Anthropic says a Yemen cell used Claude for nine months to write missile software

Anthropic's September 2026 threat report says a cell in northern Yemen used Claude Code, Haiku, Sonnet and Opus between December 2025 and August 2026 to write guidance, navigation and control software for three weapons projects. The company labelled the case GTG-87001 and said it banned the accounts after it pieced the work together. It assessed the operators as highly likely to be linked to the Houthis. It also said it has no evidence that a finished weapon was fielded.

The three projects, as Anthropic described them, were a guided rocket built around a phone-class flight computer and a terminal homing system; a multi-stage ballistic missile meant to fly more than 2,000 kilometres; and a set internally called R2000 that included a hypersonic glide vehicle concept. Operators ran several Claude sessions at once and split jobs between coding, research and review so that no single prompt stated the full aim. Safeguards blocked many requests. Some did not.

On the guided rocket, the report says the group used Claude to write flight-control firmware and then, after a live test-fire in Yemen failed, to work through the failure within hours. Anthropic says the cell already had its own stand-alone simulation tools and did not need MATLAB or Claude to run every flight model. The models were used as cheap software engineers for the parts of the stack that look like ordinary code: filters, control loops, target logic.

The company published the case in the same week Houthi forces took Mocha, Dhubab and Perim Island and said Saudi ships were barred from Bab el-Mandeb. That coincidence will be read as a single story in many newsrooms. The report itself is narrower. It covers account misuse from late 2025 through August, before this week's coastal offensive. It does not claim Claude built the rockets that flew on Thursday.

What the document does claim is that a small group can now assign roles to language models the way a missile bureau assigns them to junior engineers, and that content filters miss the intent when the work is chopped into innocent-looking tickets. Anthropic says it disrupted the activity. It also says several requests slipped through. That second sentence is the part other labs will have to answer, because the same pattern can be run on any coding model that will write firmware.

There is a hard limit in the public record. No open source has shown a working 2,000-kilometre missile or a hypersonic glide vehicle leaving Yemen. A failed test-fire of a smaller rocket is a different object. Readers should keep those scales apart. The policy fight that follows will be about whether frontier labs can see a weapons programme when it arrives as a set of control-theory questions.

The same report describes other misuse cases, including state-linked espionage, that are separate from Yemen. Lumping them into one headline hides the mechanics. The Yemen file is about control software and simulation. The espionage file is about access and data. Different operators, different mitigations. Labs that only raise the temperature on weapons keywords will miss the chopped-up firmware tickets that Anthropic says got through.

Regulators who read the report as a call for licensing should notice the timeline. The activity ran for nine months before the write-up. Detection was retrospective. That lag is the operational fact, more than the range figures attached to the paper missiles. If other companies have similar unreported queues, the public case is still incomplete.

Anthropic's public write-up is now part of the record other firms will be asked to match. Silence from peers will look like an absence of cases or an absence of disclosure.