Anthropic published Wednesday its threat intelligence report, "Detecting and Countering Misuse of AI: September 2026," detailing malicious operations involving Claude that its Threat Intelligence team identified and disrupted over the past eight months. The report covers seven harm areas addressed between December 2025 and August 2026: cyber operations, surveillance, influence operations, conventional weapons development, biological misuse, scams and fraud, and illicit distillation.
The report's central claim: AI's role in cyber attacks is moving from "assistant" to "orchestrator." Anthropic uses the term Generative Threat Groups (GTGs) for actors observed abusing AI, and measures "uplift" — the capability boost along speed, scale, and depth. In one notable case, GTG-20006, an actor linked by public reporting to Russian espionage (Midnight Blizzard) used customized AI-driven workflows that automated everything from development and infrastructure acquisition to phishing, persistence, and exfiltration — and could autonomously rewrite and redeploy malware when security products detected it, making static detections nearly useless. The investigation identified more than 20 targeted organizations, concentrated in Ukraine and Europe.
Another case, GTG-50014, shows ShinyHunters-affiliated criminals scaling smash-and-grab theft with AI: a fleet of cloud workers mass-downloaded 1.8 million Android APKs, decompiled them, and scanned for hardcoded secrets, with verified credentials streamed into Telegram groups in real time. One supply-chain breach of a SaaS provider extracted over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours. GTG-10007, meanwhile, was an "exploit foundry" run by Chinese-speaking operators including students — autonomous agents reverse-engineered security product firmware, yielding more than a dozen possible zero-day findings in a single month.
The report also warns that the AI supply chain itself has become a deliberate target. One actor injected malicious instructions into an AI vendor's automated evaluation sandbox, coercing it to hand over production API keys; another group, GTG-50021, posed as a discounted Claude reseller while installing credential harvesters and silently proxying traffic to a different model. Anthropic stresses that every key involved was stolen from customers' environments — Anthropic's own systems were never compromised.
In the illicit distillation section, the report names seven China-based AI labs in alleged efforts to extract Claude capabilities, including claims of 151 million conversations generated via over 3,500 fake accounts to pull chain-of-thought transcripts. Notably, all misuse cases involved Claude's Haiku, Sonnet, or Opus models — none used Fable or Mythos-class models, with the exception of one distillation case. When attackers begin letting AI organize attacks themselves, the security balance shifts, unprecedentedly, toward whoever moves faster.