Anthropic Catches Russians Using Claude to Code Self-Targeting Drones

Anthropic said in a 154-page threat report published September 10 that a small freelance team in Russia, tracked as GTG-27005 and calling its project DronDoc or Serafim, used Claude Code to build software for a swarm of first-person-view kamikaze drones that selects its own targets, including people, and issues the detonation command without a human in the loop. The team, which began work in mid-May 2026 and routed traffic through commercial virtual private servers to bypass Anthropic's geographic blocks, used a location in Ukraine's Donetsk region as its demonstration strike point; Anthropic banned nine accounts and assessed the group as a freelance outfit doing mixed civilian and military work rather than a Russian state entity. Anthropic said the misuse involved its Haiku, Sonnet and Opus models and none of its Fable or Mythos-class models, and that the swarm never flew a live mission as far as the company knows.

A small freelance team in Russia used Anthropic’s Claude Code to write the software for a swarm of first-person-view kamikaze drones that chooses its own targets, including people, and issues the detonation command without a human in the loop, Anthropic said in a 154-page threat report published September 10. The team, which Anthropic tracks as GTG-27005 and which called its project DronDoc or Serafim, started work in mid-May 2026 and got around Anthropic’s geographic blocks by routing traffic through commercial virtual private servers. It repeatedly used a location in Ukraine’s Donetsk region as its demonstration strike point. Anthropic banned nine accounts and says the group was a freelance outfit doing a mix of civilian and military work, not a Russian state entity. Six months ago DroneXL reported Anthropic CEO Dario Amodei warning that AI could let one operator command a drone swarm. His own company’s report now describes a handful of people building exactly that coordination layer with his company’s tools. Anthropic Traced the Project to Freelancers, Not the Kremlin Anthropic says the DronDoc team ran nine accounts created between late 2025 and early 2026. The accounts were linked to a regional Russian university and a federal research center associated with the Russian Academy of Sciences. Anthropic assesses the group as a small freelance team rather than a state program. The team told Claude it was funded by Russia’s Advanced Research Foundation, the National Technology Initiative and the Ministry of Defence, according to Anthropic’s report https://www.anthropic.com/threat-intelligence-report-september-2026 . Anthropic says it could not verify those claims. The Advanced Research Foundation is Russia’s answer to DARPA, so if the claim holds, a state defense research fund paid for the work even if no state agency ran it. The case sits in the conventional-weapons section of a report that covers activity Anthropic disrupted between December 2025 and August 2026 across seven categories, from cyber operations to biological misuse. The company says the misuse involved its Haiku, Sonnet and Opus models and none of its Fable or Mythos-class models. The report says Anthropic shares what it learns from each case with authorities and industry partners where appropriate. Claude Code Wrote the Swarm Logic and an Onboard Attack Model The developers used Claude Code to write and test code straight into their own project files, alongside a software-in-the-loop simulator and a rented GPU. Claude helped them build shared swarm memory, fault-tolerant coordination, terminal guidance and an onboard language model deciding whether each drone attacks, observes or returns to base. The targeting stack was designed for what the report calls autonomous lethal engagement. The onboard model selects targets and issues the detonate command on its own, and its target classes explicitly include “person,” Cybernews reported https://cybernews.com/ai-news/claude-anthropic-russia-kamikaze-drones/ from the document. The team trained a computer-vision classifier on scraped Ukrainian combat footage, labeling targets as enemy or friendly and allow-listing Russian systems so the swarm would not attack its own side. Ukrainian front-line cities and corridors were the mission geography. That training set deserves a second look. Ukraine’s own units post thousands of FPV strike clips to prove the war is being fought and won, and in March Defense Minister Mykhailo Fedorov opened millions of them as a training dataset for Ukrainian AI targeting, a decision DroneXL covered in Fedorov’s Gamble https://dronexl.co/2026/03/13/ukraine-ai-drone-training-dataset-fedorov/ . Anthropic describes the DronDoc footage only as scraped from the internet. Either way, the same archive now trains both sides. The swarm never flew a live mission, as far as Anthropic knows. The company found evidence that code was loaded onto development boards and tested on real hardware, but the system stayed early-stage and was validated in simulation rather than deployed, Resilience Media reported https://resiliencemedia.co/claude-ai-helped-russia-based-threat-actors-develop-autonomous-kamikaze-drone-swarm/ from the document. A demonstration strike point in Donetsk is not a strike. Ukraine has fielded the mirror image of this for months. The Kolibri 10 Advance, which DroneXL reported in July, finishes its attack run without a pilot on the sticks https://dronexl.co/2026/07/21/ukraine-kolibri-autonomous-fpv-40-km/ , and Eric Schmidt’s Ukrainian venture was claiming a 70% kill rate for its AI-guided drones https://dronexl.co/2026/01/06/eric-schmidt-ai-drones-hit-70-kill-rate-ukraine/ back in January. Russia’s V2U kamikaze drone was running NVIDIA-based image recognition