Somewhere in China, a researcher opened a chat window and went to work. Over several weeks, he assembled roughly 16 software modules for electronic warfare and suppression of enemy air defenses, taking the suite through 12 versions with an American AI model serving as an assistant. The code ranked targets and scored jamming options. Midway through the project, the default scenario flipped. It now listed 12 targets on Taiwan: a command bunker, an early-warning radar, Patriot and Tien Kung batteries, major air bases, and a regional combatant headquarters. Anthropic later tied the account to research institutions in the People’s Republic of China, including the PLA Academy of Military Sciences. This was development work, not an attack. The intended use was still obvious. An American model was speeding software that would matter in a campaign against a democratic island the United States has pledged to help defend.
The episode occupies pages 119 through 122 of a 154-page report Anthropic released on September 10. The document catalogs attempts by China and other hostile services to turn Claude toward weapons, surveillance, and theft. Two days earlier, the NSA, the FBI, and CISA issued a joint advisory warning that Chinese companies were extracting American AI capabilities at industrial scale, likely with the Chinese government's knowledge. I have not seen a cleaner pairing of evidence for a point conservatives have been making for years. The United States has to win the AI race, and the margin is national security, not bragging rights for a ‘lab’. Anthropic shows what hostile users already try to do with a frontier model. The agencies show how those users are trying to obtain the American capacity that makes the work possible.
The same habit appears in procurement files, not only in targeting code. A China-based actor that Anthropic assessed as tied to a defense manufacturer used Claude to draft an anti-torpedo fire-control specification, write software components, and assemble a proposal of more than 200 pages for a PLA Navy acquisition effort. A separate Chinese actor mined the model for directed-energy weapons material destined for leadership briefings. Then there is the cyber case that should unsettle anyone who still thinks talent is the scarce ingredient. Chinese operators, two of them identified as university undergraduates, ran an espionage operation against roughly 50 organizations. They used autonomous vulnerability research and parallel AI agents. Anthropic reports actual compromises and data theft. The scarce part of the job, the analysis and the code, no longer required a bench of experienced operators.
The human-targeting files are uglier because the victims are named by faith and by exile. Anthropic identified a China-based, government-aligned operation compiling dossiers on Catholic cardinals, Taiwanese Presbyterian leaders, Tibetan Buddhists, Falun Gong practitioners, and Christian missionary networks. The templates asked for scandals and leverage. A second PRC-aligned operation used Claude to support recruitment aimed at Uyghurs in Syria, looking for pressure points such as financial distress and relatives still living in Xinjiang. Translation and analysis that once required specialists arrived on demand. The gain went to officers compiling pressure on priests, monks, and refugees.
Iran, Russia, and a cell in northern Yemen took the same shortcut. An Iran-linked actor used Claude to assemble targeting recommendations against US naval forces, stitching together naval-movement data, commercial imagery, and sailors’ names scraped from public military photographs, then probing weaknesses in shipboard systems. On September 11th, the Wall Street Journal stated the finding without ornament. Iran used American-developed AI to try to target US Navy ships in the Middle East. Russia-based developers wrote software for autonomous attack-drone swarms that select a target and detonate without a human in the loop, and they got as far as hardware testing. The Yemen cell used the model on guided-weapons work and returned for troubleshooting after what looks like a failed live rocket test. None of that proves a fielded system. It proves that the path from intent to prototype is getting shorter.
If the models are this useful in hostile hands, why keep building better ones here? Evidence in the same document runs the other way. A consultant used Claude to engineer a surveillance platform for Mali’s intelligence service, targeting about 25 million SIM cards. Anthropic banned the account. The deployed system had already been moved onto local models and kept running. In another cluster of incidents, an access platform redirected refused biological requests to more permissive models and restored access after enforcement. The report records five concerning dual-use cases involving avian influenza, orthopoxviruses, and toxins. Saying no inside one American company does not retire the demand. The work migrates to whoever will take the query, and that provider is, more and more often, Chinese.
