Anthropic has published its most detailed threat intelligence report to date, documenting attempts to misuse Claude for cyber operations, surveillance, influence campaigns, biological research, conventional weapons development, scams and illicit model distillation. The Anthropic threat intelligence report, published September 10, 2026, covers activity identified and disrupted between December 2025 and August 2026.
The report says the incidents involved suspected state-sponsored groups, financially motivated criminals, commercial spyware operators and politically motivated actors. Anthropic said it disrupted the operations described, banned associated accounts, strengthened safeguards and shared relevant intelligence with authorities and industry partners.
Quick Summary
- Anthropic published its most detailed threat intelligence report on Claude misuse.
- The report covers cyberattacks, surveillance, influence operations, scams, biology and weapons development.
- Attackers increasingly used AI agents and automated workflows to perform complex tasks.
- Anthropic says it disrupted every operation described in the report.
- The company strengthened its AI safety safeguards and detection systems based on these cases.
- Some findings were shared with authorities and other AI companies to improve industry-wide security.
- The report highlights the growing challenge of securing AI agents and increasingly autonomous AI systems.
- For businesses, the findings reinforce the need for access controls, monitoring, logging and human oversight.
What the Anthropic Threat Intelligence Report Found?
Anthropic divided the activity into seven major areas:
- Cyber operations
- Influence operations
- Surveillance
- Scams and fraud
- Biological misuse
- Conventional weapons development
- Illicit model distillation
The company said Claude Haiku, Sonnet and Opus models were involved in the documented misuse cases. Anthropic also emphasized that the cases represent some of the most notable and novel activity it identified rather than typical usage patterns.
That distinction is important. The report is not claiming that ordinary Claude users are engaging in these activities. Instead, it provides examples of sophisticated actors testing AI safeguards and attempting to circumvent restrictions.
AI Cyberattacks Are Becoming More Autonomous
One of the report’s most significant findings concerns AI-assisted cyber operations.
Anthropic observed attackers using Claude throughout the cyberattack lifecycle, including reconnaissance, infrastructure development, phishing, exploitation, persistence, credential theft and data exfiltration.
In some cases, AI was incorporated into multi-agent workflows that could conduct reconnaissance and exploitation with limited human intervention. Anthropic said humans generally remained responsible for important decisions such as selecting targets and reviewing stolen information.
The report describes one operation attributed consistently with public reporting to the Russian state-linked group Midnight Blizzard. The attackers used AI-driven workflows to automate substantial portions of their operations against government, diplomatic and defense-related targets.
The workflows could also monitor whether malware had been detected and modify or rebuild components when security products identified them.
This represents a notable change from the traditional AI-assisted hacking model. Instead of asking an AI assistant for individual pieces of code, attackers can potentially connect AI agents to tools and infrastructure to create a more continuous operational loop.
Microsoft separately reported the CaptiveCrunch campaign involving a Midnight Blizzard sub-cluster and said AI supported a significant portion of the operation.
Influence Operations Are Becoming More Scalable
Anthropic also identified AI-assisted influence campaigns designed to manipulate online information environments.
The documented operations included the creation of:
- Fake social media profiles
- Fabricated biographies and personas
- Fake news websites
- AI-generated profile images
- Political and institutional impersonations
- Forged documents
- Coordinated deceptive content
In some cases, actors attempted to conceal the origin of their activities by using VPNs, foreign phone numbers, rotated accounts and third-party services.
However, Anthropic noted an important limitation: much of the deceptive content it discovered had little or no authentic audience engagement. In several cases, the company disrupted operations before they developed significant reach.
This suggests that AI can reduce the cost of producing influence material, but generating large quantities of content does not automatically guarantee genuine audience reach.
Surveillance and Political Targeting
The report also documents cases where Claude was used to build or support surveillance systems.
Anthropic identified activity involving state-aligned actors, contractors and commercial surveillance vendors. The cases included efforts to develop software for identity resolution, social-network monitoring, credential collection and communications interception.
In one case described by Anthropic, Claude was used as an engineering resource for a surveillance platform designed to collect communications data across mobile operators.
The company said these activities violated its usage policies and that accounts associated with the operations were banned. It also developed additional detection mechanisms based on the techniques observed.
The cases demonstrate why AI safety concerns extend beyond the model’s generated answers. The way AI assistants and coding agents connect to external tools can determine how much real-world impact malicious users can obtain.
AI Misuse Extends to Weapons and Biological Research
Anthropic’s report also covers attempts to use Claude in conventional weapons development and biological research.
The conventional weapons cases involved work related to firearms, missiles, armed drones, bombs and other systems. Anthropic said it identified six cases involving actors in China, Russia and Yemen.
