By Frederic Lemieux

Introduction

In September 2026, two events converged to draw attention to artificial intelligence in irregular warfare. On 8 September, Houthi forces launched a wave of missile and drone strikes on southern Saudi Arabia [1]. Two days later, Anthropic published its fourth threat intelligence report [2]. The report described a northern Yemen weapons cell that used the company’s Claude models for missile guidance software [2]. Media coverage rapidly fused these two developments into a single narrative. One headline stated flatly that the Houthis had used Anthropic’s AI to develop ballistic missile software [3]. Others implied that a large language model (LLM) had built the weapons that struck Saudi territory. This article examines that claim with care. It separates what the public record establishes from what it merely suggests. It then reflects on what the episode means for small armed groups with limited resources.

The September 2026 Strikes on Saudi Arabia

On 8 September 2026, Houthi forces attacked Abha, Khamis Mushait, Jazan, and Najran in southern Saudi Arabia [4]. The Saudi-led coalition reported 73 people injured, including women and children [1, 4]. The Saudi energy ministry reported fires at several facilities and a temporary halt to some operations [4]. The Houthi military spokesperson said the offensive targeted Aramco facilities in Abha, Najran, and Jazan [1]. He also cited an air base in Khamis Mushait and said dozens of ballistic missiles and drones were fired. Reuters reported that the Houthis had been attacking Saudi Arabia since declaring a naval blockade against Riyadh in July [4]. Riyadh described the escalation as dangerous and vowed a firm response [4]. Oil prices rose amid concern over the widening regional conflict and risks to Saudi energy infrastructure [5]. Nothing in the public reporting on these strikes links them to LLM-assisted weapons. The weapons described were ballistic missiles and drones of the type the Houthis have fielded for years. The United Nations Panel of Experts on Yemen has documented the Iranian origin of key Houthi systems and components [6]. Its 2020 report found that the Houthis continued to receive parts and complete systems through intermediaries [6, 7]. The September 2026 strikes are therefore best understood as the continuation of a mature, externally supplied arsenal.

What the Anthropic Report Documents

Anthropic’s report, published on 10 September 2026, covers activity disrupted between December 2025 and August 2026 [2]. One case, designated GTG-87001, concerns a cell of threat actors based in northern Yemen [2]. Anthropic did not identify the actors as members of the Houthi movement. Reuters noted that the report did not state whether the actors were Houthis [8]. Nor did Anthropic publicly establish a command relationship with Houthi institutions. The activity occurred in territory largely controlled by the Houthis, so a Houthi connection is plausible [9]. It should nonetheless remain an assessed inference rather than a stated fact. The public record supports describing the actors as a northern Yemen weapons development cell. According to Anthropic, the cell ran three parallel weapons programs [2]. The first was a guided rocket built around a commodity phone-class flight computer with final-phase homing. The second was a multi-stage ballistic missile with a stated range goal above 2,000 kilometers. The third was a multi-variant missile set, labeled “R2000,” which included a hypersonic glide vehicle variant.

The most significant finding concerns the division of labor. Anthropic reports that the actors used Claude Code in place of human software engineers [2]. This applied to portions of the guidance, navigation, and control (GNC) work. In practice, they used Claude to integrate an open-source autopilot onto the phone-class flight computer. Claude wrote control and position estimation software, tuned control settings, and ran a firmware build pipeline [2]. It also performed a flight simulation [2]. Anthropic reported that the actors took steps to avoid revealing the project’s end use [2]. They hid their goals and the products the software was meant for. They split their work across multiple sessions so that no single session exposed their full intent. The company also reported that they ran multiple Claude instances with distinct roles for coding, research, and review [9]. Anthropic acknowledged that its safeguards blocked many of the cell’s requests, but not all of them [8]. Reuters summarized the model’s role as coding, simulation, and troubleshooting [8].

A live test occurred. Anthropic stated that the cell test-fired a guided rocket and that the test appeared to have failed [2]. Within hours, the actors returned to Claude to determine what had gone wrong. Anthropic identified the activity through an internal investigation into suspected weapons development. It banned the accounts and shared threat information with public and private sector partners.

