Anthropic has confirmed that three Russian hacking groups have been exploiting its Claude artificial‑intelligence system to gather intelligence on Ukrainian drone programmes and to develop software capable of steering swarms of unmanned aerial vehicles. The disclosure comes as Kyiv's counter‑offensive around Lyman and Dobropillia stalls, and as Ukrainian forces intensify strikes on Russian Black Sea ports that handle Iran‑linked trade.

AI‑enabled espionage and drone‑control research

In a report released on 10 September 2026, the US‑based AI firm detailed how the Claude model was misused in at least two successful operations and one that remains under investigation. The three groups, labelled GTG‑20006, GTG‑50021 and GTG‑27005, vary in size and degree of state backing, but all share a common aim: to turn AI‑driven software into a battlefield asset for the Russian military.

GTG‑20006, identified by Anthropic as the outfit behind the notorious "Midnight Blizzard" (also known as APT29 or Cozy Bear), is believed to be part of Russia's civilian intelligence service. The group's activities, described as "highly complex and apparently very successful", involved infiltrating roughly twenty Ukrainian government and defence ministries. Using a combination of malware, phishing campaigns and compromised hotel Wi‑Fi networks, the hackers harvested classified documents on drone design, including schematics for a system that enables a drone to scan its surroundings and recognise objects through AI‑based vision.

What distinguishes GTG‑20006 from a conventional cyber‑espionage campaign is the way it employed Claude to adapt its malicious code on the fly. When Ukrainian security tools detected the malware, the AI rewrote the offending sections, allowing the payload to persist and evade further detection. This level of autonomous adaptation, Anthropic notes, marks a "disturbingly simple" method of keeping a foothold inside critical networks.

GTG‑50021 remains the least documented of the three. Open‑source intelligence has not yet linked it to a specific state apparatus, and Anthropic's report offers only a brief mention of its activities. Analysts suspect it may be a smaller outfit testing the limits of AI‑assisted reconnaissance, but concrete evidence is still lacking.

The third group, GTG‑27005, operating under the monikers "DronDoc" and "Serafim", claims partial financing from Russian defence ministries. Its members present themselves as independent researchers, yet they have downloaded publicly available Ukrainian combat footage, including videos that have been featured in the daily "Ukraine Battlefield update". The group is using these recordings to train a machine‑vision algorithm capable of recognising targets for coordinated drone swarms. If successful, the technology could allow a single operator to direct dozens of attack drones in real time, dramatically lowering the cost per sortie and increasing the lethality of Russian air attacks.

Front‑line developments: Lyman, Dobropillia and the wider front

While the cyber‑war rages in the background, the physical battlefield shows a mixed picture. Military analyst Konrad Muzyka of Rochan Consulting published a comparative map that juxtaposes the front line in mid‑January 2026 with its position at the start of September. The visual evidence confirms that Russian forces have made only modest gains over eight months of an offensive that was originally intended to secure the whole Donbas region.

In the south of Dnipropetrovsk oblast, Ukrainian troops reclaimed a stretch of territory around Lyman, pushing Russian units back by roughly 12 kilometres. The advance, however, was halted as Russian forces redirected their focus to the town of Dobropillia, where they have concentrated a sizeable portion of the 41st Combined Arms Army and the 90th Guards Tank Army, the latter, analysts note, is "a tank army in name only" given its depleted armour and limited operational capacity.

Unit Observer, a volunteer mapping project, reported that the Ukrainian 210th Separate Assault Regiment was redeployed to reinforce the sector opposite Dobropillia. The same source observed that Russian commanders have repeatedly shifted elite formations into the same corridor, a pattern that mirrors the previous year's attempts to break through the same line with little success.

Satellite imagery and open‑source video confirm that September has been the most intense month for drone activity in the Dobropillia sector. Ukrainian forces have employed a mix of fixed‑wing loitering munitions and rotary‑wing platforms to conduct reconnaissance and strike missions, while Russian air defences have been strained by the volume of incoming UAVs.

Strikes on Russian ports: targeting the Black Sea fleet and Iran‑linked logistics

On 9 September, Ukrainian forces launched coordinated attacks on the Black Sea ports of Novorossiysk and Makhachkala. In Novorossiysk, satellite images show damage to the missile frigate Admiral Essen, a vessel capable of launching Kalibr cruise missiles. Ukrainian officials claim the strike aimed at the ship's missile launchers; the damage, while visible, appears to have been limited to the superstructure rather than a catastrophic explosion.

According to the Ukrainian defence website NV, the raid reduced the number of Russian vessels capable of firing Kalibr missiles to three or four, a quarter of the fleet's original strength in 2022. The loss of these platforms hampers Moscow's ability to project power into the Mediterranean and the Indian Ocean, and may force a greater reliance on land‑based missile systems.

