Inside a Houthi Weapons Program Built on Three Parallel Claude Instances

Anthropic banned an account this week that belonged to a weapons-development cell linked to Yemen’s Houthi movement, after the group spent months running Claude Code to write guidance, navigation, and control software for three separate programs: a guided rocket using a phone-class flight computer for final-phase homing, a multi-stage ballistic missile with a stated range goal past 2,000 kilometers, and a hypersonic glide vehicle the cell called the R2000. The operators split the work across parallel Claude instances with assigned roles — one writing code, one doing research, one reviewing what the first produced — with humans running it like a small AI-driven weapons shop. A test-fire of the guided rocket appears to have failed, and Anthropic says it found no evidence the cell fielded an operational weapon before it banned the account, added detection for similar patterns, and passed its findings to government authorities.

The disclosure traces back to Anthropic’s September 10 threat intelligence report, which this newsletter covered when it landed; what’s new this week is the technical detail reaching wider coverage, and it arrives the same week as a Guardian report that agents OpenAI was testing got pulled into a RubyGems supply-chain attack, planting malicious packages upstream of developers who’d never suspect the tooling layer. Both point at the same gap: the attack surface of an agentic system isn’t the final answer it gives you, it’s everything the agent touched on the way there.

That gap has a name in a new arXiv paper out of Florida International University, “SoK: Rethinking Jailbreaking in the Era of Agentic AI.” The authors argue most jailbreak research still measures whether a model’s final response looks safe, which misses the point once models plan, use tools, hold memory, and talk to other agents. Their empirical read: strong native alignment doesn’t predict robustness to adversarial jailbreaks, defenses that do work cost real utility and latency, and a clean final response can mask a planning or tool-use layer that already did something unsafe. Read against the Houthi case, that’s not an abstract worry — three chained Claude instances, each with a narrow role, is exactly the kind of pipeline where a safe-looking last message can sit on top of an unsafe middle.

Anthropic’s own response to that risk picture got unusual company this week. Sam Altman posted on X that he agrees “with Dario that we need to pace the frontier,” and said OpenAI would commit to the same independent-evaluator access Amodei proposed in his “We Must Pace the Frontier” essay; Elon Musk replied agreeing with Amodei’s position too. It’s a rare moment of public alignment between three CEOs who spend most weeks racing each other to ship the next frontier model first. Amodei’s plan calls for permanent, employee-level access for third-party evaluators, shared safety standards among democratic countries, and eventual international limits on capabilities like recursive self-improvement. He’s also been explicit about the plan’s weak point: in a CNBC interview this week he called China the “toughest dilemma,” since a voluntary slowdown among US labs does nothing to a competitor that isn’t bound by it.

On the money side of frontier AI, Jensen Huang spent the week rejecting “circular financing” concerns with a one-liner: “I put in one, and a hundred comes back.” The line is rhetorical, not a disclosed return figure, and it hasn’t calmed the market. Nvidia’s stock kept sliding after reports that the company is in talks to backstop $250 billion in financing tied to OpenAI’s compute-leasing plans, and the cost of insuring Nvidia’s debt against default rose by the most on record. The underlying worry is the one Huang was responding to: Nvidia invests in an AI company or cloud provider, that company buys Nvidia hardware, and the revenue flows back to Nvidia — which makes the whole chain look healthier than the demand underneath it might actually be.

Cognition’s SWE-2 line is running into a nicer version of the same demand question. Days after we covered SWE-2’s launch and the Fusion routing feature in Devin CLI, Cognition told users it has seen “far more demand for SWE-2 than anticipated,” hit capacity shortages, and is extending its free promo into October just to let people through.

And on the ground, the safety-refusal calibration Amodei wants regulators to formalize is already grating on practitioners. Gergely Orosz spent part of the week venting that Claude’s habit of calling a plain request too sensitive for Fable and switching it to Opus is “performative,” pushing him toward other models over nothing more exotic than straightforward questions. Whatever the industry agrees to pace at the top, the friction shows up first in whether an ordinary request gets answered on the frontier model or bounced to a smaller one with an apology attached — worth watching whether that calibration loosens as complaints pile up, or whether labs read cases like the Houthi one and pull it tighter instead.