Anthropic Research on AI Capabilities in Intelligence Targeting and Conventional Weapons

Anthropic's Frontier Red Team has developed new evaluations to measure AI capabilities in tactical intelligence targeting and conventional weapons development. The research demonstrates that frontier models can now perform tasks—such as identifying individuals from fragmentary data and engineering drone guidance software—that historically required highly trained human experts, thereby lowering the barrier for threat actors to conduct surveillance and develop precise weaponry.

AI Capabilities in Intelligence Targeting

Intelligence targeting involves the "find" and "fix" stages of the intelligence cycle: identifying targets of interest and pinning them to a precise location and time. Anthropic found that AI models can significantly reduce the labor and cost associated with these processes.

Identity Correlation and Classification

Using simulated social media content from fictional scenarios in Mexico City and Kolkata, Anthropic evaluated models on their ability to link different digital personas to the same individual and classify them into categories of interest.

  • Performance: Mythos Preview emerged as the top performer, showing the smallest gap between actual performance and the theoretical maximum. Kimi K3 performed comparably to frontier models on easy and medium tasks but lagged on harder samples with more noise and better operational security.
  • Efficiency: The models demonstrated massive speed advantages over humans. For a median sample of 37,000 words—which would take a human analyst approximately 2.5 hours to read—Claude Mythos Preview produced a complete assessment in an average of 11 minutes.

Geolocation from Visual and Textual Data

Anthropic tested the ability of models to "fix" targets using photos and text without relying on metadata or reverse image search.

  • Photo Geolocation: Using the YFCC100M Flickr dataset, the research found that frontier models are approaching superhuman capabilities. Mythos Preview and Mythos 5 achieved median distance errors of 37.0 km and 47.2 km, respectively, beating the strongest human baseline (Champion Division GeoGuessr players at 151 km).
  • Text-to-Geolocation: Using the GeoText corpus, models were asked to locate users based on their posts. Mythos Preview, Mythos 5, and Opus 5 performed best, with median home location errors around 20-21 km. The study found that 8% of users were reliably placed within 1 km of their home, often through mentions of campus affiliations, local dialects, or specific venues.

AI Capabilities in Conventional Weapons Development

Anthropic evaluated the ability of models to write and iterate on Guidance, Navigation, and Control (GNC) software for simulated quadcopter drones. This research focuses on the software bottleneck of weapons development rather than physical manufacturing.

Terminal Guidance and Strike Rates

Models were tasked with writing code to perceive, track, and strike a target vehicle using only a forward camera, IMU, and barometer.

  • Results: Opus 5 was the most successful, achieving an 80% strike rate on parked, high-visibility targets and a 20% overall strike rate across all nine settings. In contrast, Sonnet 5 had a 0.7% overall strike rate.
  • Technical Approach: Opus 5 outperformed other models by implementing smaller, iterative code edits (9% of lines per launch vs. 25% for Mythos Preview) and utilizing advanced solutions like proportional navigation, target state Kalman filters, and its own internal physics model to test controllers before flight.

Payload Delivery and GPS-Denied Navigation

  • Payload Drops: Models were evaluated on their ability to drop a simulated payload within a 5-meter lethal radius. While most models succeeded with static targets, Opus 5 was the only model to maintain regularity in the hardest setting (weaving targets under wind gusts), succeeding in 28% of sorties.
  • GPS-Denied Flight: Models were tested on navigating to waypoints when GPS is jammed or spoofed. Frontier models (Opus 5, Mythos 5, Mythos Preview) could detect sensor disagreement and dead-reckon using the IMU, whereas weaker models like Sonnet 5 and Kimi K3 continued to trust spoofed GPS signals, ending over 100 meters from their destination.

Implications for Safety and Policy

Anthropic concludes that the ability of AI to substitute for scarce expert labor in intelligence and military domains creates significant risks for privacy and global stability.

Model Safeguards

Due to the evidence of misuse, Anthropic's Safeguards team has implemented new classifiers specifically designed to detect and block requests related to weapons development. The lab notes that because these engineering capabilities are dual-use, classifiers will be imperfect but are necessary for risk mitigation.

Open-Weights Risks

The research highlights a concerning trend in open-weights models. While models like Kimi K3 generally trail frontier models, they still exhibit capabilities that could be useful to threat actors. Anthropic argues that the democratization of military-relevant expertise via open-weights models warrants careful consideration and more robust safety research.

Geostrategic Considerations

Anthropic suggests several policy and strategic responses to these findings:

  • Compute Governance: Protecting the advantage in compute (chips and chipmaking equipment) to limit the progression of authoritarian AI.
  • Legal Updates: Updating pre-AI era laws and checks to address the decoupling of expert human labor from mass surveillance.
  • Defensive AI: Developing frontier model intelligence to aid defenders in privacy and physical security, mirroring the approach taken in cybersecurity.

Sources