Makhachkala, Russia's only ice‑free port on the Caspian Sea, serves as a key logistics hub for trade with Iran. Ukrainian drones reportedly struck the port on the night of 10 September, though the extent of the damage remains unclear. Video footage shared by open‑source analysts shows smoke and a possible explosion near the dockside storage area, but no independent verification of the target's nature has been published.

The attacks on these ports illustrate a broader Ukrainian strategy: to disrupt Russia's supply chains, especially those that sustain the war effort in the south and provide a conduit for Iranian weapons and technology. By striking at the maritime nodes that connect Moscow to Tehran, Kyiv hopes to raise the cost of Russian logistics and limit the flow of spare parts for its own air‑defence systems.

Equipment losses and the human toll

The Oryx project, which tracks equipment losses through open‑source photographic evidence, recorded that by 7 September Russian forces had lost 24,066 pieces of heavy equipment since the start of the year. Of these, 4,446 were tanks, with 3,351 destroyed in combat. Ukrainian forces reported the loss of 12,097 pieces of their own equipment, including 1,462 tanks, of which 1,120 were destroyed.

These figures, while unable to capture the full scale of casualties, highlight the grinding attrition that both sides endure. The heavy loss of Russian armour, especially in the Donbas, underscores the difficulty Moscow faces in sustaining a high‑intensity offensive without a steady flow of replacement vehicles, a flow that is increasingly constrained by sanctions and supply‑chain disruptions.

Beyond the material losses, the war continues to exact a heavy civilian toll. A large warehouse in Hostomel, on the outskirts of Kyiv, was set ablaze on 9 September. Russian officials allege the site stored ammunition, but independent verification is pending. Earlier in the conflict, similar strikes on ammunition depots in the suburbs of Vyshneve and the village of Myla near Bucha resulted in nearly 50 civilian deaths, underscoring the growing risk of secondary explosions in populated areas.

International reactions and the AI‑arms race

The revelation that Russian groups are weaponising a US‑origin AI model has prompted reactions from Western governments. The US State Department issued a statement reminding AI developers of their responsibility to monitor and restrict the export of dual‑use technologies. The UK's Office for AI and the European Commission's Directorate‑General for Communications Networks, Content and Technology (DG CONNECT) have announced a joint review of AI export controls, citing the need to prevent "malicious repurposing" of advanced models.

European tech firms, many of which have been pressured to adopt stricter licensing regimes for generative AI, are now facing a new set of compliance challenges. The European Parliament's Committee on Industry, Research and Energy (ITRE) is set to debate a proposal that would require AI providers to embed "tamper‑proof" usage logs, enabling authorities to trace illicit deployments of models like Claude.

Trade unions representing workers in the AI sector have expressed concern that tighter controls could lead to job losses in a rapidly expanding industry. However, they also acknowledge the broader social responsibility of preventing AI from becoming a tool of state‑led aggression.

What lies ahead for the conflict and for AI governance?

On the battlefield, the Ukrainian army appears poised to continue its push in the Dobropillia corridor, while Russian forces are likely to reinforce their positions with additional tank and artillery units. The next few weeks will test whether Kyiv can translate its drone‑heavy tactics into a decisive breakthrough, or whether Moscow will adapt its defences and counter‑drone measures.

In the digital realm, the Anthropic report suggests that the misuse of AI is no longer a fringe concern but a developing front in modern warfare. The ability of AI to rewrite malware, analyse vast troves of video footage and potentially command autonomous weapon swarms raises profound questions about the adequacy of existing international law, including the Geneva Conventions, to regulate such capabilities.

European policymakers are now faced with a dual challenge: to bolster the resilience of critical infrastructure against AI‑enhanced cyber attacks, and to shape a regulatory framework that curbs the export of powerful generative models without stifling innovation. The balance between security and technological progress will likely dominate debates in Brussels and national capitals throughout the coming months.

For workers across Europe, the emerging AI‑driven conflict underscores the need for robust social protections. As defence budgets shift towards high‑tech procurement, the demand for skilled technicians, data scientists and cybersecurity experts will rise, but so will the risk of job displacement in traditional manufacturing sectors. Trade unions are already calling for upskilling programmes funded by both national governments and the EU's Recovery and Resilience Facility, arguing that a just transition is essential to prevent widening inequality.

Ultimately, the intertwining of AI, cyber‑espionage and conventional combat on the Ukrainian front illustrates a new era of hybrid warfare. The stakes are high not only for the territories contested on the ground, but for the future of international security norms and the protection of civilian populations from the collateral damage of autonomous weapons.