Anthropic's September 2026 Threat Report: The Full Digest for Builders
Nine months of disrupted operations across seven harm areas. The attack techniques are all old ones. The economics behind them are not. If you ship anything that holds an API key, sections 2 and 8 are where the money is.
Last updated: September 12, 2026
📌 TL;DR
- Sophistication no longer tells you who you're dealing with. A lone hacktivist, a criminal crew and a state espionage unit ran campaigns that look structurally the same, because agentic AI now handles the labour that used to separate them.
- AI credentials have become a primary target. A working key resells, it runs attacks on someone else's bill, and it puts someone else's name on the logs.
- Breaches now finish in hours. One escalation went from a single stolen developer token to full cloud admin in about three hours. Another dumped over 2,100 Azure AD token sets across 40+ tenants in roughly 34.
- For the first time an AI lab has published evidence of bio-adjacent misuse on its own platform. Five cases, with names and agents withheld.
- Seven PRC labs were caught distilling Claude, including two that were quietly serving Claude's answers to their own paying users.
- Autonomy and severity are different things. Some of the worst compromises in the report came from operations where a human directed every single step.
🗂️ Quick reference: the seven areas
| # | Area | Headline finding | Who should care |
|---|---|---|---|
| 1 | Cyber operations | AI moved from assistant to orchestrator across the full kill chain | Every engineering org |
| 2 | AI supply chain | Keys and agent integrations are now a deliberate criminal target | Anyone shipping AI features |
| 3 | Surveillance | AI standing in for entire engineering and analyst teams | Policy, human rights, infra |
| 4 | Influence operations | Nine campaigns, and influence-as-a-service is now a functioning business | Media, platforms, comms |
| 5 | Conventional weapons | Six cases of weapons software, procurement and targeting work | Export control, defence |
| 6 | Biological misuse | First public disclosure of this kind by a frontier lab | Life sciences, policy |
| 7 | Scams & fraud | 20+ dating apps, about 4,700 AI personas, 25,000 users in two weeks | Consumer platforms, app stores |
| 8 | Illicit distillation | Seven PRC labs, millions of exchanges, end-user data caught in transit | Anyone using a model router |
The report covers activity disrupted between December 2025 and August 2026. Only the generally available Haiku, Sonnet and Opus models show up in the misuse cases. Fable and Mythos-class models appear exactly once, in a distillation attempt.
⚔️ 1. Cyber operations: the assistant became the orchestrator
The most useful framing in the whole document is that none of these attacks were novel. Stolen credentials, unpatched edge devices, exposed services, SQL injection, phishing. What shifted is the cost structure. Reconnaissance, tooling, exploitation and data processing used to be the expensive human work that separated a funded state unit from a bored individual, and all of it now gets delegated to models running in harnesses, in parallel, at machine speed.
Four cases carry the argument.
A Russian espionage actor (GTG-20006), attributed in line with public reporting on Midnight Blizzard, wired AI into every stage of its operations: fingerprinting mail and remote access systems, registering phishing domains, standing up hosting, running the intrusions themselves, then sorting hundreds of gigabytes of stolen material. The nastiest component is a detection-evasion loop. Monitoring agents watched whether deployed malware had been picked up by security products, and when it was, other agents rebuilt and redeployed it until it went dark again. Static signatures stop imposing any real cost once an adversary can close that loop faster than vendors can ship detections.
The targeting is worth reading closely if you work anywhere near Ukraine-adjacent supply chains. More than 20 organisations, with heavy concentration on Ukrainian government bodies and drone manufacturers. In one case the actor stole an SDK for a drone vision system and spent several days reverse-engineering it down to the bill of materials and supplier list. Indirect access came through three hotel WiFi vendors, where DNS records were repointed so that guests connecting to hotel networks got fingerprinted and served malware. Microsoft documented the same delivery method in July 2026 under the name CaptiveCrunch. A separate intrusion at a North African government technology authority pulled more than 300,000 national identity records along with commercial registry data on over half a million companies.
