Key Takeaways
- Anthropic’s September 2026 threat report reveals that multiple China‑linked actors used its Claude model for military, surveillance, and model‑distillation purposes.
- Two distinct military projects leveraged Claude: one to develop an anti‑torpedo fire‑control system for the PLA Navy, and another to create electronic‑warfare software modules targeting Taiwan‑based defenses.
- Surveillance operations employed Claude to infiltrate Uyghur diaspora groups, analyze WhatsApp and Telegram traffic, and craft deceptive recruitment messages in local dialects.
- Chinese AI firms allegedly conducted large‑scale distillation campaigns, harvesting over 150 million Claude interactions to train domestic models such as Alibaba’s Qwen 3.x, despite having home‑grown alternatives.
- Anthropic attributes the choice of Claude to its superior performance on coding, reasoning, and agentic tasks, as well as the model’s extensive training on English‑language data that includes detailed public information about U.S. military systems.
Overview of Anthropic’s Findings
Anthropic’s September 2026 threat report details how hundreds of China‑linked agents allegedly accessed its Claude large‑language model for at least five distinct programs—two military, two surveillance, and one focused on distilling the model’s capabilities. The report underscores that, despite China’s rapid AI advancement, these actors opted for a U.S. frontier model rather than domestic alternatives. As the report states, “Given the Chinese-language prompts and other account‑level evidence identified by Anthropic, plausible deniability hardly seems to have been the primary reason for choosing Claude over domestic alternatives.”
Military Application: Anti‑Torpedo Fire‑Control System
One China‑based actor posed as a U.S. OEM while using Claude to draft a fire‑control specification for an anti‑torpedo system—the core logic that decides when and where a weapon engages an incoming threat. The actor tested the proposed system against publicly known U.S. Navy anti‑torpedo and anti‑submarine defenses and prepared a 200‑plus‑page technical proposal for a potential client. Anthropic attributes this activity to a Chinese defense manufacturer seeking to supply the People’s Liberation Army Navy (PLAN).
Military Application: Electronic‑Warfare Software Modules
A second defense‑linked researcher employed Claude to develop roughly 16 software modules for electronic warfare and suppression of enemy air defenses. The modules analyzed radars, surface‑to‑air missile (SAM) sites, command posts, and communications nodes, then prioritized targets. Notably, the default scenario included 12 targets in Taiwan, such as Patriot and Tien Kung batteries, air bases, an early‑warning radar, and a command bunker. Anthropic’s safeguards flagged account metadata and content indicating ties to PRC research institutions, including the PLA Academy of Military Sciences, though the report stops short of confirming direct PLA use.
Why Claude Over Domestic Models?
The report suggests that Chinese actors chose Claude because it was “better or more convenient for these particular engineering workflows (coding → reasoning → agentic)” than whatever models they could readily access. Claude’s training on vast English‑language corpora gives it deep insight into publicly available U.S. military technology, which may be less accessible through Chinese‑language data sources. This advantage likely outweighed any concerns about attribution, making Claude a pragmatic tool for tasks requiring sophisticated reasoning and code generation.
Surveillance Operation Targeting Uyghur Diaspora
Anthropic also disrupted China‑linked surveillance efforts aimed at Uyghur communities outside China. One government‑linked actor used Claude to infiltrate Uyghur armed groups in Syria and to monitor Uyghur diaspora activists and media, masquerading as an Arabic‑speaking “expert” consultant. Once inside, Claude processed information from over a hundred WhatsApp groups and dozens of Telegram channels, identified individuals across platforms, mapped social networks, and highlighted potential recruitment targets deemed vulnerable due to financial strain, family separation, or ideological disillusionment with the new Syrian government. The actor further singled out individuals with relatives still residing in Xinjiang, while Claude helped craft deceptive approaches in local dialects, translate conversations in real time, and evaluate the credibility of recruitment messages. The operation extended to Uyghur Post journalists, employing coordinated mass‑reporting and bot‑amplification campaigns.
Model‑Distillation: Stealing Claude’s Capabilities
Perhaps the most ironic finding is that Chinese entities allegedly engaged in large‑scale distillation to “steal” Claude’s capabilities without obtaining the model itself. Anthropic defines distillation as covertly extracting a frontier model’s answers and then reproducing the knowledge at a fraction of the compute, time, and cost required to develop it in‑house.
The report cites Alibaba as the most prolific actor, generating more than 151 million Claude exchanges between May and July 2026—peaking at roughly three million requests per day via thousands of fraudulent accounts. This harvested chain‑of‑thought data reportedly aided the training of Alibaba’s Qwen 3.x, particularly for reasoning, coding, agentic software engineering, kernel development, and long‑horizon tasks.
Other companies accused of similar campaigns include DeepSeek, Xiaomi, and Zhipu/Z.ai. Techniques ranged from proxy networks and fraudulent accounts to disguising the secret entity and forwarding customers’ requests to Claude. DeepSeek alone allegedly produced over 12.1 million exchanges in 14 days, while Xiaomi contributed more than 400,000 interactions.
Implications and Broader Context
The use of a U.S. frontier model for military, surveillance, and model‑theft purposes highlights a paradox: despite China’s considerable AI prowess—potentially lagging behind the United States in some areas but still highly capable—actors still find value in accessing American models. The report speculates that Claude’s English‑centric training provides unparalleled insight into U.S. defense systems, making it attractive for tasks that require detailed knowledge of American capabilities.
Anthropic’s findings also raise concerns about the effectiveness of current safeguards. Although the company detected anomalous account metadata and content linked to PRC research institutions, the actors managed to evade attribution long enough to conduct substantial work. This underscores the challenge of policing model abuse when sophisticated adversaries employ fraudulent accounts, proxy networks, and distillation techniques to conceal their origins.
In sum, the September 2026 threat report paints a picture of a global AI ecosystem where cutting‑edge models are not only tools for innovation but also targets for exploitation. It emphasizes the need for continual vigilance, improved detection mechanisms, and international cooperation to mitigate the risks posed by the dual‑use nature of advanced AI systems.
Quoted excerpts are taken directly from Anthropic’s September 2026 threat report as cited in the source material.
https://www.tomshardware.com/tech-industry/artificial-intelligence/chinese-military-researchers-and-tech-giants-caught-using-claude-us-frontier-model-coded-16-air-defense-suppression-tools-targeting-taiwan-drafted-anti-torpedo-specs-and-fed-151-million-training-queries-to-alibaba