Last Thursday, Anthropic, the American AI company behind Claude, released a report that reads like a dark science-fiction preview. Kremlin-backed actors, the company said, had been using Claude to program autonomous lethal drones. A Russian-linked group known to investigators as GTG-27005 used the AI system to develop a model compact enough to run on single-board computers but powerful enough to help a drone select targets—including a specific “person” target class—and to issue detonation commands without a human being in the loop. In other words, they were trying to build a machine that could decide who lives and who dies entirely on its own. The group had not yet deployed that model in the real world, but Anthropic says the operatives were not just daydreaming. They were using real hardware-in-loop testing within their sessions, meaning they were experimenting with actual drone components and control loops, refining their software against physical hardware rather than mere simulations. They also used Claude to create software that allowed autonomous drones to communicate with one another, so a swarm could coordinate and improve targeting in real time. Anthropic moved quickly: it banned the group, folded the lessons into its safety systems, and alerted industry partners. But the report doesn’t stop at drones. It is the latest and most vivid warning from an AI company that made-in-America tools are being exploited by hostile states around the world. Russia, China, Iran, and other adversaries are using American AI to attack targets, steal secrets, and manipulate public opinion. The fact that a commercial assistant designed to be helpful can be repurposed as a weapons research tool is not a malfunction; it is a feature of general-purpose AI. The barrier to entry has fallen from a nation-state with a weapons lab to a group of freelancers with an API key. That doesn’t make the work easy, but it makes it accessible. And even a crude autonomous drone, built with off-the-shelf parts and a compact neural network, could be catastrophic in the wrong hands. Anthropic’s finding is significant not because the drone reached the battlefield—it didn’t—but because it shows how close we are to a world where AI-enabled weaponry is no longer the exclusive domain of advanced militaries.
The rest of Anthropic’s report is a catalogue of espionage and sabotage attempts. Chinese and Yemeni groups, for example, tried to use Claude to design conventional weapons; Anthropic says it disrupted those attempts. Foreign actors used Claude to dig up information on targets, find vulnerabilities in their online accounts, create malware capable of bypassing security, steal data, and hide their traces. They also used the AI to build networks of fake social media profiles and entire fake news sites. What used to require a team of human editors, designers, and translators can now be accomplished by a single operator directing an AI model. This is not just about making fake content; it’s about making fake credibility. A fake news site with hundreds of articles, a fake journalist with a convincing avatar and social history, a fake NGO with documents and statements—all can be assembled with AI assistance in a fraction of the time it would once have taken. Anthropic’s report notes that the Russian-linked groups automated much of their operations, from development and infrastructure acquisition to phishing, persistence through command and control, to data exfiltration. The AI didn’t just write text; it helped identify targets, exploit weaknesses, and cover tracks. The group even used AI to forge documents from the Central African Republic Gendarmerie and Ministry of Defense, presumably to add official weight to their schemes. This is a worrying escalation. Espionage and sabotage have always involved forgery and deception, but AI makes it possible to generate high-quality false evidence quickly and on demand. For police agencies, intelligence services, and journalists, the question is no longer simply whether a document is genuine; it’s whether the adversary had access to an AI that can mimic official seals, language, and formatting. Anthropic’s report is essentially an early warning that the “deep fake” era has arrived for written documents, social media personas, and even entire media outlets.
The most public-facing part of the report concerns influence operations. The campaigns bear the hallmarks of classic Russian tradecraft: fake news sites and fake journalist profiles were used to spread lies about NATO activity in the Baltics, an old Kremlin theme intended to undermine alliance unity and stir fear among local populations. But AI made the operation faster and more effective. Claude allowed operators to generate far more disinformation than human writers could, and it helped produce fake reporters who looked and sounded more believable to local audiences. The AI tools also streamlined the entire process, from building websites to managing social accounts, so a small group could sustain an operation that would once have required dozens of staff. Anthropic says the Russian-linked groups automated much of their operations, not just publishing, but also the underlying infrastructure and security. They even used AI to forge official-looking documents, lending false legitimacy to their narratives. Another group tracked by Anthropic, GTG-84005, operated differently. This group, apparently based in or linked to Turkey, used AI to steal census and public information, then tailored its messaging to specific audiences in Malaysia. There, the group laundered Russian and Chinese state media as independent reporting. This is a sophisticated strategy: rather than pushing a Russian or Chinese source directly, they repackaged state narratives as local journalism. An ordinary Malaysian reader might have found an article written in local style, referring to local demographics, and had no idea that the original content came from Moscow or Beijing. The use of stolen census data makes this even more insidious, because the messages weren’t just translated—they were engineered to exploit specific social, ethnic, or religious fault lines. In the past, running a foreign influence operation required linguists, writers, forgers, recruiters, web developers, and money. Now, one group using a commercial AI can perform many of those roles in days, with a level of polish that makes the product almost indistinguishable from authentic journalism. The goal is not necessarily to convert readers to a foreign cause. The goal is to make them uncertain—to create a fog of suspicion in which legitimate sources and fake sources look exactly alike.
