The public alarm regarding artificial intelligence is running high. Last week, Anthropic published a report on the misuse of its AI models by malicious actors, in which examples of biological weapons research and the use of AI to track U.S. naval movements in the Persian Gulf captured the public’s attention.
On social media, Evan Hubinger, one of Anthropic’s leading safety researchers, commented that AI is advancing so rapidly that, in his assessment, there is more than a 10% chance that the technology “could kill all humans” within the next decade.
This was added to reports of recent incidents in which AI agents escaped from their testing environments, generating headlines about the “AI Apocalypse Threat.” After some industry leaders, such as Dario Amodei, Sam Altman and Elon Musk, suggested a joint slowing of the pace of model evolution, even President Donald Trump publicly labeled the threats as a “hoax.”
Read also: New AI warnings rekindle debate about controlling technology
But what in this debate is real and what is exaggerated? Nikita Shah, senior researcher in the Intelligence, National Security and Technology Program at the Center for Strategic and International Studies (CSIS) in Washington, outlined some questions and possible answers in an article published this week.
For her, concerns about the urgency and pace of the threat are legitimate, but perhaps somewhat misdirected. “From a national security perspective, the AI abuses described in the Anthropic report are legitimate, but not particularly new or surprising,” she writes.
For her, the reports are “remarkably consistent” with how threat actors already behave, using AI to increase the speed, scale, effectiveness, and reach of their operations.
“What is alarming is the presence of actors much less qualified or mature using AI improperly, such as militant rebels or hacktivists: AI models give them a significant boost, allowing them to skip vital stages of development, acquisition, and refinement of these capabilities,” she argues.
She says there is a non-catastrophic path forward at this moment, but it depends on the national security community adopting a louder voice to draw attention. And contextualizing for the public how these threats are evolving, helping to form a more nuanced understanding of the risks they pose.
See the main points of the specialist’s article:
What does Anthropic’s threat intelligence report say about the use of AI models by malicious actors?
Nikita Shah highlights three main points in her article.
1- AI enhances the existing modus operandi of threat actors: Most of the report’s examples reflect what state and non-state actors were already doing before the advent of AI, such as cyber operations, information operations, and mass surveillance. The report also shows AI being exploited by contractors, military research institutes, and students at state universities, especially in the design and development of weapons — areas that existed long before AI, including research into biological weapons.
2 – The misuse of AI reflects states’ strategic objectives: State actors used Anthropic’s models to support broader strategic aims, such as information operations against their own citizens, tracking dissidents, and surveillance. This extends to conflicts — such as Iran’s use of Claude for reconnaissance of US troops and by Russian actors to design drone swarms. Furthermore, malicious actors attempted to hack Claude itself to gain unauthorized access to Anthropic’s most advanced capabilities.
3- AI is being used across the entire lifecycle of operations: The report confirms that threat actors are applying AI across the full lifecycle of their operations, including target reconnaissance, deception approaches to victims, malware development, evading detection, and creating fake profiles on social media. At all stages of an attack, AI is yielding faster and more efficient approaches.
Are the attack methods identified in Anthropic’s report new?
Not particularly. The use of AI by malicious state actors reflects much of what they were already doing. According to the specialist, Chinese students using Claude to maintain an autonomous program of technical vulnerability research is consistent with China’s voracious appetite for collecting and exploiting technical vulnerabilities, as well as its use of “AI agent swarms” for mass collection of open-source intelligence. “Iran, which frequently appears in the report, has been using AI to enhance its cyber capabilities for several years; a Google report identified Iran’s cyber apparatus as the largest user of Gemini in 2026, while Iran’s CyberAv3ngers group (hacktivists linked to the Islamic Revolutionary Guard Corps) are known to use ChatGPT for research into specific industrial-control technology (such as programmable logic controllers, which were exploited in recent hacks at U.S. water facilities in 2024).
Where should the public be truly concerned?
For Nikita Shah, the key question is which threat actors would have the capability to carry out such operations without AI. The vast majority of actors identified in the Anthropic report—whether state actors, cybercriminals, military research institutes, or even state-affiliated universities—would very likely pursue the same operations and achieve the same results through sophisticated cyber and analytical capabilities. “However, it would take them significantly longer (probably months) and significantly more human resources. And indeed, some researchers question whether the use of AI is transforming criminal capabilities as much as is thought, relative to other incentives.”
She says the real concern comes from actors who no longer possess such capabilities or who could gain a significant boost by using AI models. Two examples stand out. The first are threat actors in northern Yemen—likely Houthi rebels—who used Claude for design and development of weapons, including software design for targeting rockets and missiles, resulting in a test firing of a guided rocket (which failed). The second is a hacktivist actor who used Claude to target European political parties, media and think tanks, including exfiltration of large amounts of data for subsequent use. With AI, the attacks of both actors could pose significant geopolitical risk. Without AI, both actors would likely be years away from being able to conduct such attacks.
Finally, the Anthropic report also points to another worrying development: the use of PentAGI, an autonomous AI agent that conducts penetration testing, to carry out cyber operations at scale.
So, what is really new in Anthropic’s report?
The specialist says the first innovative conclusion is the players in this space. AI companies like Anthropic and OpenAI are still new to national security, thus much less familiar with the scope, depth, and complexity of threats to national security. “Such companies are the type that puts innovation first and security second; this can lead to a mindset of dealing with consequences later, which, in this case, has significant implications for national security.”
The second conclusion in Nikita Shah’s article is the leap of these threats to national security into public awareness — with limited context. “Companies like Anthropic are accidental entrants into threat assessment space, only now arriving at what industries such as the cyber threat intelligence sphere have been doing for decades. They deserve praise for the transparency they provided about the misuse of their models. However, as these companies are learning, discerning the strategic intent of malicious actors is one of the hardest things to do when it comes to threat assessment; without strategic context or doctrinal and geopolitical understanding of how threat actors operate, the published examples are presented in a vacuum, as if they had emerged from nowhere. Given the vast media coverage these companies receive, the natural result is public alarm.”
How is the political response to these risks shaping up?
Nikita Shah says it is imperative that the public maintain a realistic view of the threat represented by AI. “Most of the threats described in the Anthropic report existed before AI, although AI is exacerbating the risks they pose by accelerating, scaling and intensifying their evolution,” she repeats. Thus, access to the same models is also enabling new entrants into the threat landscape, who do not have the same restraints as states, and even some non-state actors with more mature ecosystems, to come onto the scene; this should concern us all. “However, this is not the same as existential risk for the future of humanity,” she concludes.
For Nikita Shah, the path forward is split between those who believe that AI model development should be slowed down and those who believe that slowing down will only allow adversaries — including China — to advance with their models, generating more risk to national security.
“Suggestions for how to contain these models vary, including ideas such as controlled testing environments, kill switches, and regulation of AI companies, including holding them accountable for their products,” she lists.
She also notes that President Trump’s rejection of these concerns is hardly comforting, but may reflect a political calculation to preserve an open space for a conversation with President Xi Jinping before his summit on September 24, where AI security should be at the top of the agenda. “This touches on a familiar tension: China is both a necessary partner in managing AI-related threats and national security risks — and a key source of threat to U.S. AI models.”
Finally, Nikita Shah says that, regardless of which path is chosen, one thing is clear: the national security community needs to share far more information with AI companies and with the public, leveraging its deep expertise to help contextualize what AI companies are seeing, the legitimate risks this creates, and what measures are being taken in response.
