# Claude misused (4/7) : A weapons cell in Yemen used it as a software team

> They fired a guided rocket, it appears to have failed, and within hours they were back asking Claude why. The hardware was always theirs. What AI replaced was the programmers.

- Author: Abhay Bagda (https://abhaybagda.com/about/)
- Published: 2026-10-18
- Topic: Quick Take
- Series: Part four of seven
- Reading time: 5 min
- Canonical URL: https://abhaybagda.com/writing/yemen-weapons-cell-claude-software-team/

---

In northern Yemen, a group test-fired a guided rocket. It appears to have failed, and within hours they were back at their keyboards asking Claude what went wrong.

That's from the conventional weapons section of Anthropic's September threat report, a category the company says is new since its last report. There are six cases, three in China, two in Russia and one in Yemen. This is part four of seven, and [part three was influence operations](/writing/ai-propaganda-mostly-reached-nobody).

The pattern across all six is the same. These people didn't need help with the hardware or the physics, because they already had both, and what they were short of was programmers. The report says the actors used Claude "to build and refine software for weapons hardware and firmware with which they already had expertise and to which they had access." Jacob Klein, Anthropic's head of threat intelligence, [explained to Reuters](https://www.staradvertiser.com/2026/09/11/breaking-news/anthropic-report-details-disruption-of-bioweapons-research-cyber-espionage-on-claude/) why this is showing up now: "A year ago, let's say you wanted to optimize a drone or optimize the software on a missile, the models just wouldn't be as good at that task as they are now."

> Nobody asked Claude how to build a rocket. They already had one, and they needed someone to write the software.

**The first is the Yemen cell.** It was running three programmes: a guided rocket steered by a phone-class computer, a multi-stage ballistic missile with a stated range goal above 2,000 km, and a missile family that included a hypersonic glide variant. They ran several Claude instances at once like a small team, with one writing code, one doing research and one reviewing the first one's work. Anthropic says its safeguards "blocked many of their requests, but not all of them," partly because the cell hid what the software was for and split the work across sessions so that no single one gave it away. Anthropic doesn't have evidence they fielded a working weapon. But by the time the accounts were banned they'd already packaged their simulation toolkit into a standalone program that doesn't need Claude to run.

**The second is a freelance drone swarm.** A small Russia-based team, which Anthropic assesses as freelancers doing a mix of civilian and military work and not a state body, set out to build a swarm of first-person-view kamikaze drones. Claude Code wrote the coordination logic, the software that steers a drone onto its target using the onboard camera, and the part that issues the call to detonate. The design put a small AI model on the drone itself that could select targets, including a "person" class, and give that command "without a human in the loop." They trained the vision system on scraped Ukrainian combat footage. It got as far as simulation and code loaded onto real development boards, which is early, but it isn't a slide deck either.

**The third changed its test scenario to Taiwan.** A China-based researcher, linked by account data to PRC research institutions including the PLA Academy of Military Sciences, built a suite of about 16 modules for electronic warfare and went through 12 versions of it. In plain terms it's software that works out where an opponent's radars and missile batteries can see, how well jamming would blind them, and which ones to knock out first. Partway through, the default scenario in the simulation was changed to 12 targets in Taiwan, including a command bunker, an early warning radar site, and Patriot and Tien Kung missile batteries.

The detail I can't get past, as someone who writes software, is in the Russian case. Anthropic tied nine accounts to that team, and eight of them were only ever used for ordinary freelance work. So it was the same people with the same tools, doing normal contract jobs on eight accounts and a weapon on the ninth. The work itself doesn't look unusual either, since a control loop, a simulator and a vision classifier could be sitting in any robotics repo. Anthropic admits the hardest case in this section to catch didn't involve weapons code at all. A procurement manager at a Moscow design bureau was sourcing European-made parts through China to get around trade controls, and every request looked, in the report's words, "individually mundane."

If you take contract work in robotics, drones, computer vision or control systems, this is now your problem as well as Anthropic's. Ask what the thing gets mounted on and who the end customer is before you write a line, and don't take a brief that won't tell you. The filter on the model missed some of these because the code looked normal. You're the one reviewer in that chain who can ask a question and refuse to carry on until it's answered.

The weapons section is [here](https://www.anthropic.com/threat-intelligence-report-september-2026#conventional-weapons-sep-26). Part five is biology, where Anthropic isn't even sure anyone meant harm.