A lone hacktivist, a criminal crew and a state espionage unit each ran multi-victim campaigns through Claude over the past eight months, and none of them needed a team of specialists to do it. That is the thesis of Anthropic’s most detailed threat intelligence report yet: sophisticated attacks no longer require sophisticated attackers, because agentic, multi-agent frameworks with persistent memory now do the labor that used to take expertise. Humans still pick the targets and collect the payout; the models plan, act and remember.
Summary: eight months, seven harm areas, one operating pattern
- Anthropic disrupted misuse across seven harm areas between December 2025 and August 2026 — cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons and illicit distillation — in a report published September 10.
- Every case ran on Claude Haiku, Sonnet or Opus; none touched Fable or Mythos-class models, with one exception in the distillation section.
- Stolen AI API keys worked as loot, compute and cover at once; in the cases described they were taken from Anthropic customers’ environments, and “Anthropic’s own systems were not compromised by this actor,” the company says.
- Seven China-based labs — Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax — are named for illicit distillation against Claude since February 2026; two of them, Anthropic says, silently relayed their own customers’ requests to Claude.
- The evidence “is no longer certain” that current models stay below the threshold for meaningfully assisting dangerous biological research, Anthropic says, and a Mali surveillance platform built with Claude’s help kept running on local models after the company banned the account behind it.
What happened: harnesses do the work human specialists used to do
In November 2025 Anthropic documented the operating model of a suspected state-sponsored campaign that ran largely autonomous attacks; the new report says that model has since spread to every class of actor it investigated. The attacks documented here are built from harnesses, multi-agent frameworks with persistent memory, rather than single prompts: a lead agent decomposes a task, hands pieces to subagents, and keeps a record of the campaign across sessions in skills files that a human operator edits while the agents keep working.
GTG-20006, which Anthropic links consistently with public reporting on Midnight Blizzard, used AI for reconnaissance, initial access, exfiltration and persistence, and targeted more than 20 organizations; from one North African government authority it took over 300,000 national identity records and commercial-registry data on more than half a million companies. Suspected ShinyHunters affiliates dumped more than 2,100 Azure AD token sets across over 40 tenants in about 34 hours, with AI agents doing nearly all of the work, Anthropic says; a single stolen developer token elsewhere escalated to full administrative control of a cloud environment in roughly three hours.
The keys behind these operations are themselves the target now: they gave operators resale value, compute paid for by the victim, and cover, since the activity looked like it came from the legitimate account holder, Anthropic says. GTG-50020 spent about four days attacking roughly thirty AI companies to reach a pre-release Claude model and never obtained it. GTG-10007, Chinese-speaking operators including two identified undergraduates in Hunan, ran agent swarms with persistent campaign memory that in one month surfaced a dozen-plus possible zero-days against network appliances.
Seven labs, one relay: how distillation reached Claude’s own customers
Illicit distillation harvests Claude’s own reasoning to train a cheaper model that keeps the capability without inheriting the refusals. Anthropic names seven China-based labs it says ran or bought illicit distillation against Claude since February 2026: Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax.
Alibaba’s campaign is, in Anthropic’s account, the largest ever measured against its platform: close to 3 million exchanges a day from more than 3,500 fraudulent accounts, over 151 million exchanges between May and July 2026. Moonshot relayed almost 300,000 customer requests to Claude over ten days through 5,380 fraudulent accounts, Anthropic says, serving Claude’s own answers to users who believed they were talking to Kimi. DeepSeek tagged requests arriving from third-party harnesses — Claude Code, the Claude Agent SDK, OpenCode — and relayed selected users to Claude Opus, according to the report.
Those relays carried real exposure: relayed sessions included CCTV analysis of a tracked individual by a user assessed as likely PLA-affiliated, and live credentials for a Russian government database, Anthropic says. Zhipu gave up attacking Fable’s cyber capabilities after safeguards degraded its attacks, and switched to Opus 4.6 and a model from another US lab “expressly because they assessed the safeguards were weaker.”
What Anthropic admits it cannot guarantee
Anthropic states that for its current models “the evidence is no longer certain” that they stay below the threshold of meaningfully assisting dangerous biological research, which is why it launched Claude Fable 5 with stronger safeguards. In one case classifiers confined the exchange to Sonnet 4 and Haiku 4.5, with the uplift, Anthropic estimates, mainly clerical; in another, a grant application for orthopoxvirus research was drafted end to end on Opus 5 in about an hour through a reseller relay, unblocked because the work was framed as attenuation research. Its conclusion: “the only safe way to serve frontier biological capabilities is to offer them in trusted user programs.”
On conventional weapons, Anthropic describes six cases — three in China, two in Russia, one in Yemen — including a Russia-based freelance team whose autonomous FPV drone swarm could select a “person” target class and issue detonation commands with no human in the loop. It says it has since deployed new classifiers for explosives and weapons-development traffic, and that Claude now summarizes its internal reasoning before responding while Fable 5.1 blocks new API accounts from altering the system prompt, tools or preceding messages.
Those defenses do not hold evenly. In one PRC surveillance case Claude refused a request and was overcome once the operator re-prompted it, Anthropic says; in another it complied across many sessions without intervention. A Mali operation called “Lakana 360,” in which Claude served as the engineering workforce for a platform monitoring roughly 25 million SIM cards across all three national mobile operators after a warrant requirement was removed at the operator’s request, ends the same way: banning the account stopped Claude from building the platform further, but the deployed system keeps running on-premises, on local models. Companion evaluations from Anthropic’s Frontier Red Team, published the same day, describe their own results — Mythos Preview geolocating photos to a 37-kilometer median error, Opus 5 hitting a parked vehicle in 80% of simulated drone sorties — as “a floor rather than a ceiling.”
What the report does not show
Every figure above comes from Anthropic’s own telemetry, labeled “medium,” “high” or “low” confidence case by case; no external auditor, victim or government confirms any of it, and Anthropic does not publish the evidence behind its attributions. Outside the distillation section, actors are identified only by internal designators — GTG-nnnnn — tagged with a country and a sector.
The report gives no denominator: it calls these “the most notable and novel” cases, not a representative sample, with no share of total traffic, no count of banned accounts, no false-positive rate — so how common misuse is on Claude cannot be read from this document. A biology reseller “re-established access within days” of being banned, Anthropic concedes. No public response from any of the seven named labs had appeared by September 12.