Anthropic says a Yemen cell used Claude to design missile software

Anthropic said in a report published Thursday that it had disrupted a cell in northern Yemen that used Claude to support three weapons programmes. The work ran from December 2025 to August 2026 on Haiku, Sonnet and Opus models, including Claude Code. The company banned the accounts when it judged the activity illegal. It did not name the users. Northern Yemen is Houthi-held territory, and the report has been read in that light.

The first programme tried to turn commercial parts into a guided rocket. The design used a phone-grade flight computer and a homing system meant to steer in the last phase of flight. Anthropic said the cell later came back to Claude to ask why a test of that rocket had failed. That is the closest the report comes to a field event. The company said it has no evidence that the group fielded an operational weapon.

The second programme was a multi-stage ballistic missile with a claimed range above 2,000 kilometres. The third, labelled R2000, was a family of variants. One of those variants was described as a hypersonic glide vehicle. That class of system is normally associated with a small set of state militaries. The report presents it as an ambition written into prompts, not as a finished airframe.

The method is the part other labs will study. Operators ran several Claude instances at once and gave them roles. One wrote code. One did research. One reviewed the first instance's output. Humans assigned the tasks. Claude Code was used to draft guidance, navigation and control software, the stack that steers and stabilises a flying body. Safeguards blocked many of the requests. They did not block all of them. The effort lasted eight months before the ban.

Anthropic's report sits in a week when Houthi forces took Perim Island and the last government-held stretches of Yemen's Red Sea coast. The group already fields drones and ballistic missiles, with Iranian help, against Saudi targets, shipping and, at times, Israel. A cell that can farm language models for GNC code does not need to match a state design bureau. It needs to shorten the distance between a commercial board and a working seeker.

The company is careful with attribution. "Northern Yemen" and "threat actors" are the phrases in the document. Coverage in security trades and regional papers has filled in the Houthi label because of geography. That inference is reasonable and still unproven in public. What is proven, on Anthropic's account, is that someone in that territory treated a consumer and developer model as a substitute for scarce missile engineers, and that a failed rocket test was then fed back into the same chat.

The policy argument writes itself and should not be overdone. Export controls on physical components already exist. Prompt-level controls on dual-use software are newer and leakier. An eight-month window is long enough to learn which refusals can be walked around by splitting the job across instances. Other model makers now have a case study with dates, a range figure and a project name.

Anthropic says the disruption came as soon as the illegal use was clear. The report is also a product. Publishing it tells governments the firm is watching. It also tells every other cell how the watchers describe the pattern. Both effects are now in the record.