Anthropic Report: Claude Used for Missile Code and Drone Swarms as Chinese Labs Log 151M Queries

Anthropic has published a threat intelligence report covering eight months of abuse of its Claude models, documenting cases that range from weapons engineering to industrial-scale data scraping. The most striking finding is that actors used Claude to help write software for missiles, control autonomous kamikaze drones, and build nationwide surveillance systems. The report also names Chinese AI developers — including Alibaba's Qwen team, DeepSeek, and Moonshot AI — as among the heaviest abusers, with Qwen alone responsible for more than 151 million exchanges.

The Chinese activity appears to have served two purposes. In some cases, labs relayed large volumes of user requests through Claude, effectively using Anthropic's infrastructure as a proxy to answer queries at scale. In others, the goal was training data: operators extracted model outputs to feed their own systems, a practice that directly undercuts the terms of service and the compute economics of Western model providers. The volume cited for Qwen — over 151 million interactions — suggests this was not opportunistic scraping but an organized, sustained operation.

The weapons-related cases are harder to dismiss as routine policy violations. According to the report, Claude was used in the development of missile software, in the control stack for one-way attack drones that detonate on impact, and in the construction of surveillance systems built to monitor entire populations. These are applications that fall outside any plausible commercial or research justification, and they put the misuse squarely in the territory of national security rather than ordinary terms-of-service enforcement.

Anthropic's disclosure lands at an awkward moment for the industry. Model providers have spent two years arguing that access controls, usage monitoring, and refusal training make frontier systems safe enough to deploy broadly. A report showing sustained abuse across weapons, surveillance, and data extraction — over a period of months, not days — raises the question of how much of that activity was caught only after the fact. It also sharpens the argument for stricter verification of API customers and for logging that can distinguish a legitimate enterprise workload from a relay operation.

The report does not specify which governments or groups were behind the missile and drone work, nor does it say whether any of the activity was referred to law enforcement or regulators. Those omissions are likely to draw scrutiny from policymakers already weighing export controls and mandatory incident reporting for AI developers. The near-term test is whether Anthropic's findings push other labs to publish comparable threat data, or whether the industry continues to treat abuse reporting as a voluntary disclosure made only when it suits the discloser. Anthropic has not said whether it has cut off the accounts involved or changed its access rules in response.