Anthropic published its fourth threat intelligence report on 10 September 2026, documenting misuse of its Claude models that the company's Threat Intelligence team detected and disrupted between December 2025 and August 2026. One case describes a suspected Russian espionage actor whose AI agents watched security products for detections of the actor's own malware, then rebuilt that malware in a loop until it stopped being detected.
The report, Detecting and countering misuse of AI: September 2026, covers seven areas of harm: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation. Anthropic says Claude Haiku, Sonnet, and Opus were the models used, and that none of the cases involved Claude Fable or Mythos-class models, except for a single distillation case.
Why Static Detection Is the Thing That Broke
The auto-rebuild loop belongs to an actor that Anthropic tracks as GTG-20006, whose attribution, the company says, is consistent with public reporting linking it to Midnight Blizzard. Anthropic reports that the actor's agents were designed to keep modifying and redeploying flagged implants until they evaded existing signatures, at which point the tools were staged on disposable hosting for live phishing, ClickFix, and DNS hijacking operations.
A companion payload delivered alongside GTG-20006's Windows credential stealers was designed to freeze the victim machine's security updates, preventing newly published detection signatures from reaching the device, according to the report.
Anthropic writes that capable adversaries can now close the loop, "bypassing traditional security detections faster than defenders can develop and deploy them" [pdf] — inverting onto defenders a cost that static detection used to impose on attackers.
The Operational Tempo Documented in the Report
Anthropic reports breaches completed in two to three hours, and dozens of victims handled in parallel by individual operators.
| Operation | Actor description | Speed or scale reported |
|---|---|---|
| GTG-20006 | Suspected Russian state-nexus espionage | More than 20 organizations targeted; 300,000+ national identity records taken from one North African government authority |
| GTG-50014 | Suspected ShinyHunters affiliates | 2,100+ Azure AD token sets across 40+ corporate tenants in about 34 hours; stolen developer token to full cloud admin in roughly three hours |
| GTG-10007 | Chinese-speaking exploit foundry, Hunan province | One workflow produced more than a dozen possible zero-day findings against network appliances in a single month; ~50 organizations targeted |
| GTG-50029 | Single French-speaking hacktivist | Internal access at 14 of 42 tracked entities; ~140,000 records exfiltrated, including users' political opinions |
What Changed Since Anthropic's November 2025 Report
In November 2025, Anthropic documented a single suspected state-sponsored campaign running an autonomous operating model. In the September 2026 report, the company says that the operating model has proliferated across every class of actor it investigated, and that publicly available offensive agent frameworks such as PentAGI now reproduce much of the same scaffolding for anyone who downloads them.
Anthropic states that sophistication is no longer a reliable signal of who is behind an operation. The report explicitly states that none of the documented operations relied on a technique defenders has never seen: the intrusions relied on stolen credentials, unpatched edge devices, exposed services, SQL injection, and phishing.
What changed, Anthropic says, is the economics — reconnaissance, exploitation, tool development, and data processing are now delegated to models running in harnesses at machine speed and in parallel.
Why AI API Keys Are Now the Target
Anthropic reports that stolen AI API keys gave operators three things at once: resale value, attack compute billed to someone else, and attribution pointing at the key's legitimate owner. One hacktivist campaign ran for a month entirely on stolen keys. In every instance described, Anthropic says the keys were taken from customers' environments, and its own systems were not compromised.
The report also describes GTG-50021, a Russian- and Ukrainian-speaking group that sold discounted Claude access, silently proxied traffic to a different AI model, and installed a credential harvester that stole buyers' Anthropic credentials for onward sale. Anthropic's guidance is to treat AI keys and agent integrations with the same seriousness as production credentials and to purchase AI access only through authorised channels.
Where Defenders Are Most Exposed
Organisations whose detection strategy rests on static signatures are the most exposed group described in the report, because an agent that iterates until undetected defeats a signature faster than a vendor can ship one.
The report's other recurring entry point is exposed secrets: one operator's pipeline mass-downloaded 1.8 million distinct Android APKs, decompiled them, and scanned for hardcoded credentials, feeding verified findings to a Telegram group in real time. Scanning your own shipped binaries and containers for secrets, rotating anything already exposed, and alerting on anomalous AI key usage all address paths this report documents directly.