Anthropic says it caught spies, hackers, and a would-be bioweapons author using Claude

Anthropic, the maker of the Claude chatbot, says its systems blocked a request in which Claude was asked to help draft a grant application for gain-of-function research on chikungunya, a mosquito-borne virus that causes fever and joint pain. Gain-of-function is laboratory work that makes a pathogen more transmissible, more virulent, or better at evading immune defenses. The request, Anthropic says, named transmissibility and immune evasion as the explicit goals.

The disclosure arrived Thursday in Anthropic's third threat report since the series began in March 2025. A day earlier, an unnamed in-house safety researcher publicly resigned, citing concerns that Anthropic and its peers are not acting responsibly as AI capabilities scale. The two events landed within 24 hours of each other, and the proximity is part of why the report reads as more than a routine corporate blog post.

The chikungunya case sits inside a broader catalog the report covers for December 2025 through August 2026. Anthropic says it also caught spyware vendors attempting to use Claude for surveillance workflows, politically motivated individuals seeking persuasion tooling, and state-sponsored propaganda operations. The company does not name the actors in most cases. The bar, the company argues, has dropped. "Elaborate cyberattacks no longer require sophisticated skills and even lone individuals can create threats that would not have been possible even a year ago," the report says, in wording the AP wire reproduced.

The blocked chikungunya request is biological-weapons-adjacent rather than a finished weapon, but it is the kind of task that once required a trained specialist and a wet lab. Anthropic says it added stronger safeguards in its most recent models to restrict dual-use biological research, meaning work that has both civilian and harmful applications. The report does not say whether the safeguards tripped on this specific request or whether a human reviewer caught it during an audit, which is itself a tell: the company is reporting the catch, not the mechanic.

The resignation is the harder signal. The researcher did not go public with a statement the wire captured, and the reason given echoes a concern common in the AI safety community: that voluntary disclosure plus model-level guardrails is not a substitute for external rule-making. Anthropic is also planning an initial public offering this fall, which puts a public-company reporting clock on the kind of openness the threat report represents. The cadence of three reports in roughly 18 months gives the series its own track record to measure against.

The next test is whether the report series changes shape. The current report bundles cyber, surveillance, and biological-weapons-adjacent work into a single disclosure. A fourth report, if the cadence holds, would land in roughly six months. The question worth holding is whether model-level catching keeps up with a misuse frontier that, by Anthropic's own account, is moving toward lone actors and dual-use biology.