Anthropic blocks use of Claude in research that could become a biological weapon

Anthropic published this week its third report on AI misuse since March 2025, and the case that drew the most attention involves research that could lead to biological weapons. According to the AP report published by ET Tech, the company says it blocked attempts to use its Claude models for cyberattacks, surveillance, and dual-use biological research.

The point that matters to those who build software isn't the superintelligence alarm the press usually highlights, but the mechanism: what a model maker actually does when it detects someone trying to use its API for something dangerous, and how that translates into rules affecting any legitimate call made by those who work with these models.

The concrete case: the blocked request

Between December 2025 and August 2026, Anthropic researchers identified misuse ranging from spyware vendors and "politically motivated individuals" to state-sponsored groups spreading propaganda. The report's most specific example is the blocking of a request for Claude to help draft a scientific funding proposal.

The work described in the proposal involved gain-of-function research (that is, research that genetically alters an organism to create a new or enhanced biological property) on the chikungunya virus. This gain-of-function research targeted the virus's transmissibility and immune evasion properties.

>

-- Anthropic misuse report

Chikungunya is a mosquito-borne virus that causes intense pain and fever, a well-known problem in Brazil. Anthropic itself acknowledges the ambiguity: this type of research "certainly" can be used to develop better vaccines and treatments, but "it can also be used to make the pathogen more dangerous." That is exactly the definition of dual use, and it's what makes the decision to block difficult to automate.

Why older models passed and newer ones don't

The report's most relevant technical detail is the shifting bar as models gain capability. Anthropic says its older models, such as Claude Opus 4 and Claude Sonnet 4.5 from 2025, were "well below the threshold where they could meaningfully help a sophisticated user carry out dangerous biological research."

At that time, safeguards were less strict, focused mainly on preventing novices from recreating known biological weapons. With current models, capable of assisting with a range of complex scientific tasks, the company says "the evidence is no longer certain" and that it can no longer offer the same guarantee.

The practical consequence: on the most recent models, such as Claude Fable 5, Anthropic applied "stronger safeguards that restrict access to a wide range of dual-use biological research queries." None of the report's cases used the newer, more powerful models (Fable and Mythos), with one exception: an "industrial-scale" campaign to extract and replicate a model's capabilities without authorization, a case of illicit distillation.

| Model generation | Described safeguard posture | |---|---| | Opus 4 / Sonnet 4.5 (2025) | Restriction focused on preventing novices from recreating known weapons | | Fable 5 and similar (current) | Broad restriction on dual-use biological queries |

What this changes for devs working with models

If you integrate the Claude API, or any large provider's API, this report is a portrait of the process that decides what your application can and can't do. Some concrete points to keep in mind:

• Safeguards are versioned along with the model. Switching from an older model to a newer one can change refusal behavior in sensitive domains, even if your prompt stays the same. Anyone with applications in areas like biotechnology, health, chemistry, or security needs to test for refusals when upgrading versions, not just response quality.
• Dual use isn't just "malicious request." The funding proposal case shows the line is blurred: a legitimate prompt from an academic researcher can fall into the same blocking range as a bad actor's. Legitimate scientific applications can run into false positives.
• The provider monitors and reports. Anthropic says it has shared information with government authorities and industry partners. For anyone sending sensitive data via API, it's worth understanding each provider's retention and monitoring policy.
• Detection before publication. The company points to an advantage of sitting at the generation layer: regarding influence operations, it states that "we can see it in Claude while the operation is still being assembled," before any post goes live. Nine cases were described, originating in Russia, Iran, Turkey, and regions across the Persian Gulf, South Asia, Africa, and Europe.

The underlying debate: who defines what is safe

Anthropic is explicit in saying it cannot claim its models cause no harm. The company frames the publication as a disclosure responsibility: "As models become more capable, their risks increase, unless AI developers and society's advocates act to make them safer."

But the report lays bare a governance question with no technical answer. John Thickstun, an assistant professor of computer science at Cornell quoted by AP, sums up the discomfort: it's an uncomfortable position for companies like Anthropic and OpenAI to be the ones determining what counts as safe and unsafe behavior, making "value judgments at a societal scale without any kind of democratic or deliberative oversight."

The context reinforces the mood: the report came out two days after an Anthropic researcher, Jacob Coxon, announced his departure, alleging that the company and rival OpenAI "are racing straight toward self-improving superintelligence and gambling with our lives." Anthropic, which plans to go public this fall, responded that it blocked every malicious activity identified and used the experience to strengthen safeguards.

What remains open

For the Brazilian developer, the practical takeaway is that models' security layer isn't static or transparent: it's defined by each maker, changes with every version, and will tighten in sensitive domains. There is still no industry standard or regulation dictating when a block is legitimate and when it's excessive, which leaves legitimate applications in scientific fields at the mercy of each provider's internal policy.

Anthropic says it hopes the report will help other developers recognize similar patterns on their platforms. The document includes excerpts of malicious code and prompts found, and the invitation is for competitors and governments to carry out the same kind of detection. Those who build on top of these APIs do well to read providers' misuse reports as part of technical documentation, not as public relations material.