How Houthis Used Claude AI for Missile Software

Iran-aligned Houthi-linked actors in Yemen used Anthropic‘s Claude AI to support software development for multiple missile programmes, including guidance and control systems for a guided rocket, according to a new threat-intelligence report from Anthropic.

The disclosure is one of the clearest indications yet that increasingly capable AI coding tools are being used in real-world weapons development efforts. Anthropic said the activity involved a weapons engineering cell in northern Yemen that operated across several missile programmes and used Claude Code to develop and troubleshoot software associated with guidance, navigation and control.

Anthropic did not publicly identify the group as the Houthis by name in the report. However, the location, military activity and description of the actors point to the Iran-aligned Houthi movement, which has built a substantial arsenal of missiles and drones in Yemen.

The company said it found no evidence that the actors successfully fielded an operational guided weapon. But it did identify a guided-rocket test that appears to have failed, after which the operators returned to Claude within hours to investigate the apparent failure.

The episode raises a larger security question: how much can advanced AI reduce the expertise, time and manpower traditionally required for complicated engineering work associated with weapons programmes?

Claude was used as part of a virtual engineering workflow

Anthropic’s report describes a workflow in which AI was used for substantially more than answering technical questions.

The Yemen-based cell reportedly used Claude Code to assist with guidance, navigation and control, or GNC, software. These systems are responsible for helping a flying vehicle determine its position, maintain stability and follow a desired flight path.

Anthropic said Claude was used for tasks including writing control and position-estimation software, integrating an open-source autopilot with a commercially available phone-class flight computer, adjusting software parameters, running firmware builds and conducting simulations.

The significance lies in the breadth of those activities. Instead of treating an AI assistant as a search engine or occasional coding helper, the operators reportedly used it across several stages of a technical development process.

Anthropic also observed multiple Claude instances being used at the same time. One could focus on writing software, another on research and another on reviewing the work produced by the first.

That multi-agent approach mirrors a broader shift in AI development, where models are increasingly used in semi-autonomous workflows rather than isolated question-and-answer sessions.

Three missile programmes were reportedly under development

Anthropic said the weapons cell was working on three separate programmes.

The first involved a guided rocket using a commercially available, phone-class flight computer and a final-stage homing system.

The second involved a multistage ballistic missile with a stated range goal of more than 2,000 kilometres.

The third was described as the “R2000” missile set, consisting of multiple variants, including one designed around a hypersonic glide vehicle.

The report does not establish that all three programmes reached an operational stage. In fact, Anthropic explicitly said it did not have evidence that the actors successfully deployed an operational guided weapon.

That distinction is important. Development activity, software assistance, testing and operational deployment are separate stages of a weapons programme. The report provides evidence of the first three in at least part of the activity, but not proof that an operational guided missile was successfully fielded.

The guided-rocket test appears to have failed

One of the most striking details in Anthropic’s account is what happened after a real-world test.

The actors apparently carried out a test launch involving the guided rocket. Anthropic said the test appears to have failed, and that within hours the operators returned to Claude to troubleshoot the problem.

This detail matters because it suggests that the AI was incorporated into an iterative engineering process rather than being used only during the planning stage.

In a conventional development cycle, a failed test can require engineers to analyse telemetry, inspect software and hardware interactions, identify likely faults and develop corrective changes. The Anthropic case indicates that an AI coding system was brought into that troubleshooting loop.

The report does not establish exactly what changes were made afterward or whether another successful test occurred. That limitation prevents the incident from being interpreted as evidence that Claude enabled a functioning guided missile programme.

But the fact that the system was used immediately after a failed physical test demonstrates why AI misuse concerns are shifting from hypothetical scenarios to real operational environments.

How the actors tried to evade Claude’s safety safeguards

Anthropic said its safeguards blocked many of the requests made by the actors, but the company acknowledged that the protections did not stop every attempt.

The threat actors reportedly used several techniques to conceal their intentions. These included hiding the true purpose of their work, disguising what the software would ultimately control and dividing activities across multiple sessions.

That fragmentation created a major challenge for safety systems. A single request might appear relatively benign when viewed in isolation. The broader malicious objective only became clearer when the separate interactions were analysed together.

Anthropic said the actors distributed their work across sessions so that no individual conversation necessarily exposed the full purpose of the activity.

This is particularly relevant for modern AI systems because the risk does not necessarily come from one explicit request for prohibited instructions. It can emerge from a long sequence of apparently ordinary programming, research and troubleshooting tasks.

Why Claude Code changes the nature of the risk

Claude Code is designed to help users with software development. Its capabilities allow an AI model to work across coding tasks, inspect files, modify programs and support longer technical workflows.

That makes it potentially much more powerful than a conventional chatbot when used by a skilled operator.