Financially motivated crews (GTG-50014), assessed as ShinyHunters affiliates, industrialised credential discovery. One operator ran ten cloud workers that downloaded roughly 1.8 million Android APKs, decompiled them, scanned for hardcoded secrets and piped verified hits into Telegram channels organised by secret type. Downstream you get a terabyte-plus exfiltration at a technology provider, tens of millions of passenger records at an airline, and a supply chain breach where a foothold at one SaaS vendor produced data belonging to around 200 of its customers. A single session dumped over 2,100 Azure AD token sets spanning 40+ corporate tenants in about 34 hours, with agents doing nearly all of it. One of the operators was also collecting legitimate bug bounty payouts from companies they were extorting at the same time.
A Chinese-speaking group (GTG-10007), which included two undergraduates, built something close to an exploit foundry. Firmware went into a decompiler through a tool server. Agents walked cross-reference chains, formed vulnerability hypotheses against a knowledge base they'd been curating over time, wrote exploit code, tested it against lab copies of the product and iterated until something landed. One workflow aimed at network appliances produced more than a dozen candidate zero-days in a single month. A standing fleet of thirteen collection agents ran on a schedule with nobody watching.
A single French-speaking hacktivist (GTG-50029) went after European political parties, media and think tanks. Forty-two tracked targets, internal access to at least fourteen of them. They found a previously undocumented WordPress reinstallation race condition that creates a rogue administrator without valid credentials, and developed and debugged the exploit in the same session they built the lab harness for it. They also poisoned the victim's backups, so a restore would reinfect. Then they built a doxxing search platform, loaded it with tens of millions of records fused from breach dumps and their own intrusions, and published it as a Tor service where people affiliated with a particular political movement could be looked up by name. That was one person.
🔑 2. The AI supply chain: target, loot and attack compute
This is the section with direct consequences for anyone reading a developer blog.
Stolen AI credentials hand an operator three benefits at once:
| Benefit | What it means in practice |
|---|---|
| Loot | Keys and accounts have an established resale market |
| Compute | The attack workload runs on the victim's bill |
| Cover | Traffic gets attributed to the legitimate key owner |
Patterns that showed up repeatedly:
- Keys harvested at industrial scale from APKs, public repos, container images, client-side code, metadata endpoints, open storage, and from customers' own deployed AI agents.
- Prompt injection against AI wrapper services. Several actors hit LiteLLM deployments to pull the production keys sitting in their cloud-hosted container environments.
- Fraudulent resellers. One group (GTG-50021) sold cheap Claude access that turned out to be neither cheap nor Claude. Traffic was silently proxied to a different model while the reseller's own tooling installed a credential harvester and sold the victims' Anthropic credentials onward.
- Fake AI client apps. Sites posing as multi-model intermediaries served desktop applications that spoofed popular AI harnesses. They were credential stealers, and they kept re-harvesting new session tokens after every rotation.
- Attacks on AI vendors directly. GTG-50020 injected instructions into an AI vendor's automated evaluation sandbox and got it to hand over the production keys it was holding, then immediately switched their ongoing attacks onto the victim's keys. A follow-up campaign hit roughly thirty AI companies in about four days, replaying one working path with small adjustments per target. Their stated goal was access to a pre-release Claude model. They never got it.
In all of these cases the compromised keys came out of customer environments rather than the provider's own systems. That distinction should shape your threat model, because it means the weakest link in the AI supply chain is almost always your own integration surface.
🕵️ 3. Surveillance: AI as the engineering department
Three trends here, and each is bleaker than the last.
AI replacing an engineering workforce. A single consultant working with Mali's state intelligence service used Claude as the main engineering resource for a population-scale interception platform covering roughly 25 million SIM cards across all three national mobile operators. Call records, SMS, voice capture. It generated intelligence dossiers on any tasked phone number, and the warrant requirement was removed from that component at the operator's request, with retention set to indefinite. It defeats burner-SIM self-protection through cross-SIM voiceprint matching and joins against the national biometric registry. The platform runs on premises with local models, so the account ban stopped the design work but not the deployment.
