in fielding an operational device, but notes that they did test-fire a guided rocket. The test appears to have failed: a few hours later, the actors went back to Claude to work out why.
Nothing in the report therefore supports the claim that this work resulted in missiles used in an attack. The assertion repeated by some media outlets, that weapons from this program struck Saudi Arabia, does not appear in the sources I was able to consult. It should be treated as unsubstantiated until some evidence confirms it.
Anthropic adds a nuance that also limits the reach of its own safeguards. It has evidence that the actors had already built an offline simulation toolkit, independent of Claude as well as of standard engineering environments such as MATLAB. In other words, even after the accounts were shut down, part of the know-how acquired or assembled remained usable.
The Houthis, an attribution that remains indirect
Anthropic does not name the Houthis. Observers reason geographically: northern Yemen, including Sanaa, is controlled by the Iran-backed Houthi rebels. The Financial Times, cited by Iran International, reported that the cell appeared to be linked to the movement.
This attribution is plausible, but it remains an inference. It comes against a tense military backdrop. The Houthis are pursuing an offensive to expand their territory and, according to the Associated Press, are seeking to damage Saudi oil exports. The day after the report was published, they also claimed control of a Red Sea island in the middle of the Bab el-Mandeb strait, a strategic shipping lane.
🔺🇾🇪🚨 Les Houthis dévoilent une vidéo de leur arsenal de missiles et de drones, dont des engins présentés comme hypersoniques.
Une démonstration de force après leurs menaces contre l’#Arabiesaoudite 🇸🇦, le #Pakistan 🇵🇰 et la #Turquie 🇹🇷.
#Yémen #Houthis #Iran #Saudi #USA https://t.co/gFwQNgM511
— Silicon Valley (@SiliconValleyMa) October 13, 2026
Experts’ reservations
I find two readings useful, which are opposed only in appearance.
The first is skeptical about real capabilities. Trevor Ball, an analyst at Armament Research Services, believes the Houthis “might be looking into” hypersonics by asking Claude, but that they are very far from having the production capacity and technical skills to build them. Writing guidance software is not enough: you need materials, engines, flight tests and an industrial chain.
The second stresses the trajectory. Adam Baron, a researcher at the think tank New America, points out that the movement has kept pace with technological developments. In the Red Sea, the Houthis have already shown an ability to use low-cost drones and missiles against expensive targets.
I do not think these two readings contradict each other. AI does not turn an armed group into a ballistic power overnight. It can, however, lower the cost of part of the work, the software and documentation, which until now required rare engineers who were hard to recruit.
Why this matters
What the affair illustrates is the shifting of a bottleneck. For a long time, ballistic proliferation relied on export controls, on hard-to-obtain components and on skills concentrated in a handful of countries. AI models act on that last factor. They condense scattered technical knowledge and assist users who lack full training.
This raises three questions.
- For AI developers, the difficulty is telling a legitimate engineering request from a military one when requests are fragmented. Anthropic says it has launched classifiers designed to detect requests related to high-yield explosives and weapons development, which implies that the initial defenses were insufficient.
- For states, AI regulation is also becoming a counter-proliferation issue, one that until now has been handled mainly through missile technology control regimes.
- For regional players, notably Saudi Arabia, whose energy infrastructure is exposed, the threat lies less in a hypothetical hypersonic missile than in the gradual improvement of the accuracy of weapons already available.
The limits of Anthropic’s transparency
We should also look at this report for what it is: a document published by the maker of Claude itself. It can be read as an act of transparency, since the company discloses a partial failure of its safeguards. It is also worth remembering that we only have its version of events, with no access to the conversation logs and no independent verification. Anthropic says it banned every account it could link to the cell and shared its information with public and private partners. The number of accounts, how long they were active and the share of requests actually blocked are not specified in the sources I consulted.
Finally, I note that other developers are probably facing comparable uses without documenting them publicly. The Anthropic case tells us as much about its disclosure policy as about the scale of the phenomenon.
What to watch
In the short term, three elements will help clarify the picture: possible official confirmation of the attribution to the Houthis, new documented test firings in the region, and the reaction of US and European regulators to these disclosures. I remain cautious about the idea of a strategic break. I am not cautious about the idea that the question of AI and proliferation is now posed in concrete terms, and no longer only in theory.
FAQ
Did the Houthis actually use Claude?
Anthropic refers to a cell based in northern Yemen, without naming it. The Houthis control that area and the press attributes the activity to them, but this link remains a deduction.
Were these missiles used against Saudi Arabia?
None of the sources consulted confirms it. Anthropic states that it has no evidence of an operational device being fielded. Only a test firing of a guided rocket is mentioned, and it appears to have failed.
Can AI alone be enough to build a missile?
No. According to the experts cited, it can help write software and analyze failures, but manufacturing requires components, industrial capacity and tests that no model can replace.
What did Anthropic do?
The company says it banned the identified accounts, shared information with partners and deployed new classifiers against weapons-related requests.
