Anthropic’s latest threat intelligence report says a person linked to China’s defense and military-industrial research system used Claude’s chat, coding, and AI agent tools to build an electronic warfare and air-defense suppression software package with about 16 modules. During development, the user changed the system’s default simulation scenario to Taiwan and included 12 targets such as command bunkers, early-warning radar stations, Patriot and Sky Bow missile sites, major air bases, and regional operational command centers. Anthropic said the account has been banned and the investigation has been incorporated into new safety protections.
GTG-17002 centered on electronic warfare and SEAD software
Anthropic labeled the operation GTG-17002. According to the report, the China-based actor used Claude across the stack, starting with low-level computational logic, radar detection and jamming models, then moving into vulnerability analysis modules, Chinese-language target cueing, and user interface work. The full system was pushed to a 12th version.
The software was described as more than a military information organizer. Anthropic said it was intended to take part in decision-making for electronic warfare and suppression of enemy air defenses, or SEAD. The system could ingest data on hostile radar, surface-to-air missile positions, command posts, and communications nodes, calculate radar coverage, assess jamming effects, rank targets by value and weakness, and determine which facilities should be suppressed first.
It could also plan multi-day operational scenarios, assign sorties for jamming aircraft to different targets, and simulate engagement ranges for air-defense systems including Patriot and Terminal High Altitude Area Defense, or THAAD. In Anthropic’s account, Claude’s role extended beyond drafting military documents and into analysis, prioritization, and mission assignment within a joint targeting cycle.
The report said the actor was also running a self-hosted AI model on an internal network and integrated it with Claude and the electronic warfare software. That means some functions could remain on a local system even if outside model access were cut off.
The default simulation scenario was shifted to Taiwan
Anthropic said the most sensitive part of the case came when the user changed the software’s default simulation setting to 12 targets inside Taiwan during development. The target categories listed in the report include Taiwanese command bunkers, early-warning radar sites, Patriot and Sky Bow air-defense missile positions, major air bases, and regional operational command centers.
The software’s stated use was to calculate detection coverage for those facilities, evaluate the effectiveness of electronic interference, and decide which targets should be suppressed first and how jamming-aircraft missions should be assigned.
Anthropic also drew a limit around what the evidence shows. It said the charts in the report reflect how often particular weapons systems were mentioned in conversation data, which can indicate research focus but cannot directly prove the actor successfully acquired those capabilities. The report does not say that any Taiwan facility was actually attacked as a result.
Based on account-level data, prompt content, and security-system flags, Anthropic assessed that the person was likely a Chinese defense and military-industrial researcher with links to Chinese research institutions, including the Chinese People’s Liberation Army Academy of Military Science.
Other China-linked cases involved anti-torpedo systems and directed-energy intelligence
GTG-17002 was not the only case in the report tied to China’s defense sector.
In GTG-17001, a Chinese actor used Claude to advance an anti-torpedo weapons system project. Anthropic said the user drafted Chinese-language fire-control system specifications, generated more than 200 pages of technical proposals and presentation materials, and compared U.S. Navy anti-torpedo and anti-submarine programs using public information. The user also asked Claude to act as a hostile reviewer, repeatedly identifying weaknesses in the proposal so later drafts could be revised.
Anthropic said that person may have been linked to a Chinese military manufacturer seeking to submit a procurement proposal to the People’s Liberation Army Navy, though the company said it could not attribute the activity to a specific business or individual.
Another case, GTG-17003, involved directed-energy weapons intelligence. A Chinese actor who described himself as a defense intelligence writer and editor of an internal publication used Claude to investigate foreign high-power microwave weapons, component supply chains, and company ownership structures. The stated aim was to identify specific equipment and suppliers for reverse-engineering, countermeasure development, and comparison with existing Chinese systems.
The same user also used Claude to compile Chinese-language reports for senior internal circulation. One document on foreign military high-power microwave programs ran 23 pages, with about 45 pages of attachments and a tracking list covering the next year. Anthropic said the collection pattern showed a high degree of organization and professional tradecraft.
The report also described surveillance targeting Taiwanese religious groups and political figures
Beyond military research, the report outlined several monitoring campaigns that Anthropic said aligned with work associated with Chinese security, united front, and propaganda systems.
GTG-14020 focused on senior Catholic figures in Asia, the Presbyterian Church in Taiwan, Tibetan Buddhist groups, Falun Gong members, and overseas Chinese communities. Anthropic said the user asked Claude to prepare background research files, lead reports, and daily situation summaries, collecting birth data, migration timelines, social media accounts, and negative information on named individuals, while looking for leverage points that could be used for pressure or exploitation.
GTG-14021 involved what the report described as “stability maintenance” work connected to local public security and state security systems in China. Claude was used in public-opinion monitoring workflows, government surveillance database queries, and report generation on petitioners, rights advocates, Hong Kong democracy activists, overseas dissidents, and human rights organizations. Some requests included advance intelligence on overseas demonstrations, such as assembly locations, marching routes, and endpoints.
GTG-14022 pushed the work toward an almost automated public-opinion system. Anthropic said it processed about 15 to more than 30 pieces of foreign news and social content per day, monitored Taiwanese political figures, labor and student movements, ethnic minorities, religious groups, and overseas dissidents, scored them by political sensitivity, and rewrote the material into internal briefings for Chinese officials.
Anthropic said the accounts were banned, but safeguards did not stop every attempt
Anthropic said it has banned the accounts tied to the cases above. It also acknowledged that its safety systems did not block every request. Some prompts were initially refused by Claude, but the users obtained results after reframing them. In other cases, activity spread across multiple conversations without triggering an immediate intervention.
Other cases in the report covered Russia, Yemen, Iran, and additional misuse
The report also recorded activity outside the China-linked cases. Anthropic said a Russian team used Claude to develop drone swarms capable of choosing targets autonomously and issuing detonation commands. A Yemen-based team used multiple Claude instances in parallel to work on guided rocket and missile control software. Russian procurement personnel were said to have used intermediaries in China and Hong Kong to look for dual-use equipment in an attempt to bypass European trade controls.
Anthropic also documented cases involving political campaigning in Kenya, Iran-linked influence operations, cybercrime, and misuse tied to biological research.