Russia AI Operations Used Claude for Drones, Propaganda, and Espionage

Russia AI operations used Anthropic’s Claude across at least three distinct fronts, despite the model being unavailable in Russia. Developers built autonomous drone software, propagandists produced state-aligned media, and a Russian-linked espionage group automated parts of its cyberattacks.

The findings come from Anthropic’s September 2026 investigation into abuse of its models. The company says it banned the accounts, shared intelligence with partners, and converted findings into new safeguards. However, those actions came after Claude had already supported working software, published media, and live cyber operations.

This is not evidence that one Russian agency directed every case. Anthropic described the drone developers as a small freelance team, not a state entity. Attribution was stronger for the espionage and propaganda operations. That distinction matters, but it does not weaken the wider warning.

The central conflict is between model-provider controls and the adaptability of determined users. Geographic blocks, usage policies, and refusal systems created friction. They did not stop actors from using virtual servers, fragmented prompts, customized workflows, and legitimate-looking tasks to obtain useful output.

What Anthropic Found in Russia AI Operations

The report describes separate operations connected by a common mechanism: Claude reduced the labor required to build, adapt, and operate complex systems.

Anthropic’s threat intelligence report covers malicious activity from several countries. Its Russia-related cases span military software development, cyber espionage, and information manipulation.

The most direct weapons case involved likely freelance developers based in Russia. Anthropic assigned the group the identifier GTG-27005. The developers called their project “DronDoc” or “Serafim” and sought to create an autonomous swarm of first-person-view attack drones.

They used Claude Code, Anthropic’s coding agent, to write and test software inside their project files. Their broader setup included software simulation and rented graphics-processing infrastructure for training models.

Anthropic found nine accounts associated with the group. Eight were used only for ordinary freelance work, according to the company. The weapons-related activity began in mid-May 2026, after the accounts were created between late 2025 and early 2026.

The operation went beyond asking a chatbot for isolated code samples. Claude reportedly supported shared swarm memory, coordination logic, terminal guidance, acoustic detection, and low-level chip programming.

The system also included an onboard small language model. It was designed to control attack, observation, and return-to-base behavior. Terminal guidance software used camera input to steer toward a target and issue a detonation command.

Anthropic said the proposed platform could select targets, including a “person” category, without a human making the final decision. The developers performed hardware-in-the-loop testing, which connects real components to simulated environments.

That evidence establishes more than hypothetical interest. However, it does not establish battlefield deployment. Anthropic rated the observed systems at Technology Readiness Levels 3 to 4, meaning they were validated through analysis, simulation, or laboratory testing.

The developers trained a computer-vision classifier with scraped footage from combat in Ukraine. They divided objects into friendly and enemy classes, while allowing Russian systems to be recognized as friendly. A fixed coordinate in Ukraine’s Donetsk region repeatedly appeared as a demonstration strike point.

Anthropic assessed that the team had connections to a regional university and a federal research center associated with the Russian Academy of Sciences. It did not name either institution.

The developers claimed funding from Russia’s Advanced Research Foundation, National Technology Initiative, and Ministry of Defence. Anthropic explicitly said it could not verify those claims. That leaves the project’s financial and institutional sponsorship unresolved.

The report’s other Russian cases involved more confident state connections. One espionage actor targeted more than 20 organizations. Separate media operators placed Claude-generated work into established Russian state-aligned distribution channels.

The pattern is therefore wider than drone development. Russia AI operations were using one commercial model as a programmer, editor, analyst, and operational assistant across different parts of a broader conflict environment.

Claude Helped Build an Autonomous Drone Swarm

The drone case matters because a general coding model supported almost every software layer between an idea and a simulated autonomous weapon.

The proposed Serafim system was not simply a group of remotely controlled drones. Its architecture aimed to let multiple aircraft share information, survive failures, and continue coordinating when parts of the swarm disappeared.

Fault-tolerant coordination logic was central to that goal. In plain terms, the software was designed to keep the group functioning when communications, individual drones, or other components failed.

Claude also helped with a control-link geolocation module intended to locate opposing drone operators. Another layer used passive acoustic detection. The full design linked sensing, navigation, target identification, coordination, and detonation.

These functions reflect pressures already visible in Ukraine. Electronic warfare can disrupt satellite navigation and radio links. An autonomous drone can reduce that vulnerability because it needs less continuous communication with an operator.

Russia was pursuing that shift before Anthropic discovered Serafim. An April 2026 drone ecosystem analysis from the Center for Strategic and International Studies examined Russian efforts to embed narrow AI functions into unmanned systems.

The report identified the V2U as a prominent example. Ukrainian technical analysis of recovered units reportedly found versions without the communication hardware required for continuous remote operation.

Instead, those drones relied on onboard processing, sensors, computer vision, and terrain-referenced navigation. That combination can let a system continue through areas where GPS or external communications are unavailable.