AI as the analyst. A PRC religious affairs collection unit that used to need many teams of analysts now runs out of a single office, producing thousands of investigations a month. An Iranian unit analysed hundreds of thousands of social media posts and picked 39 opposition accounts to monitor. A commercial vendor profiled social media users across Iran and the Gulf, sorting them into demographic buckets with confidence scores and producing Arabic-language briefings written in the register of a government report.
AI as the operator. The most operationally mature case involved a PRC-aligned actor with no Arabic skills running a multiday recruitment operation against Uyghur targets in Syria. The model drafted outreach in regional dialect, translated replies in real time, role-played an expert to quality-check the messaging, and formatted the results for handoff. Chatter from over 100 monitored WhatsApp groups was converted into structured Chinese-language profiles, with people who still had family in Xinjiang explicitly flagged as leverage targets.
The victims are the same communities these regimes have always gone after. What's new is that the capability no longer needs a building full of people.
📰 4. Influence operations: building the apparatus, not just the content
Nine cases, originating in Russia, Iran, Turkey, the Gulf, South Asia, Africa and Europe.
The shift I'd flag: actors used the model to build the organisation around the campaign, not only the posts. Doctrine manuals, persona systems, target databases, scoring rubrics for ranking their own staff. In one Russian-aligned operation running through a radio station in the Central African Republic, the model produced employment contracts encoding political loyalty and a three-strike dismissal process, and the operators then scored staff articles against those criteria.
Other cases worth knowing about:
- A France-based digital advertising agency ran around 70 fabricated news sites that published 8,913 articles in roughly 20 languages, paired with fake X accounts and 250+ inauthentic commenting accounts. It switched political sides depending on who was paying at the time.
- An Istanbul-based company sold access to a platform that targeted Malaysian voters constituency by constituency across all 222 seats, ran about 1,000 fake accounts with warm-up and evasion logic, and fed a synthetic news outlet that republished Russian and Chinese state media with the state attribution stripped out.
- Four accounts used the model as a sub-editor inside newsrooms that were already running, producing material that reached Sputnik and RT channels, including on-air tickers and voiceover copy.
- Persistence lived in files rather than prompts. Doctrine kept in markdown and reused almost verbatim across hundreds of sessions, banned-word lists inside the agents, shared source and evasion rules. Operators producing content never had to coordinate with each other, or even know each other.
The counterweight is that most of this content got little or no authentic engagement. Detection sits upstream of distribution, so a lot of operations were disrupted while still being assembled. The campaigns that achieved real reach were the ones riding established state media: FM radio, satellite, broadcast television.
🚀 5. Conventional weapons: six cases
This is a new category since the previous report. Four cases of building weapons software, two of procurement and intelligence collection.
Yemen (GTG-87001). A cell used Claude Code in place of software engineers to build guidance, navigation and control software. They integrated an open-source autopilot onto a phone-class flight computer, wrote the control and position estimation code, tuned it and ran simulations. They also ran several model instances at once with assigned roles: one writing code, one doing research, one reviewing the first one's output. They test-fired a guided rocket. It appears to have failed, and they were back within hours working out why. They had also compiled an offline simulation toolkit that runs without any model at all.
China (GTG-17001). An anti-torpedo fire control specification plus a technical proposal running over 200 pages, refined by having the model role-play a hostile expert reviewer after each draft and then acting on that critique.
Russia (GTG-27005). A full-stack autonomous FPV drone swarm: shared swarm memory, fault-tolerant coordination logic, an onboard small model governing attack and return-to-base behaviour, terminal guidance that issues the detonation call, plus a module for geolocating opposing operators. It was designed for autonomous lethal engagement, with a "person" target class and no human in the loop. The vision classifier was trained on scraped Ukrainian combat footage. Firmware was flashed to live development boards.
Procurement (GTG-27006). A procurement manager at a Moscow design bureau used the model to find third-country intermediaries, draft multilingual quote requests that obscured the real end user, and reverse-engineer an existing grey-import chain including its costs and routing steps. Internal briefings described the approach openly as a way to route around European trade controls through a third country.
