Anthropic Says Yemen Weapons Cell Used Claude Code to Develop Missile Guidance Software

Anthropic Reports AI-Assisted Missile Engineering in Yemen

Claude Code was used by a weapons development cell in northern Yemen to support guidance, navigation and control software for multiple missile programs, according to Anthropic’s September 2026 threat intelligence report.

The company identified the activity as GTG-87001, describing the group as a northern Yemen-based cell working on three weapons programs. Anthropic said the cases were among six conventional weapons investigations detailed in its report, alongside operations identified in China and Russia.

The report does not establish that the Yemen-based actors were formally part of the Houthi movement. The location and the nature of the weapons work place the activity in territory associated with the broader Yemen missile and drone threat environment, but attribution should remain separate from geographic association.

Anthropic said the investigation covered activity disrupted between December 2025 and August 2026. The company said it banned accounts connected to the actors and shared relevant information with public and private sector partners.

Three Missile Programs Were Under Development

According to Anthropic, the cell was pursuing three related weapons development efforts.

Anthropic emphasized that its visibility into the overall weapons programs was limited. The company therefore distinguishes between software development activity it observed and the actual maturity or performance of the weapons themselves.

That distinction is important. A stated range objective is not evidence that a missile achieved that range, while the presence of simulation software does not establish that a corresponding missile became operational.

Anthropic said it found no evidence that the actors successfully fielded an operational weapon. It did, however, identify evidence of a live guided-rocket test in Yemen.

Claude Code Was Used as a Distributed Engineering Tool

The most significant element of the case is not simply that the actors asked an AI model technical questions.

Anthropic says the operators used Claude Code in place of human software engineers for portions of the guidance, navigation and control workload. They ran multiple Claude instances at the same time and assigned different functions to each instance.

One instance handled coding, another conducted research, and another reviewed the resulting code. The arrangement effectively divided software engineering work into separate AI-assisted workstreams.

Anthropic said the actors also used Claude for software associated with flight control and position estimation, simulation and other elements of the development process.

For security reasons, the broader significance is better understood at the workflow level rather than through reproducing the technical instructions involved.

The case demonstrates how an AI coding agent can become part of a larger engineering process rather than remaining a conventional question-and-answer tool.

Anthropic has separately described Claude Code as an agentic system capable of searching code, editing files, running tests and using command-line tools. That capability is useful for legitimate software development, but it also increases the potential consequences when an operator applies it to prohibited weapons work.

The Guided-Rocket Test Provides the Clearest Real-World Evidence

Anthropic’s most concrete evidence of physical weapons activity was a guided-rocket test conducted in Yemen.

The company said the test appeared to fail. Within hours, the operators returned to Claude and used the system to help analyze what had gone wrong based on information from the test.

That sequence matters because it links AI-assisted software development to an actual hardware test cycle.

In conventional weapons engineering, development normally moves through requirements, design, modeling, software development, hardware integration, testing and post-test analysis. Anthropic’s description indicates that the Yemen cell used Claude across several parts of that broader development loop.

The report’s own technical assessment maps the activity across requirements decomposition, integration and testing, although Anthropic cautions that its visibility into the complete program was limited.

The evidence therefore does not establish that Claude independently designed or built a missile. Instead, it shows human operators using an AI coding system as an engineering resource while they already possessed access to relevant hardware and technical infrastructure.

The Offline Toolkit May Be More Important Than the Account Bans

Anthropic’s investigation also uncovered a limitation in account-level enforcement.

The company said the actors had already compiled an offline simulation toolkit that could operate without Claude and without engineering environments such as MATLAB.

That creates a significant security distinction.

Banning an account can stop an actor from accessing a commercial AI service, but it cannot necessarily remove software, knowledge or engineering artifacts that have already been produced.

The report specifically identifies the packaging of the simulation environment into a standalone executable as one of the most serious elements of the operation.

For AI providers, this means misuse controls cannot rely solely on blocking individual prompts or accounts. Once an AI system has helped generate reusable engineering tools, the resulting capability can persist outside the provider’s infrastructure.

Safeguards Blocked Some Requests, But Not the Entire Workflow

Anthropic said its safeguards blocked many requests from the Yemen cell.

The operators nevertheless found ways around those controls. According to the company, they concealed their objectives and the weapons systems for which the software was intended, while dividing their activity across multiple sessions so that individual sessions did not necessarily expose the full context.

This is an important feature of the case.

A safety system may identify an explicit request to develop a weapon while failing to recognize a series of individually ambiguous requests that collectively form part of the same development program.

Anthropic said the six conventional weapons cases in its report showed a broader pattern in which actors split their work across sessions and used other methods to circumvent safeguards and access controls.

The company said it has subsequently introduced new classifiers intended to identify and block activity associated with high-yield explosives and weapons development.