The federal advisory is the industrial half of the same story. The NSA, FBI, and CISA describe extraction as central to the development strategy of named Chinese companies, DeepSeek, Moonshot, Alibaba, MiniMax, StepFun, and Z.AI among them, and they assess that the campaigns likely proceeded with Chinese government awareness. Anthropic gives the volumes. It attributes more than 151 million exchanges to Alibaba’s distillation campaign between May and July, more than 23 million to Moonshot in the same window, and more than 12.1 million to DeepSeek across 14 days in July. Distillation here means querying a strong model at enormous volume so a weaker one can be trained on the answers. The agencies note that the method shortens timelines and cuts training costs. American research is covering part of China’s bill.
Two details in the Anthropic report take the matter out of the licensing file. Extracting general reasoning can lift dangerous capabilities in biological and cyber work even when the harvested chats contain little material on those subjects. Ordinary coding sessions can be reused later on tasks no one billed as weapons research. Anthropic also states that its safeguards do not travel with unauthorized distillation. The copy gets the competence. It does not get the refusal layer.
A further complication is easy to miss if the whole affair is filed under theft and forgotten. Anthropic found that Moonshot forwarded selected customer requests to Claude and showed Claude’s answers to people who thought they were using Moonshot’s own model, Kimi. DeepSeek used similar tactics. Some of that forwarded traffic exposed likely PLA-affiliated surveillance work, Chinese police-system development, and credentials tied to a Russian defense-related government agency. In some cases, customers of Chinese AI services were receiving American output. As long as the traffic still touched an American stack, the company could see the work and shut it down. Once the capability has been copied and stood up at home, that authority disappears.
American hosting is worth defending for reasons that do not reduce to pride. The better model reaches our own operators first. The company that runs it can still shut off an account. It can also see hostile work while the traffic is still on an American stack. Those last two goods last only as long as hostile users still need the American model. The extraction campaigns exist to end that need. A lead has value only if the United States keeps moving, keeps its weights and methods from walking out the door, and puts the systems it already has into the hands of people who will use them. The present dependance is not a comfort. It is the thing the other side is spending millions of queries to abolish.
Winning, in that light, is not a mood. It is leading models, laboratories that can be secured, computing capacity that actually exists, electricity that shows up when the racks need it, and adoption fast enough that the Pentagon and critical-infrastructure operators are not waiting out a procurement cycle. It is also the unglamorous work of breaking the fraudulent access networks the report describes, and of treating organized distillation as the national-security problem the advisory says it is. President Trump’s AI Action Plan already joins innovation, infrastructure, and security in one frame, and its authors were right that the country with the largest AI ecosystem will write the standards everyone else has to meet. Gold Eagle, launched in July, is a working piece of that design, a clearinghouse that uses frontier models and government-industry coordination to find vulnerabilities and patch them before an adversary does. Treasury Secretary Scott Bessent has put the aim in plain language, harness frontier AI and stay ahead of the people who want to use it against us. Heritage Foundation work on the China competition has treated technological superiority as the cheap form of deterrence, cheaper than trying to match an opponent system for system after the gap has closed, and the files in this report are what that claim looks like in practice.
Infrastructure belongs here because computing is physical. Data centers draw power, and the administration’s expanded Ratepayer Protection Pledge is the right America First answer: build what the race requires, and make the data centers cover their attributable costs so households are not asked to subsidize the effort. Some conservatives are uneasy about the scale of this build-out, and I understand why the bills look large, the footprints look ugly, and the county fights are real; the unease is not frivolous. A smaller build-out does not produce a quieter world. It produces a world in which hostile services do the same work with tools as good as ours, or better, and answer to no one who can turn the system off.
Anthropic’s report spends 154 pages on what adversaries intend to do with the most powerful tool of the century. The response that fits the evidence is to make sure they never do it with the best version.
If you enjoy my work, please subscribe https://x.com/amuse/creator-subscriptions/subscribe
Alexander Muse is a Fellow at the John Milton Freedom Foundation and publishes daily political analysis at amuseonx.com. Primary sources cited in this piece are linked inline; campaign finance figures are drawn from FEC filings, polling data from publicly released crosstabs, and legal claims from filed pleadings. Corrections are posted to the original URL with a dated changelog. Readers who identify errors are invited to contact the author directly. Each op-ed edited for grammar and clarity using Ai in a sponsored partnership with Grammarly. Data provided in a sponsored partnership with Polymarket.
I mentioned the Houthi-linked use of Claude here today: https://foreignlocal.substack.com/p/the-oil-tanker-in-2024-was-a-warninga
Thankyou. Very concerning. Ain’t it !!