What the Evidence Does and Does Not Establish

The public evidence has clear limits. Anthropic reported no evidence that the actors fielded an operational device developed with Claude [2]. It stated that a guided-rocket test fire occurred but appeared to have failed. The report identifies a northern Yemen cell rather than naming the Houthis or individual participants. Public attribution is therefore limited to a northern Yemen cell. Anthropic did not name Houthi personnel or establish a command relationship.

The Houthis have denied the account. A member of the group’s political bureau called reliance on open-source tools “unreasonable and illogical” [9]. He stated that the movement’s production capabilities were built independently over the course of the war [9]. Independent analysts add further caution. A weapons researcher at Armament Research Services said the Houthis lack the industrial base for hypersonic systems [9]. He observed that even United States hypersonic programs remain in testing. In his view, the likelier motive was reducing dependence on Iranian shipments of components. Iran denies arming the Houthis, but Iranian weapons have been found in Yemen and seized from shipments bound there. A second analyst, Adam Baron of New America, cautioned against underestimating the group. He described the Houthis’ emergent use of Claude as one sign of deepening institutional technical capacity [9].

These limits do not make the episode insignificant. They define its significance. The documented case is an attempted and disrupted AI-assisted weapons development effort. It is not proof that an LLM-enabled weapon was operationally deployed. The claim that the Houthis used an LLM to bomb Saudi Arabia is therefore not supported. What the record supports is narrower but still consequential. A cell inside Houthi-controlled territory used a frontier LLM for parts of its guidance software work. It did so across three programs over roughly eight months and reached live testing before detection. Anthropic also found that the actors had built an offline simulation toolkit before the ban [2, 9]. Parts of the work therefore no longer depended on Claude when the accounts were closed.

Implications for Small Armed Groups with Limited Resources

The Yemen case is best read as an early warning rather than a proof. Its importance lies in a possible change in the economics of weapons development. What follows is assessment rather than source-established fact. Six implications are proposed. Labor substitution is conditional, not total. The central dynamic is not that an LLM has eliminated the need for weapons engineers. Rather, Anthropic reports that the cell used Claude in place of software engineers for portions of GNC work [2]. This suggests that capable models can reduce bottlenecks in coding, simulation, and software integration. But the effect is conditional. The actors still required hardware, testing opportunities, technical judgment, and access to components. In the available evidence, AI functioned as an accelerator layered onto an existing physical and technical base. It was not a complete substitute for one.

The Yemen case was not isolated within the report. Anthropic described several other conventional weapons cases in the same period [2, 8]. Likely freelance Russia-based actors used Claude to write software for an autonomous swarm of first-person-view attack drones [8]. That software covered terminal guidance, target selection, and coordination among aircraft. China-based actors used Claude for air-defense suppression software and fire-control software for an anti-torpedo system [8]. In each case, the model supplied software for a weapon whose hardware existed or was being sourced elsewhere. The pattern is therefore documented in weapons software specifically, not only in cyber operations. Anthropic’s cyber findings point the same way. The company reports that AI has narrowed the gap between well-resourced state cyber operations and individual operators [2]. Google’s threat intelligence group has reached a comparable view on adversarial AI use in cyber operations [10]. How far this extends beyond software into physical production remains an open question.

Hardware remains the binding constraint. The Yemen case shows what LLMs cannot yet do. They cannot manufacture solid rocket motors, machine airframes, or produce seekers. Materials, manufacturing, propulsion, sensing, and test infrastructure still matter. This suggests a stratified future. Groups with access to smuggled components, such as the Houthis, would gain the most. Groups without a supply chain would gain a design capacity they cannot realize. The near-term risk therefore appears to concentrate in proxies of states willing to ship parts. Commodity hardware lowers the floor. The guided rocket used a phone-class flight computer and an open-source autopilot [2]. Both are widely accessible, although legality depends on jurisdiction, end use, and export controls. An LLM that can integrate these components may turn hobbyist hardware into a weapons subsystem. This resembles the trajectory of first-person-view drones in Ukraine. The difference is that part of the integration work can now be delegated to a model. For a small group, this could change the calculus of what counts as an achievable project.