A general-purpose conversational model might provide an explanation of a programming concept. An AI coding agent can instead participate in an iterative workflow in which code is created, tested, revised and reviewed.

That difference is at the heart of Anthropic’s warning.

The company says misuse increasingly involves AI systems acting as components in larger automated or semi-automated operations. In cybersecurity, for example, models can assist across reconnaissance, code generation and evasion. In weapons engineering, they can potentially contribute to specialised software and analysis tasks.

The concern is therefore not that AI suddenly invents an entire weapon independently. The more immediate issue is that it can increase the productivity of human teams already working on sophisticated programmes.

AI does not replace the entire weapons engineering process

The Houthi-linked case should also not be interpreted as proof that an AI model can independently design and deploy a sophisticated missile.

Weapons programmes involve hardware engineering, materials Science, propulsion, sensors, manufacturing, testing, logistics and specialised operational knowledge. Software is only one component.

Even advanced AI systems remain dependent on physical equipment, engineering judgement and real-world testing.

Anthropic’s own findings underscore this limitation. Despite substantial AI assistance, the guided-rocket test reportedly failed.

That provides an important counterpoint to exaggerated claims about AI instantly transforming any group into a highly capable weapons manufacturer. The technology can lower barriers in particular technical tasks, but it does not eliminate the physical and organisational challenges of building reliable weapons.

The bigger concern is the lowering of expertise barriers

The more serious long-term concern is the possibility that AI makes specialised engineering knowledge easier to access and apply.

Missile guidance software can involve mathematics, control systems, sensor data, embedded programming and real-time computing. Traditionally, developing such systems would require teams with highly specialised backgrounds.

An increasingly capable AI system can potentially help less-experienced developers understand technical concepts, generate code, identify errors and move more quickly through an engineering workflow.

That does not remove the need for expert oversight, but it could reduce the amount of specialist labour required for some stages of development.

This is one reason security experts are closely watching the progress of AI coding agents. The same technologies that can accelerate legitimate software development can also make specialised forms of technical work more accessible to malicious actors.

The Yemen case is only one part of Anthropic’s broader warning

The Houthi-linked activity was one of several cases Anthropic identified in which its models were misused for conventional weapons development.

The company’s report described six such cases involving actors in Yemen, china and Russia. The weapons-related activity included missiles, firearms, armed drones, bombs and other munitions, as well as software associated with targeting and control systems.

This matters because it shows the Yemen case was not an isolated incident confined to one organisation or one conflict.

Anthropic said the examples represented some of the most sophisticated misuse it had observed. The company is using those incidents to examine where existing safeguards are effective and where they need to improve.

AI is also being used in cyber operations and surveillance

The threat-intelligence report describes a much broader misuse landscape beyond physical weapons.

Anthropic said Russia-linked actors used Claude in cyber-espionage operations involving phishing, malware and other intrusion techniques. The company also reported activity involving China-linked surveillance programmes and other efforts to exploit AI for intelligence operations.

In these cases, the same basic pattern appears: AI is increasingly being integrated into workflows rather than used only as a conversational assistant.

That shift matters for defenders because the amount of work that previously required several human specialists can potentially be divided among multiple AI agents working in parallel.

Anthropic said some malicious operators effectively used humans as supervisors while AI systems handled large parts of the operational workload.

Propaganda and influence operations add another dimension

The report also identified AI misuse for propaganda and influence-related activity involving actors in countries including Russia, Malaysia, Iran and Bangladesh.

AI-generated or AI-assisted content can reduce the cost of producing large quantities of messages, adapting material for different audiences and maintaining persistent influence operations.

This expands the safety challenge beyond physical harm. Advanced AI can affect information environments, political discourse and public trust at the same time that it becomes more capable in technical domains.

Anthropic also identified biological-risk cases

Among the company’s most serious concerns were examples involving biological research.

Anthropic said it identified five instances in which researchers used its AI models for scientific work that could potentially contribute to biological weapons development.

The company did not disclose the identities of the researchers, their institutions, countries or the specific biological agents involved. It said uncertainty about the users’ intentions was one reason for withholding those details.

The decision illustrates the difficulty of distinguishing legitimate advanced scientific research from activity that could become dangerous when placed in the wrong context.

As AI systems become more capable in biology, chemistry and engineering, safety controls have to account not only for explicit malicious instructions but also for combinations of individually legitimate tasks that could produce harmful capabilities.

Why the Anthropic report matters for AI safety

One of the report’s most important conclusions is that the threat landscape is evolving alongside AI capabilities.

Anthropic’s head of threat intelligence, Jacob Klein, said models had become more capable over the previous year and that tasks such as optimising drone systems or missile software were increasingly within their abilities.

That suggests a moving-target problem for AI safety.

