Intelligence Targeting Conventional Weapons Capabilities

Measuring AI capabilities in intelligence targeting and conventional weapons \ Anthropic Frontier Red Team Measuring tactical intelligence targeting and conventional weapons capabilities of AI models Sep 10, 2026

Anthropic’s Frontier Red Team developed new evaluations to measure AI capabilities in tactical intelligence targeting (like finding where people are based on fragmentary information) and conventional weapons development (like engineering drones to strike a moving target). For some tasks in military and intelligence domains, models could do things that, historically, only a set of scarce, highly-trained human experts could do. These evaluations show how models have become useful to actors seeking to misuse our platform for surveillance and conventional weapons development. They also show why on-platform safety measures are necessary, like the new classifiers we have implemented to block such misuse. Although open-weights models from PRC developers that we tested were behind the frontier, they also showed concerning ability to identify and target adversaries, and improve weapon performance.

Cybersecurity and biorisk are among the best-studied domains of risk from misuse of AI. But most of modern conflict occurs in more conventional realms. Adversaries try to identify and target one another to collect intelligence. Combatants try to make conventional weapons more precise and less vulnerable to countermeasures. “Kill chains,” such as “find, fix, track, target, engage, assess,” are end-to-end conceptual models of these engagements. Making improvements in any step of this process has typically required expert human labor and judgment: experienced intelligence analysts or highly-trained engineers, for example. As AI shows tremendous progress in data analysis, software development, and coding, can it apply these skills to the specialized domains associated with national security? A new report from Anthropic’s Threat Intelligence Team suggests the answer is yes. It includes instances of AI misuse in surveillance and conventional weapons development which show threat actors already perceiving benefit from the use of AI models. The Frontier Red Team has developed some complementary capability evaluations to better illustrate how AI progress is changing the risk landscape across different parts of the kill chain. The evaluations show that models are making consistent progress on simulated intelligence and weapons development tasks. Open-weights models we tested on the same evaluations are behind the frontier (typically between Sonnet and Mythos-class models in performance), but often still capable of concerning levels of capability. Models well short of the frontier will have intelligence and military applications. Looking ahead, we do not think capabilities are about to plateau. Instead, we should consider the potential for AI to make substantive contributions to more novel and geostrategically consequential breakthroughs in the intelligence and military domains. The development of these capabilities may affect how models should be trained, safeguarded, and released, or used to preserve stability and liberty. The rest of this post expands on the research and results underlying these conclusions. Models as targeters In an intelligence agency, the core job of a targeter is to find and fix people and things. "Find" means identifying targets of interest (a person, an account, a facility, a vehicle) and building enough of a picture to know who or what they are and why they matter. "Fix" means pinning them to a place and time precisely enough to enable further intelligence collection or disruption of their activities. Targeting sits at the front of the intelligence cycle, before collection and analysis, and it is where a significant amount of the labor goes. This process has been historically labor-intensive, specialized, and expensive. 1 Because of this, much of what protects people, programs, and facilities from intelligence targeting is not secrecy so much as cost. Extensive data useful for deanonymizing and targeting individuals is freely available online, cheaply purchasable, or likely to be held by an adversarial intelligence organization. But the analyst labor required to search and correlate that data has been expensive. If models can make intelligence targeting labor less scarce and widely available, they could enable individual and small group threat actors previously incapable of these workflows, and augment the ability of well-resourced actors to take full advantage of previously underutilized data holdings. Both shifts could expose a larger group of people to new levels of scrutiny. Identity correlation and classification An important task in the “find” portion of a targeting workflow is to identify linked accounts: different digital personas that belong to the same person. This enables development of a richer profile and more accurate pattern of life. This information can classify the underlying individuals into categories: are they targets of interest with access to useful information? Close associates of the targets who could be indirectly useful? Or part of the background and not directly relevant for an investigation? We developed an evaluation to assess models’ capabilities at two tasks: correlation of accounts on different platforms and classification of individuals into categories of interest. We use model-generated, simulated social media content produced to emulate users’ activities across several platforms (WhatsApp, Telegram, Instagram, and Facebook). This pipeline generated 200 tasks across two fictional scenario worlds (protest movement corpora from Mexico City and Kolkata), at three difficulty tiers based on factors like the number of accounts and the sparseness of evidence linking them (68 easy, 68 medium, 64 hard). 2 We evaluate both identity correlation and individual classification by F1 (the harmonic mean of precision and recall).

On the account linkage task, Mythos Preview is the top performing model we tested, with the smallest gap between its actual performance and the theoretical maximum across easy, medium, and hard samples (the design of the synthetic data pipeline means that perfect linkage and identification are very unlikely to be possible). Kimi K3 performs about as well as the frontier on easy and medium samples, but its performance lags when the task is made more difficult by samples with more noise and better operational security by the...