Evasion techniques may spread faster than safeguards. The reported tradecraft was simple. The actors concealed the end use and fragmented work across sessions and instances [2]. None of these techniques requires expertise. Each can be described in a short manual and shared. Anthropic notes that several operations in its report ran on publicly available agent frameworks. It states that the capabilities described should be assumed available to any motivated actor. That warning was written about cyber operations, but the logic plausibly extends to other domains. Offline capture reduces the value of account bans. The most durable lesson is the offline simulation toolkit [2, 9]. Bans may not erase previously obtained code, workflows, or know-how. Actors may also seek alternative tools or services after disruption. Detection and banning therefore impose delay rather than denial. For a small group with patience, delay is manageable.

Counter-proliferation may need to adapt. This is a policy implication, not a confirmed finding. Export controls on missile technology were designed around physical goods and specialized knowledge. Neither framework easily captures a coding agent running on a laptop. A plausible response is to supplement AI-platform safeguards with stronger attention to physical bottlenecks. These include engines, propellant precursors, seekers, and flight computers. Routine intelligence sharing between AI developers and governments, as occurred here, would also help [2]. Finally, analysts should resist both overstatement and complacency. The Houthis did not bomb Saudi Arabia with an LLM. But a cell in their territory reached a live test with model-assisted software. The next such cell may not be detected in time.

Conclusion

The September 2026 record contains two related but distinct developments. On 8 September, the Houthis carried out missile and drone attacks in southern Saudi Arabia [1, 4]. These caused 73 reported injuries and disruption at energy facilities [4]. Separately, Anthropic disclosed that it had disrupted a northern Yemen cell using Claude in attempted guided-weapons development [2]. That effort included a rocket test that apparently failed. The public record does not establish that the weapons used in the Saudi strikes were developed with an LLM. It does show that advanced AI can assist parts of a weapons development workflow. Software, simulation, and troubleshooting are the parts in question. That assistance applies where an actor already has access to physical systems and expertise. For small armed groups, that conditional lowering of software barriers is the real strategic development.

References

[1] Associated Press. (2026, September 8). Houthi attacks on Saudi Arabia ignite fires at oil facilities and wound 73 people. Wire report published by NPR. https://www.npr.org/2026/09/08/g-s1-142296/houthi-attacks-saudi-arabia

[2] Anthropic. (2026, September 10). Detecting and countering misuse of AI: September 2026. Threat intelligence report. https://www.anthropic.com/threat-intelligence-report-september-2026

[3] Middle East Eye. (2026, September 11). Houthis used Anthropic AI to develop ballistic missile software, says report. Live blog update. https://www.middleeasteye.net/live-blog/live-blog-update/houthis-used-anthropic-ai-develop-ballistic-missile-software-says-report

[4] Reuters. (2026, September 8). Houthi attacks disrupt Saudi energy facilities, wound 73, authorities say. Wire report published by Al-Monitor. https://www.al-monitor.com/originals/2026/09/houthi-attacks-disrupt-saudi-energy-facilities-wound-73-authorities-say

[5] CNN. (2026, September 8). Scores wounded as Iran-backed Houthis attack Saudi Arabia in major regional escalation. https://www.cnn.com/2026/09/08/middleeast/houthis-attack-saudi-arabia-yemen-intl-hnk

[6] United Nations Security Council. (2020, April 28). Final report of the Panel of Experts on Yemen (S/2020/326). https://documents.un.org/doc/undoc/gen/n20/106/86/pdf/n2010686.pdf

[7] Nadimi, F. (2020, February 13). The UN exposes Houthi reliance on Iranian weapons (PolicyWatch 3261). The Washington Institute for Near East Policy. https://www.washingtoninstitute.org/policy-analysis/un-exposes-houthi-reliance-iranian-weapons

[8] Baptista, E., & Vicens, A. J. (2026, September 11). How Anthropic says Claude was used for weapons, spying and cyber operations. Reuters. https://www.reuters.com/world/china/how-anthropic-says-claude-was-used-weapons-spying-cyber-operations-2026-09-11/

[9] El Deeb, S. (2026, September 11). Users in Houthi-held Yemen tried to develop advanced weapons with AI, Anthropic says. Associated Press. https://apnews.com/article/yemen-houthis-anthropic-ai-missiles-9b20934e031ff3d99dd8bb49d85d97a9

[10] Cyber Magazine. (2026, September). Google: AI now powers every threat actor’s playbook.