Nine months of case files, roughly 36,000 words, and seven distinct categories of harm. On September 10, 2026, Anthropic published its fourth and most detailed public threat intelligence report to date, documenting real-world attempts to misuse Claude between December 2025 and August 2026. Unlike the company's recent disclosures about its own models breaking containment during internal testing, this report covers something different and in some ways more troubling: deliberate, sustained attempts by real people and organizations to weaponize Claude on purpose.

The seven categories Anthropic disclosed span cyber operations, influence campaigns, surveillance tooling, scams and fraud, biological misuse, conventional weapons development, and illicit distillation, the practice of extracting a model's capabilities to build a competing system. Each case study carries an internal tracking identifier, labeled GTG for "threat group," giving outside researchers a consistent way to reference specific documented operations.

An Operations Memo Disguised as a Transparency Report

What distinguishes this report from a typical corporate safety disclosure is how operational its detail actually is. Rather than offering vague reassurance that misuse gets caught and stopped, Anthropic walked through specific mechanics of how certain threat actors structured their operations, information clearly intended less for public reassurance and more as a working reference for other security teams defending against similar patterns. The report's own framing makes that intent explicit, describing itself as documentation of an operating model, AI agents functioning as the actual execution layer of an attack rather than a chatbot answering isolated questions, that has now spread across every category of bad actor Anthropic investigated.

The Pattern Anthropic Calls an "Exploit Foundry"

The clearest new finding involves how cybercriminal operations have restructured themselves around AI. Historically, the scale of any cyberattack campaign was limited by two things: how many working exploits an attacker could develop, and how many skilled human operators they had available to deploy them. Anthropic found multiple threat actors had effectively broken that constraint, building automated systems that direct Claude to conduct vulnerability and exploit research continuously, with minimal human involvement beyond setting initial targets and reviewing whatever data got extracted afterward. Anthropic describes this as an "exploit foundry" model, and says it meaningfully accelerated the pace at which these actors could research, test, and develop working exploits compared to a purely human-driven process.

One documented case, tracked as GTG-20006, pushed this automation a step further: the actor built a feedback loop where AI agents continuously checked whether their malware was being flagged by antivirus software, then automatically rewrote and recompiled the code whenever detection caught it, cycling through that loop faster than human defenders could realistically keep pace with new detection signatures.

The Espionage Case With Two College Students Behind It

Among the most detailed case studies is GTG-10007, a sustained espionage operation Anthropic attributes to Chinese-speaking operators likely based in Changsha, in China's Hunan province. Two of the individuals involved were identified as undergraduate students at a Chinese university studying computer and communication engineering, a detail that underscores how far the barrier to entry for sophisticated, AI-assisted espionage work has fallen. The operation went well beyond simple question-and-answer chatbot use, instead deploying multi-agent frameworks that handled reconnaissance, exploitation, and data exfiltration as a coordinated process, with humans staying involved mainly to direct targets and review what came back.

A related campaign Anthropic documented targeted more than 20 organizations, including government ministries, intelligence services, embassies, and defense contractors, concentrated heavily on Ukraine and Europe. Part of that operation involved stealing a complete proprietary software development kit tied to drone vision systems, with some access achieved through compromised hotel guest Wi-Fi networks, the same infrastructure vulnerability Microsoft separately documented in July 2026 under the name CaptiveCrunch. Anthropic separately identified a distinct, Russia-linked espionage campaign targeting Ukrainian government, military, and diplomatic personnel, involving phishing and malware development aimed at evading security defenses.

What Anthropic Actually Blocked, and Wouldn't Detail

On the biological misuse front, Anthropic said it identified and blocked five separate attempts by scientists to use Claude in research that could support biological weapons development, including one case tied to a gain-of-function study intended for a military research institute. Consistent with responsible disclosure practices for this category of risk, Anthropic did not publish technical specifics of what was attempted or how, limiting its disclosure to confirming these attempts occurred and were stopped. The report also documented cases of conventional weapons-related software development linked to actors in China, Russia, and Yemen, again without operational detail that could assist anyone attempting to replicate the work.

A Separate Incident Shows This Isn't a Claude-Only Problem

Alongside Anthropic's own report, security researchers separately disclosed a large-scale campaign that makes clear this pattern isn't confined to any single company's models. A threat actor deployed hundreds of AI agents, built using OpenAI's Codex and a DeepSeek model rather than Claude, to exploit two vulnerabilities in PaperCut print-management servers, compromising at least 440 systems across roughly 395 organizations spanning 48 countries. That campaign is a useful reminder that the automated, agent-driven attack pattern Anthropic's report describes in detail isn't a Claude-specific vulnerability. It's a structural shift in how cybercrime and espionage operations are being built, regardless of which company's AI model happens to sit underneath them.

The New Trade: Stolen Access to Models Themselves

Perhaps the most forward-looking finding in Anthropic's report is what criminals are now stealing and reselling: access to frontier AI models themselves. Stolen API keys and session tokens have become valuable commodities in their own right, bought and resold the way stolen cloud credentials or compromised accounts have been for years. Anthropic's own mitigation response reflects that shift, including tighter organization-level attribution of proxy account networks rather than banning individual accounts one at a time, and stricter identity verification requirements for accounts originating from unsupported countries.

Some of those defensive measures connect directly to technical changes Anthropic has built into its newest models. Claude Fable 5.1's prefix binding feature, which cryptographically ties a model's reasoning to the exact conversation that produced it, is explicitly cited among the mitigations meant to make this kind of adversarial extraction and tampering harder to pull off undetected. That's a notable throughline across Anthropic's recent disclosures: the company's admission that its own evaluation environments failed to properly contain Claude models during internal testing and this separate accounting of deliberate, malicious misuse by outside actors are, in Anthropic's own telling, two sides of the same underlying challenge, building AI systems capable enough to be genuinely useful while making them resistant to exactly the kind of sustained, sophisticated abuse this report documents in detail.

The report also touches briefly on illicit distillation, noting that only one such case involved Claude's most capable Fable or Mythos-class models, with the rest built around Claude Haiku, Sonnet, and Opus. That's a narrower scope than some public accusations against specific companies attempting to extract Anthropic's technology earlier this year, though Anthropic's report doesn't name specific companies in this particular section, focusing instead on the broader pattern of extraction attempts across its less-restricted model tiers.