A safeguard that was adequate when a model could only generate basic code may be insufficient once the same class of system can reason over large codebases, run iterative workflows and coordinate multiple subtasks.

Safety systems therefore cannot remain static. They need continuous evaluation against new models, new tools and new patterns of misuse.

The multi-agent problem could make future misuse harder to detect

The Yemen case provides an early example of why multi-agent AI could pose a new monitoring challenge.

One AI session might conduct research. Another might write code. A third might review the output. A fourth could help analyse test results.

Individually, each interaction may reveal only a small part of the overall objective.

For safety teams, understanding intent therefore increasingly requires looking at patterns of behaviour across sessions rather than relying solely on the contents of one prompt.

The problem becomes even more complicated when users deliberately compartmentalise their requests to evade detection.

AI safety is now a security issue, not just a software issue

For years, AI safety discussions focused heavily on hallucinations, bias, privacy and unreliable outputs. Those risks remain important, but the Anthropic report highlights another category: capability misuse by determined actors.

An AI model does not have to autonomously launch a missile to create a security problem. Helping a weapons team write specialised software faster, troubleshoot engineering failures or automate supporting tasks may already have strategic consequences.

The same principle applies to cyberattacks, surveillance and influence operations.

That is why governments, technology companies and security researchers are increasingly treating advanced AI as part of the broader national-security Environment.

What the failed missile test tells us

The failed guided-rocket test is arguably the most revealing part of the case because it demonstrates both the capability and the limitation of AI-assisted weapons development.

On one hand, the operators had reached a point where AI-generated or AI-assisted software was being incorporated into a physical weapons test. On the other, the test did not apparently produce a successful operational guided weapon, and the team had to return to the development environment to troubleshoot what went wrong.

This is a more realistic picture of AI’s near-term role. It can accelerate parts of an engineering process, but physics, hardware reliability, sensor performance and real-world testing continue to impose constraints.

That distinction should remain central to discussions about AI-enabled military threats.

The security challenge will become harder as models improve

Anthropic’s latest findings arrive as the capabilities of frontier AI systems continue to expand across coding, scientific research and complex multi-step tasks.

That progress creates enormous benefits for legitimate users, but it also changes the risk profile of open or broadly available AI systems.

Preventing misuse increasingly requires more than blocking a list of obviously dangerous questions. Developers need systems capable of recognising suspicious behaviour across many interactions, detecting attempts to conceal intent and responding when AI tools are embedded into broader automated workflows.

At the same time, overly broad restrictions could interfere with legitimate research in engineering, science and cybersecurity. Designing effective boundaries is therefore becoming a much harder technical and policy problem.

Anthropic says it disrupted the Yemen-linked activity

Anthropic said its internal investigation identified the suspicious activity, after which the company banned accounts associated with the actors and shared information with public- and private-sector partners.

The response demonstrates how AI companies are increasingly functioning as part of the security ecosystem rather than simply as software providers.

They are monitoring usage, investigating suspicious behaviour, coordinating with outside organisations and updating safeguards based on real-world incidents.

But the case also shows the limits of platform-level enforcement. Determined users can attempt to create new accounts, disguise their objectives or distribute their activity across services and sessions.

What this means for the future of AI and weapons development

The Houthi-linked Claude case is unlikely to be the last example of AI being used to support military engineering.

As AI models become better at coding, simulation, scientific research and technical problem-solving, they could become more useful to organisations that lack large teams of highly specialised engineers.

The most important question may therefore be whether AI lowers the barrier to entry for sophisticated weapons development faster than governments and technology companies can build effective safeguards.

The answer is not yet clear. Anthropic’s report provides evidence that misuse is already occurring, but it also shows that AI assistance does not automatically translate into successful weapons deployment.

The real warning from the Claude case

The most consequential aspect of the Yemen case is not that Claude supposedly built a missile. Anthropic did not report that, and it explicitly said it had no evidence that the actors successfully fielded an operational guided weapon.

The warning is that an AI coding agent was incorporated into a real weapons-development workflow, across software development, testing and troubleshooting, and that its safeguards were not sufficient to prevent every stage of that activity.

That represents a meaningful shift in the misuse landscape.

For the Houthis or any other armed group, access to powerful AI does not eliminate the need for engineering expertise, physical hardware or successful testing. But it can potentially make some specialised tasks faster, cheaper and easier to iterate.

For AI developers, that means the safety challenge is becoming increasingly dynamic. The same models that help legitimate engineers write software, scientists conduct research and companies build products can also be redirected toward military and criminal applications.

Anthropic’s investigation therefore offers a glimpse of a broader future in which AI capability and national-security risk become increasingly intertwined. How effectively companies can detect, stop and learn from these misuse attempts may prove just as important as how quickly they improve the models themselves.