admin The artificial intelligence company disclosed the case in a September threat-intelligence report describing five instances in which researchers used, or attempted to use, Claude for work that could support biological weapons development. Anthropic stressed that it had not established malicious intent and withheld the scientists’ identities, institutions and countries because biological research can have legitimate medical purposes.
The chikungunya request, detected in May, concerned gain-of-function work designed to identify mutations, engineer them into infectious virus clones and test variants for properties including transmissibility, immune evasion and virulence. Information in the proposed application indicated that civilian researchers were involved but that the work was intended to be carried out at a military research institute, according to Anthropic.
Its biological safety classifier blocked exchanges associated with the grant-writing request. A subsequent investigation found that the researcher was accessing Claude through a platform serving life-sciences users in regions where Anthropic does not provide its service. The platform routed traffic through United States infrastructure and used other methods intended to conceal users and bypass regional restrictions.
Anthropic said the platform’s customers included virologists connected with civilian and military institutions. It later found that the operator had built a fallback system directing sensitive biology prompts rejected by Claude to another company’s model with more permissive safeguards. Anthropic banned associated accounts, worked with partners to disrupt relay networks and shared information with affected AI companies and government authorities.
The company said the research nevertheless continued, with weaker Claude models providing limited editorial, data-analysis and study-design assistance. It assessed that those models did not offer expert-level biological capabilities and therefore gave the researchers substantially less help than more advanced systems might have provided.
The disclosure matters because Anthropic says older Claude models were previously assessed as too weak to meaningfully assist sophisticated biological research, whereas newer systems have advanced enough that the company no longer makes that assurance.
Anthropic said the episode offered evidence that active laboratory programmes involving potentially enhanced pathogens were seeking access to frontier AI systems while attempting to hide their identities. It did not say the chikungunya project was a biological weapons programme, and acknowledged that similar experiments can contribute to vaccines, therapies and understanding how viruses evolve.
Chikungunya is a mosquito-borne viral disease that commonly causes fever and severe joint pain. The World Health Organization says most patients recover, although joint pain can persist for weeks, months or longer, and severe complications can occur in vulnerable patients. Because the virus circulates naturally in many regions, Anthropic said a deliberate release could be difficult to distinguish from a natural outbreak.
The four other biological cases described by the company included a researcher studying highly pathogenic avian influenza adaptation to mammals; an application involving orthopoxvirus immune evasion; work using AI to catalogue and optimise venom peptides; and a programme computationally redesigning toxins while deliberately keeping the identities of biological agents vague in progress reports.
Anthropic said some of those activities proceeded because safety classifiers face a fundamental problem in advanced biology: the same technical knowledge can support medicine or harmful applications. It said newer, more capable models are therefore subject to stronger biological safeguards and, for some advanced research, access restrictions based on verified users and institutions.
The company has progressively tightened protections as its models have improved. Its Responsible Scaling Policy requires stronger deployment controls when systems may materially assist people seeking chemical or biological weapons, while its latest biology safeguards divert or block classes of dual-use queries that could create unacceptable risk.
