{
 "public_id": "AIR-2026-0237",
 "incident_id": "2026-09-anthropic-gtg-87001-yemen-guided-weapons-claude-code",
 "date_disclosed": "2026-09-10",
 "date_occurred": null,
 "title": "GTG-87001: a northern-Yemen weapons cell used orchestrated Claude Code instances in place of engineers to build missile guidance, navigation and control software, test-fired a guided rocket and returned to Claude for failure analysis",
 "class": "in_the_wild",
 "attack_surface": "coding_agent",
 "initial_vector": "policy_violating_use",
 "agent_capability_abused": [
  "code_generation",
  "firmware_build_pipeline_execution",
  "flight_simulation",
  "multi_instance_orchestration",
  "code_review",
  "failure_analysis"
 ],
 "target_product": "Claude Code",
 "target_vendor": "Anthropic",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "weapons_capability_uplift"
 ],
 "blast_radius": "three weapons programmes (guided rocket with terminal homing; multi-stage ballistic missile with >2,000 km goal; 'R2000' multi-variant missile incl. a hypersonic glide vehicle); one failed live rocket test; no evidence of a fielded device",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI10"
  ],
  "mitre_atlas": [],
  "labels": [
   "capability_uplift",
   "weapons_development",
   "safeguard_evasion",
   "task_splitting_across_sessions",
   "multi_agent_orchestration",
   "vendor_disclosure",
   "account_enforcement",
   "offline_toolkit_persistence"
  ]
 },
 "defense_present": "Anthropic usage-policy safeguards blocked many requests",
 "defense_bypassed": true,
 "fix_shipped": "accounts banned; threat information shared with public- and private-sector partners; Anthropic notes the actors had already built an offline simulation toolkit independent of Claude",
 "primary_sources": [
  "https://www.anthropic.com/threat-intelligence-report-september-2026",
  "https://www.aljazeera.com/news/2026/9/11/anthropic-claims-claude-ai-used-for-missile-projects-global-espionage",
  "https://incidentdatabase.ai/cite/1687",
  "https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf"
 ],
 "verified_quote": "The actors used Claude Code in place of human software engineers to develop the guidance, navigation, and control (GNC) software that steers and stabilizes a flying vehicle.",
 "confidence": "high",
 "notes": "From Anthropic's 'Detecting and countering misuse of AI: September 2026' report (10 Sep 2026; PDF pp. 112-115, also on the HTML report page). Activity window per AIID: Dec 2025 - Aug 2026, no event date given, hence date_occurred null. The agentic element is explicit: the actors ran several Claude Code instances at once with delegated roles (one writing code, one researching, one reviewing), and Claude executed firmware build pipelines and flight simulations; evasion was by hiding end-use and splitting work across sessions. impact_realized false: Anthropic has no evidence of an operational device, the one live test appears to have failed, and no third-party harm is documented - this is realized capability uplift to a weapons programme, not a realized consequence to a victim, and it is recorded as an unsuccessful in-the-wild misuse. FT and AP (11 Sep) linked northern Yemen to Houthi-controlled territory; Anthropic does not name the actors as Houthis. The same report documents many other agentic campaigns (ShinyHunters-associated Claude Code phishing workflows, an autonomous vulnerability-research programme, a Chinese municipal cyber-police Claude Code surveillance pipeline, memory-file-driven influence operations) that belong with the vendor-research records. AI Incident Database incident 1687. Deduped 2026-09-21 against a parallel draft (2026-09-anthropic-gtg-87001-yemen-guided-weapons) from the lab-disclosure sweep; this record was retained as the better-sourced version.",
 "risk_category": "safety_harm",
 "risk_secondary": [],
 "risk_subcategory": "Unclassified",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "human_acted_on_output",
 "agency_debatable": false,
 "agency_reason": "Claude Code produced guidance software; humans built and test-fired the weapon",
 "vector_family": "misuse",
 "vector_detail": "policy_violating_use",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1687
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI10",
 "agent_framework": "claude_code",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "vendor_disclosure",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "policy_drift",
 "eai_domain": "governance",
 "eai_secondary": [],
 "eai_reason": "vector default: misuse",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI10 (eai fallback: policy_drift)",
 "submitted_by": "EAI Internal"
}