https://dronexl.co/2025/06/10/russian-ai-drone-nvidia-sony-ukraine/ near Sumy in June 2025. The difference in the Anthropic case is who built it and how fast: nine accounts and rented compute, starting in mid-May. A Second Russian Actor Stole a Complete Drone Vision SDK A separate case in the same report describes a Russian espionage group, tracked as GTG-20006, whose targeting Anthropic says is consistent with public reporting on Midnight Blizzard. Its recurring theft target was drone supply-chain technology, and its most common victims were Ukrainian government, military and diplomatic staff. The group bulk-exported the mailboxes of at least two drone component manufacturers, targeted a military drone maker, and stole a complete proprietary software development kit for a drone vision system. It then spent several days reverse-engineering that system, recovering the product architecture, the hardware bill of materials, the supplier list and details of an unannounced product. Military drone control firmware and AI vision firmware drew particular interest. To reach its targets the group compromised at least three hospitality vendors that run hotel guest Wi-Fi and hijacked their DNS so that guests were served malware for Windows machines and for both major phone platforms. Anthropic says the people it went after through that channel included Ukrainian officials and drone manufacturers, and Microsoft documented the same technique in July under the name CaptiveCrunch. The group also used AI to monitor its own malware and rewrite it automatically whenever a security product flagged it. The Report Landed as Jet Drones Hit Kyiv Gas Stations Anthropic’s disclosure arrived during a new phase of Russia’s bombardment of the Ukrainian capital. Two people were killed and 12 injured in Friday morning strikes on two Kyiv gas stations, following a similar attack on Thursday, Kyiv Mayor Vitali Klitschko said, The Guardian reported https://www.theguardian.com/world/2026/sep/12/ukraine-war-briefing-russian-developers-used-ai-to-build-kamikaze-attack-drone-software-anthropic-says . All three stations belonged to Ukrnafta, the state-owned oil and gas producer, and all three appeared on a list of 18 Kyiv gas stations that began circulating on Telegram on Wednesday. The attacks used the faster jet-powered drones Russia has been sending at Kyiv for two weeks, a class that includes the Geran-5 Ukrainian intelligence identified in January https://dronexl.co/2026/01/22/russia-geran-5-jet-drone/ . DroneXL’s Take I’ll start with the credit, because it’s real. Anthropic caught this and shut it down, then published it under its own name with the case number attached. Most companies whose product turns up inside a weapon never say a word, and none of its frontier models were involved. None of that changes what the case shows. The line between a human deciding to kill and a machine deciding to kill was not crossed here by the Pentagon or by a Russian design bureau. It was crossed, in software at least, by a freelance team the size of a startup’s engineering pod, using an off-the-shelf coding assistant and rented GPUs, in a few months. The report’s own trend section says the capabilities it describes “should be assumed to be available to any actors who are motivated,” and I read that as the operative sentence of the whole document. DroneXL has been on this arc since Ukraine’s GUR opened up the V2U in June 2025 and found an NVIDIA Jetson doing the target recognition. Every step since has moved the kill decision one notch further from the pilot, from the Kolibri finishing its run alone to Fedorov turning the strike archive into training data. What Anthropic adds is the cost curve. The engineering that took a state program in 2024 took nine accounts in 2026, and the blockers that stopped them were a geo-fence and a trust-and-safety team, not the difficulty of the work. I don’t buy the framing that this is an AI story first. It’s a drone story. The airframe is a commodity FPV quad, the same class of aircraft Ukraine builds by the hundreds of thousands and the same class hobbyists fly on weekends. What changed is that the expensive part, the autonomy stack, just became cheap too. The Amodei warning I covered in March https://dronexl.co/2026/03/13/anthropic-ceo-warning-ai-drone-swarm/ was about one operator commanding thousands of drones. The DronDoc case is about zero operators, and a classifier with “person” in its target list. The open question worth watching is the money. Anthropic says the team claimed grants from the Advanced Research Foundation, Russia’s defense research agency, and could not confirm it. If that funding is real, the freelance label describes the org chart and not the customer, and the Kremlin has found a way to get autonomous targeting built without a single state employee touching the keyboard. If it isn’t, nine people did this on their own. I’m not sure which answer is worse. Ukraine’s response is already in the field, and it’s the same stack pointed the other way. My read is that the side with more combat footage and a defense minister willing to open the archive keeps the edge. That’s Ukraine, for now. Anthropic’s report is a reminder that the edge is measured in months. Sources: Anthropic https://www.anthropic.com/threat-intelligence-report-september-2026 , The Guardian https://www.theguardian.com/world/2026/sep/12/ukraine-war-briefing-russian-developers-used-ai-to-build-kamikaze-attack-drone-software-anthropic-says , Cybernews https://cybernews.com/ai-news/claude-anthropic-russia-kamikaze-drones/ , Resilience Media https://resiliencemedia.co/claude-ai-helped-russia-based-threat-actors-develop-autonomous-kamikaze-drone-swarm/ DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo. Read our editorial standards /editorial-standards/ .