Anthropic TI GTG-30005: Iran-nexus actor used Claude to build US Navy targeting handbooks
Anthropic’s September 2026 Threat Intelligence report (Detecting and countering misuse of AI; activity December 2025–August 2026) case GTG-30005 covers an Iran-nexus threat actor that used Claude to collect and analyse publicly accessible data to develop targeting recommendations against US naval forces in the Middle East. Anthropic says the actor built a Claude-assisted Python pipeline to compile targeting handbooks: US personnel rosters scraped from captions on public military photographs; publicly accessible ship and aircraft transponder identifiers; commercial satellite-imagery query scripts; and an inventory of public sites exposing US naval movements. The same case directed Claude at vulnerability research on shipboard systems (known CVEs in maritime VSAT terminals, Cisco communications equipment, and industrial control products). Anthropic disrupted the activity, banned associated accounts, and shared threat info with partners. Wire coverage (TWZ / WSJ) notes the dual-use account also touched domestic surveillance tooling in the same report cluster; this card is the naval-targeting case only. Distinct from anthropic-yemen-weapons-gnc-20260911 (northern Yemen GNC), anthropic-shinyhunters-apk-20260911, and anthropic-gtg20006-midnight-blizzard-20260911 (same TI report, different cases). Primary: Anthropic TI; secondary: The War Zone summary of the GTG-30005 naval case.
- Product
- Anthropic Claude (misuse for OSINT naval targeting / maritime vuln research)
- Versions
- n/a (account misuse; not a product CVE)
- Exploited in Australia?
- unknown
- Patch to
- n/a for end-users; Anthropic banned associated accounts and shared partner intel; maritime operators: review exposure of VSAT/Cisco/ICS CVE surface and public movement OSINT
Primary: Anthropic — Detecting and countering misuse of AI (Sep 2026 TI) · Vendor: Anthropic Threat Intelligence · The War Zone — GTG-30005 naval targeting + Yemen GNC context (Sep 2026)