Anthropic Blocks Bioweapons Research Prompts in AI Safety Test

A grant proposal was submitted to Claude, where the system's safety filter flagged and blocked it. Several days later, the same individual returned, and the rejected prompts were reportedly sent to a competing AI model instead.

Anthropic shared this account of itself, detailing an instance where an AI firm demonstrates its own systems engaging with potential biological weapons research.

The Blocked Grant Application

The request was for funding to investigate chikungunya, a virus spread by mosquitoes that causes prolonged pain and lacks a treatment. Its aim was to enhance transmission and evade immune defenses. It was drafted by civilian researchers, with a military facility planned as the host location.

We're publishing our most detailed threat intelligence report to date.

It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.

We disrupted every operation in the report,…

— Anthropic (@AnthropicAI) September 10, 2026

All interactions were prevented, yet a workaround emerged. The platform used by these investigators set up a backup to another company's model. Claude itself assisted in writing that code, with the task presented to it as a solution for excessive refusals.

Five Cases, No Established Malice

The report spans 154 pages and includes five biology-related incidents. Anthropic deactivated the accounts, held back the labs, and then refrained from the accusation many anticipated.

“We do not assert that they intended harm, and identifying them or their labs could expose them to harm,” the team said in the report.

Still, the filters did work in certain situations. A researcher focused on bird flu was redirected to less capable models, and Anthropic views that assistance as mainly administrative.

Anthropic Biological Weapons Cases by the Numbers

• 154 pages in the report
• 5 biology cases published
• 35 research efforts found in a 30-day sweep of state-linked institutions
• 1 hour: time one user took to draft a smallpox-family grant on Opus 5

The Aspect That Should Raise Concern

Most of those 35 attempts were standard civilian research. That is the trouble. The same expertise can create a vaccine or a weapon, and a filter cannot interpret intent.

“A classifier cannot simultaneously enable benefit and prevent harm,” Anthropic said.

Its constraints have faced prior challenges. In April a Discord community accessed its restricted model on the first day.

As these concerns escalate, Washington is acting. Representatives Ted Lieu and Nathaniel Moran filed the AI Kill Switch Act in July, which would require developers to retain the ability to shut down their systems.

The same report removed clients who used Claude to monitor dissidents.