Anthropic report says Claude was used to plan dual-use biological research

Anthropic said Thursday that five cases outside the United States involved people using its advanced Claude AI systems to plan biological research with potential military applications, including work on avian influenza, chikungunya and orthopoxviruses. In several instances, the people involved also tried to bypass restrictions designed to limit access to sensitive capabilities, the artificial intelligence company said.

The report did not identify the researchers’ countries, institutions or particular biological targets in each case. Anthropic said it is not claiming that the people involved intended to build biological weapons, and it said the cases do not demonstrate that Claude has enabled an imminent attack.

Instead, the company said the incidents show a more immediate concern: scientists tied to state-associated programs are using powerful AI tools to accelerate research that may have legitimate medical purposes but could also be adapted for offensive use.

One of the report’s most detailed examples involved a military research institute seeking approval for a grant proposal concerning chikungunya, a virus transmitted by mosquitoes. The proposed project would have examined mutations that could make the virus more transmissible and better able to evade the immune system. The researchers planned to place those mutations in infectious viral clones and repeatedly pass the virus through live animals, selecting strains that produced the most severe disease.

Anthropic rejected the grant application. The company said the work could contribute to vaccines and treatments, but it could also produce a pathogen difficult to distinguish from a naturally emerging outbreak.

The researchers accessed Claude through a life sciences platform that routed their traffic through U.S. infrastructure, bypassing Anthropic’s regional restrictions. When Claude declined sensitive questions, the platform redirected those requests to another AI model with looser safeguards. After Anthropic banned accounts connected to the activity, the platform operator reportedly obtained new identities within days, while Claude continued to provide editorial help on research materials.

The report did not say that the proposed chikungunya experiments were carried out.

In another case, a researcher spent several weeks using Claude to develop plans for studying mammalian adaptation and airborne transmission of highly pathogenic avian influenza. The work focused on viral traits that could help bird flu spread more effectively among mammals and cause severe illness beyond the respiratory system. Anthropic said a strain capable of efficient human-to-human transmission would create a major pandemic risk.

According to the report, the researcher appeared to have access to virus samples and animal facilities. Anthropic restricted that interaction to weaker models, limiting the assistance mainly to study design, data analysis and editing. The company said the activity appeared to be part of an active research program building both the expertise and biological resources needed to create pathogens with greater pandemic potential. The researcher also concealed his identity and accessed the models from a region not supported by Anthropic.

A separate person linked to a state-associated infectious-disease laboratory used Claude to draft an orthopoxvirus grant application from beginning to end in about an hour. Orthopoxviruses include mpox and variola, the virus responsible for smallpox.

The proposed research examined viral genes that suppress the human immune response. The application included a central hypothesis, experimental procedures, dosing plans, statistical methods and contingency strategies. Anthropic said Claude did not block the assistance because the project was presented as an effort to weaken the virus. The same information, however, could potentially help a researcher preserve or strengthen a virus’s ability to evade immunity.

The report’s remaining cases concerned venom-derived peptides and toxins. In one, a researcher used Claude to help construct a database of toxin peptides from several venomous animal groups and develop a generative system for improving their properties. The stated purpose was to support medical treatments, including painkillers and antidepressants. The database also contained structures linked to paralytic toxins that could potentially be developed as incapacitating agents. Anthropic said the work belonged to a state-supported research program.

In the fifth case, a researcher used Claude to computationally redesign several toxins, including a bacterial toxin and a protein from a hemorrhagic fever virus that the World Health Organization has identified as a priority disease threat. The person used the system to prepare progress reports but asked Claude to describe the toxins vaguely and withhold their identities.

Taken together, the cases illustrate the difficulty of controlling biological misuse through automated content filters alone. Anthropic said its safeguards blocked the clearest requests involving pathogens with enhanced pandemic potential. They were less effective when users presented similar work as defensive, therapeutic or medical research.

“Biological capabilities are dual use,” Anthropic wrote. “The same information that can be used to develop a biological weapon could also be used to develop, for example, a vaccine or a cure for a disease.”

The company also reviewed 30 days of activity connected to adversarial state institutions and identified roughly 35 separate biological research efforts. Anthropic said most appeared to involve ordinary civilian science, although some had what it described as notable dual-use potential.

Anthropic said stronger protections will probably need to go beyond filtering individual prompts. The company pointed to identity verification, institutional screening and closer scrutiny of users seeking advanced biological capabilities.

The findings arrive as policymakers and AI researchers continue to debate the possibility of severe or catastrophic harms from increasingly capable systems. Jacob Coxon, a former Anthropic and OpenAI researcher, recently resigned while accusing the companies of “racing straight to self-improving superintelligence and gambling with our lives.” His warning attracted more than 100 million views on X. Evan Hubinger, Anthropic’s alignment science lead, separately said he personally believed there was a greater than 10% chance that AI could kill all humans within the next decade.

Those comments concern the longer-term risks of advanced AI. Anthropic’s new report focuses on a narrower danger already visible in recorded activity: sophisticated biological researchers using AI assistance while testing or evading the limits placed on their access.