What the Case Says About AI and Missile Development

The Yemen case does not demonstrate that AI has eliminated the need for conventional weapons engineers.

Missile development still depends on physical hardware, propulsion, materials, sensors, manufacturing, testing infrastructure and specialist engineering knowledge. Software is only one part of the overall system.

The significance lies instead in the potential reduction of the software labor burden.

Guidance and control software is traditionally developed through specialized engineering teams that combine knowledge of control theory, embedded computing, navigation, sensor processing, simulation and testing. An agentic coding system can potentially compress parts of that workflow by generating code, reviewing it, running simulations and iterating rapidly.

That does not guarantee a working weapon. The apparent failure of the Yemen test is itself a reminder that generated software does not remove the difficulty of integrating software with real-world hardware.

But the episode demonstrates a potentially important shift in the economics of technical work. A small group with access to hardware can use an AI coding system to perform portions of a workload that previously required more specialized personnel.

Anthropic’s own report describes this as an uplift in weapons development rather than evidence that AI independently created a complete weapons system.

The Yemen Case Is Part of a Wider Pattern

Anthropic identified six conventional weapons cases in its September report: three involving China, two involving Russia and one involving Yemen.

The cases cover several different applications.

In one China-based case, an actor used Claude to develop material related to an anti-torpedo weapons system. Another China-based actor used Claude to develop targeting software associated with electronic warfare and suppression of air defenses.

Anthropic also described a Russia-based effort involving autonomous military drone swarm software. The company said the actors progressed far enough to load software onto real development hardware and conduct hardware-in-the-loop testing.

Two additional cases involved procurement and intelligence rather than direct weapons software development.

This broader pattern matters because it suggests that AI misuse is not confined to one weapon category or one type of actor.

The report spans missile guidance, autonomous drones, electronic warfare, undersea warfare, procurement and defense intelligence. The common element is the use of AI to accelerate specialized work that already forms part of established military development processes.

Implications for U.S. Defense and AI Security

For the U.S. defense establishment, the report highlights a security problem that extends beyond conventional export controls and battlefield intelligence.

AI providers now occupy a position in the technical supply chain. Their models can assist with software development, research, simulation and analysis even when they have no direct connection to a weapons manufacturer or military organization.

That creates a new monitoring challenge.

Traditional counterproliferation efforts often focus on physical components, financial transactions, manufacturing equipment and technical personnel. AI-assisted development adds a software layer that can be accessed remotely and potentially reused after access to the original service is terminated.

The distinction between a model and the tools produced with its assistance is therefore becoming increasingly important.

A provider can disable an account, but it cannot necessarily retrieve code, simulation environments or engineering artifacts that have already been exported.

The Yemen case also shows why contextual detection matters. Anthropic said the operators intentionally separated requests across sessions to make their overall objective harder to detect.

For AI security teams, the challenge is consequently moving from identifying individual prohibited prompts toward identifying patterns of behavior across accounts, sessions and workflows.

No Evidence of an Operational AI-Enabled Missile

Anthropic’s findings should not be interpreted as evidence that an operational AI-designed ballistic missile or hypersonic weapon now exists in Yemen.

The company explicitly said it had no evidence that the actors successfully fielded an operational device. The only physical test identified in the report was a guided rocket test that appeared to fail.

The report also does not establish that the weapons cell was formally controlled by the Houthis.

What it does establish is more specific: Anthropic identified a weapons development cell in northern Yemen, observed its use of Claude for guidance and simulation work, identified a live guided-rocket test, detected efforts to evade safeguards, banned linked accounts and found evidence that the actors had created an offline simulation capability.

That distinction is essential for assessing the actual threat.

The immediate concern is not that AI has independently produced a fielded missile. It is that increasingly capable AI coding systems can become part of weapons engineering workflows and potentially reduce the amount of specialized human labor required for portions of development.

For defense organizations and AI providers, that changes the counterproliferation problem from simply controlling access to information toward controlling how increasingly capable AI systems can be integrated into real-world engineering workflows.

Bottom Line

Anthropic’s Yemen investigation provides one of the clearest reported examples to date of an AI coding agent being incorporated into an actual conventional weapons development cycle.

The cell used multiple Claude instances for different engineering functions, worked across several missile programs, conducted a guided-rocket test and returned to the AI system for post-test analysis. Anthropic says the test appeared to fail and that there is no evidence the group fielded an operational weapon.

The more consequential finding may be that the operators had already built an offline simulation toolkit before Anthropic shut down their accounts.

That illustrates the central security challenge posed by agentic AI in weapons development: stopping access to the model can disrupt an operation, but it may not erase the capabilities, software or engineering knowledge that the users have already extracted.

As AI coding systems become more capable, monitoring that transition from individual assistance to persistent engineering capability is likely to become an increasingly important part of AI security and conventional weapons counterproliferation.