← The Red Lens: every edition

14 October 2026 · Issue 19

Anthropic Reports AI Assisted Yemeni Weapons Development

Markdown · JSON · RSS · For agents

Each reference carries its source's own evidence class. A story is never summarised by its strongest source.

Summary

Anthropic reports that threat actors in northern Yemen used Claude Code to assist in three weapons development programs, including a guided rocket and a ballistic missile, though the company states it found no evidence of a successfully fielded operational device [1, 2]. Security firm XBOW says its researchers used a public OpenAI model to build a full-chain Chrome exploit in six days, earning a $250,000 bounty from Google [3, 4]. Dark Reading details a Russian influence operation targeting Latin America that used AI to create fake government documents and spoofed emails [5]. Tencent Zhuque Lab published a write-up for a Linux kernel flaw, Vghost, which allows local users to gain root access and potentially escape virtual machine boundaries [6].

Main story: Anthropic Reports AI Assisted Yemeni Weapons Development

Anthropic’s threat-intelligence report states that threat actors based in northern Yemen used Claude Code to support three weapons development programs between December 2025 and August 2026 [1]. Anthropic says the actors used the AI to integrate open-source autopilot software, write control code, tune parameters, and run flight simulations [1, 2].

The report notes that the actors evaded safety controls by concealing the broader purpose of their work and dividing tasks across multiple sessions. Anthropic states it found no evidence that the cell successfully fielded an operational weapon, although the group did test-fire a guided rocket that appeared to fail. The actors returned to Claude within hours of the failed test to diagnose the issue. Anthropic banned the associated accounts and shared intelligence with partners, but it did not definitively identify the actors as members of the Houthi movement [1, 2].

Supplemental

XBOW Uses Public AI Model for Chrome Exploit

Security firm XBOW says its researchers used AI agents running OpenAI’s publicly available GPT-5.6 Sol model to build a full-chain Chrome exploit in six days. The chain combined three bugs to execute code on a Windows computer from a web page, crossing both Chrome’s internal sandboxes. Google confirmed the bugs, fixed them, and paid XBOW a $250,000 bounty, the first of its kind under the Chrome Vulnerability Reward Program. XBOW estimates the AI compute cost for the campaign was approximately $40,000 [3, 4, 7].

Russian Influence Operation Targets Latin America

Dark Reading reports on a Russian influence operation that widely targeted Latin America using AI-enabled methods. The operation used spoofed emails, fake government documents, and the creation of a local organization to target schools in Peru and Ecuador [5].

Linux Kernel Flaw Vghost Allows Root Access

Tencent Zhuque Lab published a write-up for a Linux kernel flaw named Vghost, tracked as CVE-2026-74580. The bug in the vhost subsystem allows a local user to read and write kernel memory and escalate to root across kernel versions from 4.11 to 7.2-rc4. In specific virtualization setups, the flaw also allows an untrusted virtual machine to write to the host’s memory and hijack the QEMU process. Tencent released a fix on August 3 and published working demos of the attacks on October 12 [6].

References

  1. Anthropic Admits AI Helped Houthis Develop Missiles That Could Correct Their Course - Gadget Review · www.gadgetreview.com · threat intel report · 2026-10-14 · RL-I-2026-0637 · archived
  2. Warheads used by militants behind airport bombing were made using AI | News World | Metro News · metro.co.uk · threat intel report · 2026-10-13 · RL-I-2026-0637 · archived
  3. Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days · thehackernews · threat intel report · 2026-10-14 · RL-I-2026-0649 · archived
  4. XBOW researchers used AI agents to win a $250,000 Chrome exploit bounty - Startup Fortune · startupfortune.com · threat intel report · 2026-10-14 · RL-I-2026-0649 · archived
  5. Russian Influence Operation Widely Targeting Latin America · darkreading · threat intel report · 2026-10-14 · RL-I-2026-0648
  6. AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host · thehackernews · threat intel report · 2026-10-14 · RL-I-2026-0650
  7. XBOW Wins Google's $250,000 Chrome Bounty With GPT-5.6 Sol - FourWeekMBA · fourweekmba.com · vendor claim · 2026-10-13 · RL-I-2026-0649