The latest Anthropic AI threat report offers a detailed warning about how generative AI is changing malicious activity. The company says AI is no longer used only to answer questions or draft code: in several disrupted operations, agents directly executed or orchestrated reconnaissance, exploitation and data handling.
Published on 10 September 2026, the 154-page report covers cases Anthropic says it detected between December 2025 and August 2026. Its most useful message for organisations is straightforward: security controls built for isolated chatbot prompts may be inadequate when attackers connect models to tools, stolen credentials and multi-agent workflows.
Background: what the report covers
Anthropic’s Threat Intelligence team examined notable misuse involving Claude across seven areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development and illicit model distillation. The company says it banned associated accounts, improved safeguards and shared intelligence with authorities or industry partners where appropriate.
These are selected cases, not a measurement of how common AI-enabled crime is across the internet. The report is also produced by the vendor whose service was targeted. Its attributions and figures should therefore be read as Anthropic’s findings rather than an independent census. Even with that limitation, the case studies give defenders a rare view of how AI tools can be wired into real operations.
What changed: AI moved from assistant to orchestrator
Anthropic’s central cyber finding is that sophisticated-looking attacks no longer necessarily indicate a large, highly skilled team. Public agent frameworks can automate steps across the cyber kill chain, while models help with research, tool development, phishing infrastructure, exploitation and analysis of stolen data.
The report says a majority of its highlighted cyber operations used AI for direct execution or orchestration, not just advice. Humans still chose targets and reviewed results, but multi-agent systems performed substantial work. In one alleged espionage operation linked by Anthropic to tradecraft associated with Midnight Blizzard, AI-assisted workflows helped manage phishing, malware modification, persistence and data exfiltration. Anthropic says the workflow could rebuild tools when security products detected them.
Microsoft separately documented a related campaign it calls CaptiveCrunch, in which a Midnight Blizzard sub-cluster compromised hospitality sign-in portals to target travellers. The overlap does not independently verify every Anthropic claim, but it reinforces the practical risk from compromised identity systems, hotel networks and convincing social engineering.
Model distillation became an industrial-scale security issue
The Anthropic AI threat report also devotes significant attention to illicit distillation. Legitimate distillation trains a smaller “student” model using outputs from a more capable “teacher.” Anthropic defines illicit distillation as covertly extracting capabilities at industrial scale without permission, often through fraudulent accounts, proxies, stolen payment details or compromised API keys.
Anthropic alleges that operators affiliated with Alibaba generated more than 151 million Claude exchanges between May and July 2026, peaking at nearly three million exchanges per day. It also describes separate activity attributed to Moonshot and DeepSeek, including claims that some customer requests were silently relayed to Claude and retained for training. TechCrunch reported the allegations when the report was released.
Those claims matter beyond competition between AI labs. Anthropic says relayed prompts included company information, personal details and live credentials. If users do not know which provider ultimately processes a request, they cannot make an informed decision about privacy, residency, retention or contractual risk.
Why this matters for businesses and developers
Defenders face faster feedback loops
Traditional security teams gain time when an attacker must manually rewrite detected code or inspect large datasets. Agentic workflows can compress that cycle. Static signatures still help, but organisations increasingly need behaviour-based detection, identity monitoring and rapid isolation when a tool changes repeatedly.
API keys are high-value credentials
An exposed AI key can provide both spending power and access to capable models. Treat model-provider keys like cloud credentials: keep them out of source code, scope them narrowly, rotate them, set budget and rate alerts, and monitor unusual geography, account creation or request volume.
AI routing needs supply-chain scrutiny
Developers using model routers, coding assistants or third-party gateways should document where prompts are sent and whether providers may retain them. Sensitive source code, customer records and production secrets should not enter an unapproved service simply because it offers a familiar model name.
Practical security steps to take now
- Inventory AI access: list approved models, gateways, agent frameworks, plugins and service accounts.
- Use least privilege: give agents only the files, commands, networks and tokens required for a specific task.
- Separate planning from execution: require human approval for destructive commands, external messages, credential use and production changes.
- Log the whole workflow: capture tool calls, identity events, model requests and agent-to-agent actions—not only final chat responses.
- Protect secrets: use a secrets manager, short-lived credentials and automated scanning for repositories, prompts and logs.
- Test incident response: practise revoking model keys, disabling agents and containing a compromised automation account.
- Review vendors: confirm subprocessors, routing, retention, training policies and data-location commitments in writing.
Risks and limitations
The report focuses on activity Anthropic could observe and considered notable. It cannot show misuse on other providers, offline models or attacks that evaded detection. Vendor telemetry also does not always reveal an operator’s real identity, and attribution can change as new evidence appears.
There is another important distinction: AI can increase speed and scale without making every attack technically novel. Phishing, credential theft, vulnerable applications and excessive permissions remain familiar weaknesses. Organisations should not abandon basic controls in pursuit of exotic “AI attack” products.
What to watch next
Expect stronger identity checks for high-risk model access, more controls around agent tools and better sharing of abuse indicators between AI providers. Customers should also watch for clearer disclosure when an application routes prompts to a third-party model. Regulators may treat hidden routing and reuse of sensitive prompts as both privacy and consumer-protection issues.
Conclusion
The September 2026 Anthropic AI threat report shows why agentic AI security must extend beyond filtering prompts. The larger risk is a connected workflow that can act repeatedly, use credentials and adapt faster than a human operator. Businesses do not need to panic, but they should govern AI agents like privileged software: constrain access, record actions, verify providers and be ready to shut compromised automation down quickly.