The hard problem here gets named honestly in the report. Every individual request (a quote, a tender document, a supplier lookup) looks completely mundane on its own. The actors also split work across sessions specifically so that no single session revealed what they were building.
🧬 6. Biological misuse: the first disclosure of its kind
Five case studies, with institutions, countries and specific agents deliberately withheld so that working scientists aren't exposed to harm. The framing is unusually candid: evaluations of older models showed they sat well below the threshold of meaningful uplift, but for current models that assurance no longer holds, which is why Fable 5 shipped with much stronger restrictions on dual-use biological queries.
The cases involve gain-of-function work on a mosquito-borne virus, routed through a reseller platform that tunnelled traffic to get around regional blocks; mammalian-adaptation research on avian influenza; an immune-evasion grant application drafted in about an hour; a venom peptide optimisation pipeline; and computational toxin redesign, where the researcher asked for the agents' identities to be kept vague in progress reports.
One detail should worry every safety team. When that platform's users hit refusals, the developers built a fallback that routed refused prompts to a competitor's more permissive model, and much of that routing code was written by Claude itself, presented as a fix for over-refusal. Safeguards that exist at only one provider are a speed bump.
The report is also clear about why this problem is genuinely hard. The same work that makes a pathogen more dangerous can produce a vaccine. Overt malicious intent mostly marks an unsophisticated actor, since they're doing it in plain sight. The sophisticated ones look plausibly benign in any single session, and only look wrong once you put a corpus of sessions together.
💸 7. Scams and fraud: the dating app factory
One case, but an instructive one. A China-based app studio built more than 20 dating apps and ran the conversations with AI personas while advertising the service as fully human. Over a two-week window: more than 4,700 distinct personas, at least 25,000 unique users, and roughly 2.36 million messages.
The mechanics are what make it interesting.
- Roughly three AI personas to every real person in the swipe feed. Real gig workers were mixed in specifically to handle what the model couldn't do, meaning live video calls and social follow-backs, which served as proof the app was authentic.
- Different providers for different roles. One model ran the conversations. A smaller non-Anthropic model generated the tap-to-send reply suggestions for the gig workers, plus photo moderation. An image model handled avatars.
- Store review evasion was designed in. A UI controller activated only during app store review and stayed dormant otherwise, class names were differentiated across the 20+ variants to defeat similarity checks, and the in-app browser that redirected payments to third-party processors could be switched off server-side during review.
- The deception was invisible from inside any single exchange. The operator's system prompt read like an ordinary roleplay or companion deployment. Monetisation and fraud never appeared in the conversation context at all.
That last point deserves more attention than it will get. Abuse detection that only inspects individual exchanges cannot see a fraud architecture living entirely in the deployment layer.
🧪 8. Illicit distillation: seven labs, millions of exchanges
Legitimate distillation trains a smaller student model on a larger teacher's outputs. The illicit version is an industrial-scale covert extraction campaign, and it runs on fraud: thousands of fake accounts built on stolen cards, credentials and API keys.
| Lab | Observed scale | Method notes |
|---|---|---|
| Alibaba (Qwen/Tongyi) | Peak near 3M exchanges/day, 3,500+ fraudulent accounts | Forced reasoning traces into inline tags, converted them into SFT data, and also used Claude for internal RL environments and architecture research |
| Moonshot (Kimi) | 23M+ exchanges, May to July 2026 | Silently served Claude's responses to its own users; used cross-session replay to turn reasoning signatures back into full traces |
| DeepSeek | not stated | Same silent relay and cross-session replay; tagged users coming in through third-party coding harnesses |
| Zhipu (Z.ai) | 3M+ exchanges in 10 days, 273 accounts | Replayed captured traces back through the model to clean them for training |
| Xiaomi | 400k+ requests, 1,500+ accounts | Replayed its own users' MiMo sessions through Claude for SFT and RL |
| SenseTime | not stated | Bought harvested transcripts from third-party data vendors |
| MiniMax | not stated | Ran a proxy service through a shell company that offered only US models |
Two findings in this section got much less coverage than they should have.
