On September 10, 2026, Anthropic published its fourth threat intelligence report, Detecting and Countering Misuse of AI: September 2026. The 154-page document covers activity the company’s threat intelligence team says it disrupted between December 2025 and August 2026 — and it reads less like a corporate transparency exercise than a field manual for the age of AI-assisted warfare. State-backed hackers used Claude to run espionage campaigns, rebuild malware on the fly, and pursue autonomous drone swarms. Industrial-scale operations siphoned roughly 190 million model exchanges out of Claude to clone its capabilities.
Anthropic says it disrupted every operation described, banned the associated accounts, hardened safeguards, and shared intelligence with authorities and industry partners. The report is, by nature, a selected set of stories rather than a census. But the stories it selects are alarming.
The seven harm areas
The report organizes its findings into seven categories: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit model distillation. The throughline is what Anthropic calls ‘uplift’: AI compressing the labor, skill, and time that used to separate sophisticated attackers from everyone else. The report’s starkest claim is that lone operators and tiny teams ran campaigns that would have required a roomful of specialists a year earlier.
Malware that fixes itself
The most technically striking case is GTG-20006, an espionage actor Anthropic assesses as consistent with public reporting on Midnight Blizzard — the Russian foreign-intelligence-linked group also known as APT29. One operator used the handle JackPoterz. Targets included more than 20 government and defense organizations across Ukraine and Europe, plus diplomatic bodies and people connected to US foreign policy.
AI-driven workflows automated the unglamorous parts of the operation: tooling, phishing, command-and-control infrastructure, and data exfiltration. Then came the part that should worry every defender. When security products flagged the group’s malware, agents autonomously modified and rebuilt it until the detections stopped firing. The malware pipeline became a loop: detect, mutate, retest, redeploy — with no human in the cycle. As CyberScoop’s coverage noted, the campaign hit its targets at a tempo that manual tradecraft could not sustain.
A separate case, GTG-50020, involved a Russian-speaking crew that turned prompt injection against an AI vendor’s own automated evaluation sandbox, extracting production API keys for multiple providers and probing for a pre-release Claude model. The attackers treated AI infrastructure itself as the target: API keys as loot, free compute, and attribution cover all at once.
The fraud economy around AI
Not all the misuse was statecraft. A ShinyHunters affiliate (GTG-50014) decompiled 1.8 million Android APKs hunting for hard-coded secrets, then parlayed one compromised SaaS vendor into access to more than 200 downstream customers. A fraudulent ‘cheap Claude access’ reseller (GTG-50021) proxied customers to other models while harvesting their Anthropic credentials. Infostealer families — Amatera, Remus, CallbackBeaver, and the macOS Djinn — now specifically harvest AI agent artifacts: access and refresh tokens, MCP configs holding credentials, and prompt histories sitting in predictable, sometimes plaintext, locations.
The 190-million-exchange distillation wars
The report’s longest section may prove its most consequential. Anthropic says seven China-based labs engaged in systematic campaigns to extract the capabilities of Claude’s Opus-class models between December 2025 and August 2026 — not isolated scraping, but coordinated industrial distillation totaling roughly 190 million exchanges.
The named operations are specific. Alibaba, labeled GTG-16005, allegedly executed about 151 million exchanges between May and July 2026, peaking at 3 million requests per day across more than 3,500 fraudulent accounts. Moonshot (GTG-16002) silently served Claude responses to Kimi users. DeepSeek (GTG-16001) relayed customer exchanges to Claude over a 14-day window totaling 12.1 million exchanges. MiniMax allegedly routed traffic through a proxy network run via a shell company. Xiaomi (GTG-16008) replayed more than 400,000 real user conversations and coding sessions from its own MiMo chatbot back through Claude over 20 days in March and April 2026, using over 1,500 accounts and proxy services to hide the traffic. SenseTime allegedly bought harvested exchanges from third-party vendors instead of collecting them directly.
The findings did not stay inside Anthropic’s walls. CISA Advisory AA26-251A, issued September 8 by the NSA and FBI, corroborated the distillation findings — a rare instance of US intelligence agencies validating a private lab’s attribution.
Weapons work
The report also documents attempts to apply Claude to weapons development. Actors tied to Yemen’s Houthi movement allegedly sought help with guided-rocket code, long-range ballistic-missile research, and hypersonic-vehicle reviews. Iran-linked groups allegedly used Claude for US naval targeting research, domestic-surveillance dossiers, and propaganda. And a group of Russia-linked freelancers associated with the Midnight Blizzard nexus allegedly used Claude Code to build a fully autonomous drone swarm — target selection and detonation commands without a human in the loop.
Anthropic notes that the misuse concentrated on Claude Haiku, Sonnet, and Opus. The newer Fable and Mythos-class models saw minimal misuse — except for one distillation case.
What this changes
Three implications stand out. First, sophistication is no longer a reliable attribution signal: public offensive agent frameworks have collapsed the skill barrier. Second, AI labs are now intelligence targets in their own right — their models, API keys, and evaluation sandboxes are the infrastructure attackers want. Third, the distillation findings put a number on an open secret: some suspiciously capable and suspiciously cheap models may have been trained on someone else’s outputs.
The report is also a reminder that safety work and threat work are converging. The same month Anthropic published these findings, it open-sourced the harness behind its automated alignment research — the tooling side of the same arms race. For the research behind that harness, see our breakdown of Anthropic’s automated alignment researcher experiment.
Featured image: Amir.Vector via Wikimedia Commons (Public domain)