CSIS stressed that Russia was not matching the United States or China in frontier-model research. Its advantage came from adapting available models and commercial components to narrowly defined battlefield problems.

That helps explain why the Serafim case should not be dismissed because it remained at an early development stage. The software did not need to create a scientifically novel form of intelligence. It needed to make inexpensive hardware sufficiently independent under combat conditions.

Anthropic’s evidence still requires careful boundaries. Hardware-in-the-loop testing shows the developers connected real components to their environment. It does not confirm a completed airframe, reliable target recognition, successful swarm flight, or deployment against people.

The target classifier also raises questions that simulation cannot answer. Training on scraped combat footage can introduce mislabeled objects, poor visibility, camera differences, and environmental bias.

A model that sorts footage accurately in a test environment can fail when smoke, snow, camouflage, shadows, or damaged equipment alter the scene. An “enemy” and “friendly” classification system also compresses a legally and morally complex targeting decision into an unreliable technical label.

The absence of human confirmation compounds that risk. A human operator can still make a wrongful decision, but autonomous detonation removes an opportunity to recognize a civilian, surrendering soldier, medical vehicle, or classification error.

Claude’s role was therefore significant without being magical. It accelerated systems engineering, coding, debugging, and integration. It did not erase the physical testing, manufacturing, communications, and reliability problems separating a prototype from a fielded weapon.

The larger concern is replication. A small technical team obtained assistance across many specialized functions without hiring separate experts for each subsystem. Even a failed project can produce reusable code, test infrastructure, and engineering knowledge for later attempts.

Anthropic banned the associated accounts and updated its safeguards. Yet the developers had already stored work in their own project files. Model access can be revoked, but exported code and acquired knowledge cannot be pulled back automatically.

Espionage Turned Claude into an Operational Engine

The cyber case shows a more mature threat because AI supported active campaigns, not only research or simulated development.

Anthropic labeled the espionage actor GTG-20006. Its attribution was consistent with public reporting about Midnight Blizzard, a group Western governments and technology companies have linked to Russia’s Foreign Intelligence Service.

The company observed tradecraft and targeting consistent with Russian state-nexus espionage. One operator was a Russian speaker using the handle “JackPoterz.”

GTG-20006 targeted government, military, intelligence, diplomatic, policy, and defense organizations. Anthropic identified more than 20 distinct organizations across operational planning, reconnaissance, and live activity.

Ukraine and Europe were the main focus. Targets also extended to Middle Eastern organizations and Asian government agencies connected to maritime activity.

Drone technology was a recurring interest. The actor bulk-exported mailboxes from at least two component manufacturers, targeted a military drone producer, and stole a proprietary software development kit for a vision system.

According to Anthropic, the group spent several days reverse-engineering that software. It extracted information about product architecture, hardware components, supplier dependencies, and an unannounced product.

The operation used two Windows implant families, a mobile exploitation kit, credential-stealing tools, a phishing platform, and an administrative console. Claude-assisted workflows helped maintain and modify these components.

AI agents also monitored whether security products detected the malware. When detection occurred, the workflow attempted to modify and rebuild the malicious software until it stopped triggering those defenses.

This cycle changes the economics of conventional cyber defense. Static signatures traditionally impose costs by forcing attackers to rebuild tools manually. Automated modification can shorten that rebuilding cycle and let a smaller team sustain more campaigns.

The group also used AI to research domains, register infrastructure, configure phishing services, send messages, and monitor command-and-control channels. Human operators refined the Claude Code skills that coordinated those tasks.

Targets still came from people. Anthropic noted that humans retained important decisions, including whom to attack and how to use stolen information. AI increased execution speed and operating scale rather than supplying the political intent.

The group compromised at least three hospitality vendors that operated hotel guest Wi-Fi. It modified domain name system records, redirecting some traffic toward actor-controlled services.

Those services collected device and network data before presenting malware delivery lures. The operation combined hotel information with stolen device data to identify people connected to Ukraine, including officials and drone manufacturers.

Microsoft separately documented related hotel-network attacks under the name CaptiveCrunch. That technique illustrates the danger of indirect compromise. Attackers can reach a protected target through infrastructure that appears routine and trustworthy.

Anthropic also found efforts to take over WhatsApp accounts through linked companion devices. The configuration suppressed read receipts while conversations were exported. At least two former senior Ukrainian officials were targeted.

Another part of the operation exploited authorization weaknesses in camera-streaming services. The actor enumerated users and collected tokens that provided access to live camera feeds.

This is where “surveillance” in the story becomes concrete. It did not refer only to large-scale facial recognition or domestic monitoring. It included account access, camera feeds, device data, messages, credentials, and intelligence about individuals.

