Anthropic blocked two AI abuses. The pattern matters more than the headline.

An Anthropic report brought together two stories that, read separately, seem to belong to different worlds.

On one hand, people used Claude in biological research activities that could support the development of biological weapons. On the other, Anthropic says it dismantled an influence operation linked with high confidence to officials of the United Arab Emirates, focused on Sudan, the Muslim Brotherhood, and UN accountability mechanisms.

The temptation is to turn both stories into a fear-driven headline: "AI already builds weapons and manipulates governments." That would be inaccurate.

The serious reading is more uncomfortable: the objectives, doctrines, and decisions were still human. AI reduced the time, cost, and number of people needed to execute parts of those plans.

What Anthropic confirmed and what it didn't

The report covers activity detected and blocked between December 2025 and August 2026. Anthropic identified cases in seven areas, including cyber operations, surveillance, fraud, conventional weapons, influence, and biology.

This table looks like an editorial precaution. In reality, it completely changes the story.

Saying "Anthropic blocked biological weapons" suggests that a ready-to-use artifact was thwarted. The report does not support that. The company speaks of research that could support weapons development. That is a big and necessary difference.

Saying "UAE manipulated the UN" also erases the nuance. Anthropic documented materials drafted to be presented before the Human Rights Council and dossiers against rapporteurs critical of Emirati conduct in Sudan. At the same time, it acknowledges that it could not verify whether the materials reached their intended audience or whether they changed a policy.

The biological case: the dual-use problem

Anthropic described five cases. They include requests and work related to research on pathogens, toxins, and compounds that can serve both medical and harmful purposes.

That point is central. Biology doesn't come with a clear label of "beneficial" or "malicious."

A technique can help study a virus, design a therapy, or understand a protein. The same capability can also lower barriers to making an agent more dangerous. Intent is sometimes hidden, split among people, or mixed into seemingly academic requests.

The company explains that it blocked associated accounts, reinforced its controls, and shared information with partners and authorities when appropriate. It also withheld institutions, countries, and specific actors. It says it is not accusing the scientists of harmful intent and that revealing those details could expose them.

The confirmed conclusion is limited, but important: actors with interests in sensitive research tried to evade regional controls, use intermediaries, and seek less restrictive models when Claude refused to respond.

That demonstrates an operational reality: an isolated filter is not enough. When a platform blocks a request, the actor can try another account, a reseller, another provider, or a model with fewer barriers.

The Sudan case: propaganda turned into process

The second case is more concrete in operational terms.

Anthropic claims that an actor used Claude to sustain an organized campaign against the Muslim Brotherhood, the conflict in Sudan, and UN accountability mechanisms. According to the report, the actor created and managed about 300 accounts with an independent appearance, impersonated a real Swiss organization, and published human rights reports prepared from a state perspective.

It also allegedly used the tool to draft testimonies intended for two people at the 62nd session of the UN Human Rights Council. The documents were designed not to mention the United Arab Emirates. In parallel, the campaign built profiles of 18 MEPs and journalists, as well as dossiers against special rapporteurs who had criticized Emirati conduct in Sudan.

Anthropic links the activity with high confidence to UAE officials and states that internal files mentioned senior officials as recipients of the work.

It is a relevant attribution. It also deserves the right language: it is the assessment of a company that observed the use of its product and its accounts, not a judicial ruling or a public investigation concluded by an international body.

The company classified the campaign as category three on its own propagation scale: activity across multiple platforms. It did not elevate it to the categories that would require evidence of broad public attention or policy impact. That limit is rare to see in corporate communication and should be preserved.

The same mechanism behind both cases

We shouldn't lump biology and propaganda into the same moral category. Their harms, potential victims, and forms of response are different.

What they share is the mechanism of scale.

An influence operation no longer requires a large team to produce versions of the same message, translate them, tailor them by audience, draft formal documents, and coordinate accounts. A single operator can take a predefined doctrine into many formats.

In sensitive research, AI can organize information, draft proposals, summarize literature, plan experiments, or help communicate results. The capabilities that accelerate legitimate science can also serve dangerous projects.

AI didn't choose Sudan or the biological targets. It didn't define the doctrine or approve a budget. Its role was to lower the friction between a human order and many executed tasks.

That's the part technical teams and governments need to understand: risk doesn't require full autonomy. It's enough for a tool to turn specialized, slow work into a repeatable sequence.

What defense actually works

Content blocks are necessary. Anthropic maintains that its classifiers performed better in high-risk categories they had been designed to detect. But it acknowledges that a classifier can't always distinguish between legitimate medical research and work with harmful potential.

The response needs layers:

• Strict filters for higher-risk requests.
• Enhanced verification for access to advanced scientific capabilities.
• Account and institution signals to detect evasions and intermediary networks.
• Retention of enough information to investigate abuse, with clear privacy and due process rules.
• Sharing of indicators among providers, platforms, and competent authorities.
• External auditing to review what was blocked, what failed, and what impact each measure had.

The last point matters especially. AI companies have an observation window that governments, journalists, and civil society don't have: they see attempts before they turn into a publication, a file, or an operation.

That can be useful for defending society. It also concentrates a lot of power. That's why verifiable transparency and independent oversight can't depend solely on the goodwill of the company writing the report.

What I take away

The two cases reported by Anthropic don't prove that AI created a biological weapon or that it altered a UN decision.

They do document something serious: people tried to use a commercial model for dual-use activities and for a complex influence operation. They also show that defense depends on detecting the full context, not just a dangerous phrase typed into a chat window.

A mature discussion about AI safety doesn't need to invent intentions in machines. It needs to look at who sets the objectives, what capabilities are automated, what controls can be evaded, and who verifies those who promise to stop abuse.

Sources: Anthropic threat intelligence report, AP coverage of the possible biological use cases and AP report on the external networks fueling the war in Sudan.