Anthropic says it blocked AI use linked to biological weapons research

Artificial intelligence (AI) company Anthropic said it identified and disrupted five cases in which users attempted to use its Claude models for "malicious activity" that could potentially support the development of biological weapons.

The cases, detailed in Anthropic’s 'Detecting and countering misuse of AI: September 2026' report, included research into virus transmissibility and immune evasion, mammalian adaptation of highly pathogenic avian influenza, orthopoxvirus research, toxin optimisation and the computational redesign of toxins.

Anthropic banned the accounts linked to the cases and used information from its investigations to strengthen its safeguards. It also shared findings with government authorities and other AI companies where appropriate. The company said it was withholding the names of institutions, countries and specific biological techniques involved.

The report covers activity disrupted between December 2025 and August 2026 across seven areas, including cyber operations, influence operations, surveillance, conventional weapons, biological misuse and fraud.

Chikungunya research triggers safety block

One of the cases involved a request to use Claude to prepare a scientific grant application for gain-of-function research involving chikungunya virus. Anthropic’s biological safety classifier blocked the request in May 2026. The proposed work focused on increasing the virus’s transmissibility and ability to evade the immune system.The company said such research has legitimate scientific applications, including the development of vaccines and treatments. However, similar work could also make a pathogen more dangerous.

The proposed research was particularly concerning because it was linked to a military research institute, even though the grant application described the researchers as civilians. Anthropic subsequently found that an intermediary AI platform was being used to bypass regional restrictions and access Claude through US infrastructure.

The platform also had a fallback system that redirected prompts rejected by Claude to other AI models with more permissive safeguards.

Anthropic banned the associated accounts and worked with partners to take down the relay networks. However, the operator later restored access using fresh identities and continued to use reseller networks to reach AI models.

Bird flu research involved pandemic risks

In another case, a researcher outside the US used Claude for several weeks while planning research involving highly pathogenic avian influenza, commonly known as bird flu. The researcher exchanged thousands of messages with Claude and used the model for study planning, data analysis, experiment interpretation and writing.

Anthropic said the research involved genetic approaches linked to mammalian adaptation and airborne transmission, with experiments planned in animal models. The company said that the work appeared to be at an early research-planning stage. It also said the research was clearly dual use. Studying the genetic basis of dangerous viral traits can help scientists identify naturally emerging strains that could cause a pandemic. At the same time, the resulting knowledge could potentially be used to deliberately create such variants.

Anthropic said its safety classifiers prevented the researcher from accessing its more capable models. The work was instead carried out using weaker models, which meant Claude’s contribution was largely limited to areas such as data analysis and study design.

The company estimated that the AI provided only limited uplift and did not perform expert-level biology research in this case.

AI used to prepare orthopoxvirus grant

A third case involved a grant application for research into orthopoxviruses at a state-associated infectious disease laboratory. The application described work with live viruses and access to high-containment facilities. It focused on understanding genes involved in viral immune evasion.

Anthropic said the research could have legitimate scientific value because understanding how viruses evade immune responses can help researchers weaken them. However, the same knowledge could also be used to preserve or enhance those properties.

Unlike the first two cases, Claude’s classifier did not block the activity because the research was framed around attenuation, or reducing the disease-causing ability of a virus.

The account was operated through an anonymising reseller system and was serving more than a dozen customers. Anthropic said one customer used Claude’s Opus 5 model to prepare the grant application end to end in about an hour, including the research hypothesis, experimental design and statistical planning.

The company said this case highlighted the difficulty of identifying harmful intent when the underlying research has legitimate scientific applications.

Toxin research exposes limits of AI safeguards

The final two cases involved research into novel venoms and toxins. In one case, a researcher used Claude to create an atlas of venom-derived peptides and then developed a generative system to optimise their characteristics. The objective was to develop potential painkillers, antidepressants and other medicines.

However, the research covered both therapeutic and paralytic targets. Anthropic said this meant the resulting system could potentially be used to generate either useful medicines or harmful compounds.

The researcher was also part of a state-supported research programme, according to information shared with Claude. Anthropic banned the account in May 2026 for evading its regional restrictions.

In the fifth case, a researcher used Claude for several projects involving the computational redesign of toxins. The work was presented largely in a therapeutic context and was linked to a national public research programme.

The researcher also used Claude to co-write progress reports. Anthropic said the identities of the biological agents involved were deliberately kept vague in those reports, which it viewed as a sign of efforts to conceal the nature of the research. Both accounts were subsequently banned.

'Dual use' makes biological misuse difficult to detect

Anthropic said biological research is difficult to monitor because the same scientific knowledge can have both beneficial and harmful uses.

“The same information that can be used to develop a biological weapon could also be used to develop, for example, a vaccine or a cure for a disease,” the company said.

This overlap can allow sophisticated users to maintain “plausible deniability”, with individual requests appearing legitimate even when considered together.

Anthropic said its first two cases showed that its classifiers could block clearly high-risk biological research, but other cases highlighted the limits of relying only on automated systems. The company also reviewed 30 days of activity linked to institutions in adversarial states and identified about 35 research efforts. Most involved civilian scientific work, though some had dual-use potential.

Anthropic said these cases do not mean Claude is making biological threats imminent. Instead, they show that some advanced biological research programmes are seeking access to frontier AI models and, in some cases, trying to bypass safeguards. The company said safer access will require both strong filters for high-risk content and trusted-user programmes to verify researchers’ identities and the legitimacy of their work.