SAN FRANCISCO, September 14 — Anthropic says it identified and disrupted malicious uses of its Claude AI models over an eight-month stretch, and it is naming the threat actors behind them. The company published a report titled “Detecting and countering misuse of AI: September 2026,” covering activity its Threat Intelligence team found between December 2025 and August 2026. It is the latest in a series, following earlier threat reports in March, August and November 2025.
Here’s what it means in plain terms: Anthropic is saying the same AI tools that help a student draft an essay can, in the wrong hands, help run a criminal campaign — and that the line between a well-funded spy agency and a lone operator has gotten blurry.
Seven harm areas, one widening cast
The report covers seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation. Claude Haiku, Sonnet and Opus models were used in the cases. No misuse involved Claude Fable or Mythos-class models, with the exception of one illicit distillation case.
Anthropic said the cases are not typical misuse but the most notable and novel threat activity it has identified to date, and that it published the work out of a responsibility to disclose malicious misuse of its services. The actors it covers include suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals.
The cases range from a network of fake dating apps designed to defraud users to surveillance systems built to identify and monitor dissidents. Anthropic said that in each case it disrupted the activity, used what it learned to strengthen safeguards, and shared intelligence with authorities and industry partners where appropriate.
The cyber operations picture
The cyber operations section covers six months of cases involving suspected state-sponsored groups, financially motivated criminals, and politically motivated individuals. Anthropic argues that while many commentators focus on the risk of AI developing exploits at scale, the more pronounced risk from AI adoption is across the cyber kill chain, where adversaries can operate faster, across a broader and deeper surface area, with fewer resources. The report says AI has collapsed the labor and tooling gap that once separated well-resourced, state-sponsored operations from individual operators.
A hacktivist using stolen API keys, disparate financially motivated individuals, and a state espionage operator each sustained multi-victim campaigns that, a year earlier, would have required many skilled operators and specialist knowledge. For threat intelligence investigators, that has a direct consequence.
Sophistication has stopped being a reliable signal of who is behind an operation. Every layer of offensive operations has been uplifted by AI, from reconnaissance and tool development to data processing and exploitation, with an example documented in case study GTG-50014. In November 2025, Anthropic documented an operating model used by a suspected state-sponsored campaign to carry out autonomous attacks.
That operating model has now proliferated across every class of actors investigated. Publicly available offensive agent frameworks such as PentAGI reproduce much of the same scaffolding for anyone who downloads them, effectively automating each step of the cyber kill chain.
The operators behind observed cases range from state services to lone individuals, across a widening set of countries. Anthropic warned that as models become increasingly capable, their risks will increase unless AI developers and society’s defenders act to make them safer. The company said it will continue to evolve safeguards and coordinate with partners to detect, disrupt and prevent future misuse.
What to watch next is whether the safeguards Anthropic describes keep pace with the frameworks anyone can download — and whether other AI developers follow with disclosures of their own.