Anthropic’s report did not emerge in a vacuum. Two weeks earlier, rival OpenAI revealed that Russian actors had used ChatGPT to create a fake “expert community” called the International Burke Institute, designed to push Kremlin-friendly talking points to international audiences. It was a textbook think-tank fabrication, with a plausible name, a website, and voices presented as independent scholars. The fact that both Anthropic and OpenAI—two companies often seen as competitors—are stepping forward with similar findings suggests that this is not anecdotal but systemic. An August report from the Institute for the Study of War warned that Russia is using AI to “scale production of content that aligns with Kremlin narratives.” Russia is also investing in human networks. According to reporting, Moscow is offering young people around the world “AI media internships and training” through university donations and related programs. This is a subtle and clever recruitment tactic. Young people eager to gain AI skills are invited into programs that teach them how to create content, use generative AI, and build audiences—skills that are, on their face, legitimate. But in practice, these programs can become pipelines for disinformation. The participants may be knowingly feeding state propaganda, or they may be unwittingly used by handlers who set the topics and distribute the finished products. Either way, the Kremlin gains something it cannot buy with bots: real human beings with real social networks, real accents, and the ability to pass as authentic voices. Combine that with AI-generated content, and the effect is overwhelming. A sophisticated influence operation no longer requires a huge staff; it requires a small core of handlers, a stable of unpaid or underpaid young “interns,” and access to AI tools that do the heavy lifting of writing, translating, and personalizing. The human-AI partnership may be the defining model of modern propaganda—more resilient than bot armies, more scalable than traditional human spies. And it is already being deployed against democratic societies.
Where does that leave the U.S. pushback? As Daniel Kimmage and Darjan Vujica argue in a recent article for New America, the opposite of mobilization is happening. Kimmage, the former acting coordinator and principal deputy coordinator of the State Department’s Global Engagement Center, and Vujica write that authoritarian regimes are early adopters in using AI to “bend the arc of reality in their favor.” They note that the U.S. government used to establish and run organizations to push back against foreign influence operations. But under the second Trump administration, those efforts have been undermined or brought to a halt. Less than a month after Attorney General Pam Bondi took office, she dissolved the FBI’s Foreign Influence Task Force—the unit specifically dedicated to investigating foreign disinformation and influence campaigns. Two months later, Secretary of State Marco Rubio shuttered the Counter Foreign Information Manipulation and Interference hub, known as R/Fimi. These were not obscure offices; they were the front line of American defense against the very operations Anthropic’s report describes. Meanwhile, the 2025 White House AI Action Plan explicitly calls for removing any references to misinformation. Kimmage and Vujica add a sharp phrase: “At least when it’s made by foreigners.” They also observe that the Trump administration has enthusiastically embraced AI-generated imagery in politically divisive posts. This is not just a policy disagreement; it creates a tactical blind spot. If U.S. officials are generating synthetic media and attacking misinformation as a concept, they are effectively erasing the distinction between their own political communication and foreign adversaries’ influence operations. That makes it much harder to warn allies and citizens about AI-enabled manipulation from abroad. It also sends a signal to Kremlin operatives: even when their schemes are detected by private companies, the U.S. government may not follow up. Anthropic can ban a group and warn the public, but it cannot impose sanctions, indict hackers, or coordinate an interagency response. The policy vacuum is real, and it is dangerous.
The picture that emerges from Anthropic’s report and the surrounding policy landscape is unsettling, but it is not hopeless. The report itself is a sign that at least some AI companies are paying attention, sharing intelligence, and building safeguards to prevent misuse. Anthropic says it disrupted the attempts it found, banned the responsible groups, and worked with industry partners to harden defenses. OpenAI, too, has exposed influence operations that relied on ChatGPT. These actions show that the private sector has a role in the fight. But private companies can’t do it alone. They are not intelligence agencies or law enforcement. They cannot decide whether a foreign operation rises to the level of an armed attack, and they cannot impose diplomatic consequences. The threat of AI-enabled drones, espionage, and disinformation requires a whole-of-society response. That response should include robust laws, investment in digital literacy, and independent institutions capable of investigating and exposing manipulation. It also requires honesty: AI is a dual-use technology, and pretending that it only “democratizes” good things is naive. The same tools that empower an entrepreneur to start a business can empower an intelligence officer to launch a propaganda campaign or target a dissident. The same language model that helps a doctor write a patient summary can help a foreign operative forge an official document or program a drone. The question is not whether to use AI; it’s how to protect against its abuse without surrendering its benefits. For ordinary people, the most practical defense may be skepticism—not cynicism, but a reasoned habit of asking who produced a piece of content, why, and what evidence supports it. In a world where AI can generate realistic-looking reporters, official documents, and videos, the ability to pause and verify is as important as the content itself. Democratic societies survived earlier waves of propaganda by building institutions of trust. The AI era demands an effort of similar scale. Anthropic’s report is not a prediction that the future will be full of autonomous killer drones and perfectly fake news. It is an observation that the future is already arriving—and a call to meet it with open eyes.