The company reported that safeguards blocked many requests, but attackers attempted to evade those safeguards by concealing their objectives and distributing their work across multiple sessions.
Anthropic also described biological misuse as one of the most serious categories of frontier AI risk. The company said its evaluations and investigations are designed to determine whether increasingly capable models could meaningfully assist dangerous biological research.
These findings illustrate why AI developers increasingly treat safety evaluations as an ongoing process rather than a one-time assessment before a model release.
What This Means for AI Agents and AI Security?
The report’s broader significance lies in the growing role of AI agents.
Traditional AI assistants generally respond to individual prompts. Agentic systems can instead reason across multiple steps, use external tools, execute tasks and maintain state.
That creates legitimate opportunities for automation in cybersecurity, software development and business operations. It also creates additional opportunities for misuse.
| AI capability | Legitimate use | Potential misuse |
|---|---|---|
| Code generation | Software development | Malware development |
| Research automation | Threat intelligence | Target reconnaissance |
| AI agents | Business automation | Automated attack workflows |
| Content generation | Marketing and publishing | Influence campaigns |
| Data analysis | Security investigations | Surveillance |
| Multimodal AI | Analysis and productivity | Deceptive or fraudulent content |
The security challenge is therefore increasingly about controlling what AI systems can do, not simply what they can say.
Anthropic Says Safeguards Must Evolve
Anthropic said the documented cases were used to improve its safeguards and detection systems.
The company also shared information with government authorities and industry partners where appropriate. Its goal is to help other AI developers identify similar behavioral patterns before malicious activity becomes more difficult to contain.
This collaborative approach is becoming increasingly important as AI-enabled attacks can cross platform boundaries. An attacker may use one AI model for research, another for coding and conventional infrastructure for execution.
No single AI provider can therefore address the entire threat landscape independently.
Why the Report Matters for Businesses?
For businesses adopting AI assistants and AI automation platforms, the report highlights the importance of treating AI systems as part of the organization’s security environment.
Companies should consider:
- Monitoring AI agents that have access to external systems.
- Limiting permissions according to the principle of least privilege.
- Logging important AI-initiated actions.
- Separating sensitive credentials from general-purpose AI workflows.
- Testing agent behavior under adversarial conditions.
- Updating security detections as attacker techniques evolve.
The same capabilities that make AI valuable for automation can become security liabilities when agents receive broad access to corporate systems.
FAQs
1. What is Anthropic’s September 2026 threat intelligence report?
It is a report from Anthropic documenting real-world attempts to misuse Claude between December 2025 and August 2026. It covers cyber operations, surveillance, influence operations, biological misuse, weapons development, scams and illicit distillation.
2. Was Claude successfully used in cyberattacks?
Anthropic identified multiple operations in which attackers used Claude to support cyber activities. The company said it disrupted the operations it describes and strengthened its safeguards based on the investigations.
3. Are AI agents making cyberattacks more autonomous?
According to Anthropic, some of the documented operations used multi-agent frameworks and automated workflows for activities such as reconnaissance, exploitation and data collection. Humans generally remained involved in important decisions such as target selection.
4. Did Anthropic report AI misuse for weapons development?
Yes. Anthropic documented cases involving conventional weapons development, including software associated with missiles, drones and other systems. The company also reported attempts to use Claude in biological research that raised safety concerns.
5. Why are AI safeguards becoming more important?
As AI models become more capable and are connected to tools, their outputs can have greater real-world effects. Safeguards therefore need to address both the content a model generates and the actions that AI agents can perform.
6. What does the report mean for businesses using AI?
Businesses should treat AI agents as part of their technology and security infrastructure. Access controls, monitoring, logging and human oversight become increasingly important when AI systems can interact with sensitive systems or data.
Conclusion
The Anthropic threat intelligence report provides a detailed look at how sophisticated actors are adapting AI for cyberattacks, surveillance, influence operations, weapons development and other harmful activities.
The most important development is not simply that malicious actors are using AI. It is that AI is increasingly being incorporated into automated workflows capable of performing multiple operational tasks.
For AI developers, cybersecurity teams and businesses deploying AI agents, the report reinforces the need for continuous monitoring, stronger safeguards and collaboration across the technology and security industries. As AI capabilities advance, preventing misuse will increasingly depend on securing the entire ecosystem surrounding AI systems, not just the models themselves.
Also Read –
Claude AI Explained: Features, Models, Use Cases & Benefits
Sources
- Anthropic — Detecting and Countering Misuse of AI: September 2026
- Anthropic — Threat Intelligence