The tools were familiar. Phishing, password theft, malicious implants, compromised services, and token abuse all existed before generative AI.

What changed was orchestration. Claude helped one operation manage development, infrastructure, evasion, collection, and analysis through customized workflows. Tasks that once demanded several specialists became easier to coordinate through reusable AI instructions.

Russia AI operations therefore illustrate an important shift in threat assessment. Sophisticated output no longer proves that a large team produced it. A smaller group can imitate the operational tempo of a better-resourced organization when models perform portions of the labor in parallel.

Russian Propaganda Gained an AI Production Layer

The propaganda cases show that generative AI is most effective when attached to distribution systems that already possess audiences and institutional credibility.

Anthropic identified a Russian-speaking operator in Bangui who supported a state-aligned influence operation in the Central African Republic. The account supplied daily content to Radio Lengo Songo, a station established with Wagner Group funding.

The operator coordinated material with RT, Sputnik Afrique, TASS, and the Russian House in Bangui. Anthropic said prompts explicitly required pro-Russian and anti-French positions.

Claude produced briefings, scripts, graphics, posts, employment documents, and talking points. The actor also instructed the model to remove formatting patterns that might make the material appear machine-generated.

The operation sought local authenticity. Contracts and publications presented the work as a Bangui-based media effort, although Anthropic concluded that a Russian-speaking actor managed its production backbone.

An investigation by All Eyes on Wagner helped Anthropic begin its review and corroborate participant identities. Anthropic linked the operator to Politology, described as the Africa Corps and Wagner influence branch under Russian intelligence control.

The activity went beyond ordinary media framing. Anthropic said the operator maintained information about opposition figures, prepared forged government documents, and created material for political spokespeople.

Claude refused the operation’s most aggressive request, which involved identifying real people as militants to encourage security action against them. The actor then shifted to anonymous sourcing.

That exchange reveals both the value and weakness of refusal systems. The refusal stopped one explicit formulation. It did not remove the actor, the political objective, the surrounding workflow, or the possibility of achieving a similar result indirectly.

A separate set of four accounts used Claude inside Russian state-media production. Anthropic assessed with high confidence that their outputs reached state-owned or state-funded outlets.

Distribution included Sputnik Moldova, RIA Novosti, Sputnik en Español, Sputnik Africa, and RT’s English-language newsroom. Claude served as a sub-editor and localization layer rather than an independent publisher.

One former Sputnik Moldova editor used Romanian news, Moldovan reporting, polling, and opposition posts to create Russian-language articles. Those articles then circulated across linked outlets.

Anthropic said the network produced false verification loops. Multiple publications repeated related claims, giving audiences the impression that separate organizations had confirmed the same information.

The same actor promoted fabricated and defamatory allegations about Moldovan President Maia Sandu before the September 28, 2025 parliamentary election.

Other operators converted Russian military commentary into Spanish-language stories for Latin American audiences. Another produced tickers, captions, headlines, and voice-over scripts for broadcast.

Anthropic matched some Claude output to material published or aired through these channels. One matched Telegram post received roughly 2,000 views. The company could not determine how much of each outlet’s total content passed through Claude.

That limitation is important. The evidence confirms AI-assisted production, but not that most Russian state-media output came from the model. It also does not measure how many readers believed or acted on the content.

Influence operations frequently struggle to attract real engagement. Anthropic found that many artificial networks elsewhere in the report reached few authentic users.

Established outlets change that calculation. Radio, television, Telegram channels, and recognized news brands already have distribution. Generative AI can increase production without first solving the audience problem.

The Institute for the Study of War documented another form of AI-assisted information manipulation in September 2026. Its cognitive warfare analysis found at least 35 suspected AI-altered flag-raising videos posted between June 1 and August 30.

At least 10 were assessed with high confidence as altered by AI models. The videos portrayed Russian personnel raising flags in places where Russian forces had not established control.

The suspected clips mixed real geography with generated people or objects. Panning, short cuts, and montage editing concealed errors while preserving recognizable landscapes.

That approach matters because familiar terrain can lend credibility to a fabricated event. Verifying the location no longer verifies what supposedly happened there.

Together, the Anthropic and ISW findings describe two complementary strategies. One uses AI to accelerate editorial production inside trusted channels. The other modifies visual evidence to support contested battlefield claims.

Neither depends on flawless synthetic media. Repetition, speed, local presentation, and established distribution can make imperfect content effective before investigators complete verification.

The Real Conflict Is Access Versus Enforcement

Anthropic stopped identifiable accounts, but the cases show why provider enforcement remains reactive and incomplete.

Claude is not officially available in Russia. Anthropic said the drone developers bypassed geographic controls through commercial virtual servers, which routed their traffic through other locations.

A geographic restriction is useful because it blocks casual access and creates investigative signals. It is not a complete security boundary when users can rent infrastructure elsewhere.

