Yemeni cell used Claude Code to write missile guidance software

What happened

US AI company Anthropic published its report "Detecting and countering misuse of AI: September 2026" on September 10, 2026. It describes how the company detects and shuts down misuse of its AI models. One case stands out. According to Anthropic, a cell of weapons developers "based in northern Yemen" used the Claude language model and the Claude Code programming tool to build software for three weapons programs. The activity falls within a period, December 2025 to August 2026, in which Anthropic disrupted several such cases. Internally, the case is designated GTG-87001.

The report is two months old, but it's making the rounds again, for example via the Yemeni outlet Belqees. Aviation magazine MiGFlug says that's because Houthi missiles are currently hitting targets in Saudi Arabia.

The three weapons programs

According to Anthropic, the cell was working on:

• a guided missile that uses an off-the-shelf, smartphone-class flight computer and steers itself onto the target in the final phase of flight (terminal guidance),
• a multistage ballistic missile with a stated target range of more than 2,000 kilometers,
• a missile family called "R2000", which includes a variant with a hypersonic glide vehicle. That's a vehicle that glides through the atmosphere at more than five times the speed of sound and is hard to intercept.

At the center of it all was GNC software (guidance, navigation and control). It keeps a missile stable and steers it to its target. According to MiGFlug, the group had Claude port an open-source autopilot to the smartphone flight computer and write the code for control and position estimation. Claude also tuned the control parameters, ran the build chain for the firmware (the software baked into the device) and simulated flights. For the ballistic missile, the group also produced a six-degrees-of-freedom trajectory simulation that models movement and rotation in every direction. The flight control was optimized using reinforcement learning, a technique in which a system improves by being rewarded for good outcomes.

An AI as an engineering team

What's striking is how the group worked. It ran several Claude sessions in parallel and split up the roles like a small dev team: one instance wrote code, a second did research, a third reviewed the first one's output. According to Middle East Eye, the AI took on work that would otherwise have required a team of engineers.

Anthropic says Claude's safeguards blocked many requests, but not all of them. The operators disguised their real goals and what the software was for. They also spread the work across many sessions, so no single conversation revealed the full project. Anthropic writes, as quoted by Middle East Eye:

We have no evidence that the actors succeeded in building a functional device, but they did test-fire a guided missile. That field test appears to have failed: within hours, the actors returned to Claude to figure out why.

Accounts banned, simulation tool remains

Anthropic uncovered the activity during its own investigations into suspected weapons development. The company banned all associated accounts and shared information with government and industry partners. According to Livemint, it also introduced stronger safeguards. MiGFlug reports new classifiers, automated filters designed to detect and block weapons-related requests.

That doesn't necessarily mean the program is over. The cell had already built an offline simulation tool that runs as a standalone program, without Claude and without engineering software like MATLAB. So parts of the development can continue without AI access.

Was it the Houthis?

Anthropic doesn't say so. The report refers to a cell in northern Yemen and names no organization. The north, including the capital Sanaa, is controlled by the Iran-backed Houthis, who run their own long-range missile and drone programs. That's why many outlets draw the connection, including the main source Belqees and Middle East Eye. MiGFlug stresses that this is an inference, not a claim made in the report. The label "terror cell" circulating on social media doesn't come from Anthropic either.

The political backdrop is tense. According to Middle East Eye, the Houthis recently seized large stretches of the Red Sea coast, including the Bab el-Mandeb strait, in an offensive. MiGFlug reports that since July 2026, Houthi missiles and drones have struck targets in Saudi Arabia, including King Khalid Airport in Riyadh, where at least 13 people died on October 10. According to Middle East Eye, the Houthis have received weapons and training from Iran and military assistance from Russia, but also rely on a homegrown arms industry.

Six weapons cases in the report

According to MiGFlug, Yemen is just one of six cases of conventional weapons development. Anthropic introduced this category after its last report in November 2025. The other cases:

At the same time, Anthropic's Frontier Red Team, an internal group that probes models specifically for dangerous capabilities, published evaluations. According to MiGFlug, they show AI models getting steadily better at simulated weapons development tasks.

Our take

This is one of the most concrete examples yet of AI coding tools partially replacing military expertise. According to MiGFlug, guidance software is one of the harder parts of building precise missiles and has so far required experienced engineers. For groups that already have the hardware and the basic know-how, AI lowers that barrier. At the same time, the case exposes the limits of safeguards. If you hide your intent and break tasks into harmless-looking pieces, you often get through. That's a fundamental problem, because flight control code for drones or model rockets also has legitimate civilian uses.

There's a flip side, though. Until now, weapons programs in Yemen have mostly been reconstructed from wreckage and seized shipments, for example by the UN Panel of Experts. Here, the tool's provider was able to watch part of the work almost in real time. Plenty of questions remain. All the information comes from Anthropic itself and hasn't been independently verified. It's unclear how far the programs actually got, and who exactly is behind them. And open-weight models that you run locally without any provider oversight can't be monitored this way at all.