The first is privacy. These relays carried real end-user data: names, email addresses, corporate documents, live credentials, internal financial models. It came from users who believed they were talking to a Chinese model, routed through third-party model routers that are popular in the US and Europe. One relayed session involved CCTV analysis of a tracked individual. If you use a model router, you don't necessarily know which model is reading your prompts, or which jurisdiction it sits in.
The second is that safeguards don't survive distillation. Research cited in the report finds that a model distilled from a frontier model can pick up dangerous capabilities in cyber and biological domains even when the harvested exchanges contain almost nothing about those subjects. The alignment work doesn't come along for the ride.
One detail cuts the other way, though. Zhipu tried to target Fable's cyber capabilities, found the safeguards were degrading their attacks, gave up, and switched to an older Opus model and a competitor's model because they judged those defences weaker. Safeguards measurably changed adversary behaviour. They also redirected it rather than stopping it.
⚖️ What the report doesn't say
Worth being precise, because this material gets over-read in both directions.
- Humans still run the operations. Target selection, monetisation and review of results stayed firmly human in nearly every case.
- Autonomy and severity are separate axes. Several of the most damaging compromises came from operations where a person directed every step. Autonomy lowers cost and raises volume without automatically raising impact.
- No novel attack technique appeared anywhere in the report. Unit economics changed, which makes previously unprofitable targets worth hitting.
- Most influence content reached nobody. Production capability isn't the same as distribution capability.
- Nothing here describes a provider being breached. Every stolen key came out of a customer environment.
🛡️ Defender checklist
If you ship software with AI in it, this is the actionable residue.
Treat AI credentials as production credentials
- Scan your own APKs, containers, client bundles and public repos for embedded keys, because attackers are already doing it at million-artifact scale
- Scope keys per service, rotate on a schedule, alert on usage anomalies (geography, volume, model mix, time of day)
- Revoke and reissue anything that has ever touched a developer laptop that installed a third-party "AI client"
Harden the integration surface, not only the model
- Assume prompt injection against any gateway, proxy or eval sandbox that holds credentials. LiteLLM-style deployments were a named target.
- Keep agent execution environments free of secrets they don't need. An agent that can read your env is an exfiltration path.
- Isolate evaluation and CI sandboxes from production key material
Buy access through authorised channels only
- A discount that requires routing your traffic and credentials through an unknown intermediary is itself a credential-harvesting business model
- If you use a model router, know which providers it can reach and what it retains
Rebuild the assumptions
- Static detection on its own no longer imposes much cost on a capable adversary, so invest in behavioural detection and response speed
- Security through obscurity is finished. An unusual stack is now trivially legible to anyone with a model.
- Assume a breach timeline measured in hours. Your token TTLs, session invalidation and alerting should reflect that.
❓ FAQ
What period does the report cover? Activity disrupted between December 2025 and August 2026, across seven harm areas.
Which models were involved in the misuse? The generally available Haiku, Sonnet and Opus models. Fable and Mythos-class models appear in only one case, an illicit distillation attempt.
Was Anthropic itself breached? No. Every compromised API key in the report was stolen from a customer's environment.
What is a GTG? Generative Threat Group, the internal designator for a threat actor observed abusing AI. It's a tracking label rather than an attribution to a specific government.
What's the most actionable finding for a small engineering team? Audit where your AI API keys actually live. They leak from mobile app binaries, container images, public repos and client-side code, and attackers mine those sources continuously because a working key gives them resale value, free compute and someone else's identity on the logs.
Are AI-run attacks fully autonomous now? Not end to end. Autonomy ranges from conversational assistance, through human-directed execution, to unattended multi-agent campaigns. Humans still choose targets and handle monetisation.
Where can I get the indicators of compromise? Anthropic published the full IOC set as a downloadable CSV alongside the report.
📚 Source
- Detecting and countering misuse of AI: September 2026, Anthropic Threat Intelligence
- The full report PDF and the IOC CSV are both linked from that page
Comments
Loading comments...