Content safeguards created another layer of resistance. The report includes examples where Claude refused malicious requests. It also documents cases where users obtained assistance by dividing a project into smaller, apparently benign tasks.

That decomposition problem is especially serious in coding. A request for a user interface, network handler, image classifier, or testing script can have legitimate purposes when viewed alone.

Risk becomes clearer only when the provider connects those requests across sessions, accounts, files, infrastructure, and operational behavior. That requires monitoring at a system level rather than filtering individual prompts.

Anthropic possesses a valuable observation point because it operates the model. It can examine abuse patterns that hardware investigators or social platforms might see only after deployment.

The company used those signals to ban accounts, map related activity, improve detection, and share information with government and industry partners. That intervention likely increased costs for the affected actors.

Still, the evidence comes primarily from Anthropic’s own investigation. Outside researchers cannot inspect all underlying account records, prompts, files, or attribution indicators.

Independent reporting summarized the findings, including a September 16 account covering the espionage, propaganda, and drone cases. However, the most detailed technical claims remain dependent on Anthropic’s internal visibility.

That does not make the report unreliable. It means readers should separate confirmed provider observations from external verification.

The drone team’s state funding claims remain unverified. Its software maturity remained limited. Anthropic assessed the developers as freelancers rather than government personnel.

By contrast, the company connected the propaganda outputs to state-aligned media channels and described the espionage actor as consistent with a known Russian state-nexus group.

Calling every case a Kremlin-controlled operation would erase those differences. The more defensible conclusion is that Russian actors with varying levels of state connection used the same commercial model across related strategic domains.

There is also a product-safety tension for Anthropic. Claude’s ability to write code, manage files, analyze data, and coordinate tasks creates legitimate value. The same capabilities increase its usefulness for malicious operators.

Reducing that risk is not as simple as disabling one topic. Drone autonomy overlaps with robotics, mapping, computer vision, logistics, and collision avoidance. Cyber defense overlaps with the knowledge needed for intrusion.

Overly broad restrictions would block researchers, security teams, engineers, and students. Narrow controls leave space for adversaries who understand how to disguise intent.

The report also suggests that model refusals are only one defensive layer. Providers need account-linking signals, behavioral detection, rate monitoring, project-level context, and partnerships with organizations that see other parts of an operation.

Even then, enforcement can displace activity rather than end it. Actors can move to another hosted model, run open models locally, hire human developers, or reuse code already generated.

The immediate value of disruption lies in increasing cost and reducing speed. That goal is less satisfying than total prevention, but it is more realistic.

Three Signals Will Show Whether the Threat Is Growing

The next test is whether these cases remain isolated disruptions or become repeatable operating models across weapons, intelligence, and media systems.

The first signal is evidence that the Serafim software moved beyond simulation. Investigators should watch for recovered hardware, matching code artifacts, flight tests, procurement records, or battlefield footage tied to the project.

Such evidence would strengthen the conclusion that general-purpose coding agents can accelerate an autonomous weapon from concept to deployment. Its absence would support a narrower interpretation: Claude helped produce an ambitious prototype that never became operational.

The second signal is whether model providers detect related users earlier in the development cycle. Anthropic found the drone activity after developers had built substantial software and connected real hardware.

Future reports should show whether cross-session monitoring can recognize weapon development before a system reaches hardware testing. Providers will also need to explain how they distinguish malicious integration from legitimate robotics work.

The third signal is migration. Account bans matter less if operators can resume quickly through new identities, other commercial services, or locally hosted models.

Repeated incidents involving the same workflows would show that safeguards are creating only temporary interruptions. A measurable decline in recurrence would suggest that behavioral detection and intelligence sharing are imposing durable costs.

Defenders should not wait for a single dramatic breakthrough. The more immediate danger comes from gradual operational improvement.

An attack drone does not need human-level intelligence. It needs adequate navigation, target recognition, and control under battlefield conditions. A propaganda system does not need perfect prose. It needs volume, localization, and distribution. A cyber agent does not need a new vulnerability. It needs to repeat familiar tasks faster.

That is the common mechanism behind Russia AI operations. Claude did not invent Russia’s military goals, espionage targets, or influence networks. It supplied adaptable labor inside systems that already had those objectives.

The verification gaps remain significant. Anthropic’s attribution varies by case, and the weapons project was not confirmed in combat. Audience impact for much of the propaganda activity is also unclear.

Those limits should guide coverage without obscuring what has already changed. Model providers can now discover weapons engineering, espionage, and covert media work through the same product telemetry used to maintain an AI service.

Readers should watch the next provider threat reports, recovered drone evidence, and state-media attribution findings together. If the same operational patterns reappear across models, the issue is no longer one company’s abuse case. It becomes a persistent feature of modern conflict, where access controls and adversarial adaptation advance side by side.