"Detecting and countering misuse of AI: September 2026" is the fourth threat intelligence report published by Anthropic's Threat Intelligence team, following reports in March, August and November 2025. Published September 10, 2026, it presents case studies of activity disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation.
The report states that Claude Haiku, Sonnet and Opus models were used in the misuse cases, and that "none of the misuse cases involved the use of Claude Fable or Mythos-class models, with the exception of one illicit distillation case." Threat actors are designated by internal Generative Threat Group (GTG) identifiers. The report defines "uplift" as the AI capability boost, measured "through the lens of speed, scale, and depth," and states the cases "aren't typical misuse, but rather examples of the most notable and novel threat activity we've identified to date."
Cyber operations
Two trends are named. The first is that "sophisticated attacks no longer require sophisticated attackers": the report states AI "has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators," so that "sophistication has stopped being a reliable signal of who is behind an operation." The operating model documented in November 2025 for a suspected state-sponsored autonomous campaign "has now proliferated across every class of actors we investigated," aided by publicly available offensive agent frameworks such as PentAGI that "reproduce much of the same scaffolding for anyone who downloads them."
The second is increasing autonomy. The report places the cases on a spectrum from conversational assistance through human-directed execution to operations running "autonomously, with minimal human input or supervision," including "a collection fleet running on a pre-set schedule with no human in the loop." Two caveats are attached: humans "have retained the decisions that matter most to them" — target selection, monetization, review of results — and "autonomy and harm are separate axes," since "several of the most serious compromises we report here came from operations where a human directed every step." The economic formulation is that "AI autonomy compresses the cost side of attacker ROI calculations, lowering the skill threshold and labor required per campaign, while leaving potential payoffs largely unchanged," making "previously marginal targets viable."
The report states that none of the operations "depended on some entirely novel technique that defenders have never seen" — the attacks involve stolen credentials, unpatched edge devices, exposed services, SQL injection and phishing — and that what changed is "the economics of the attacks," with results including "breaches completed in two to three hours, and dozens of victims handled in parallel by individual operators." See Autonomous cyber-agents, AI and Cybersecurity.
The named cyber cases are GTG-20006, a Russian espionage actor whose attribution the report describes as "consistent with public reporting linking the actor to Midnight Blizzard"; GTG-50014, operators suspected of affiliation with the ShinyHunters collective; GTG-10007, exploit foundries and autonomous attack frameworks; GTG-50020 and GTG-50021, targeting the AI supply chain; and GTG-50029, hacktivists targeting European political entities.
GTG-20006 is described in the most detail. It targeted more than 20 organizations — government ministries, defense and intelligence bodies, embassies, think tanks and defense-industrial companies, concentrated in Ukraine and Europe — scanned email and remote-access systems across more than two dozen Ukrainian government organizations, and bulk-exported the mailboxes of at least two drone component manufacturers, stealing "a complete proprietary software development kit for a drone vision system." It compromised at least three hospitality vendors operating hotel guest WiFi and used DNS hijacking to stage malware delivery, a method Microsoft Threat Intelligence separately published in July 2026 as CaptiveCrunch. An intrusion of a North African government technology authority exfiltrated "more than 300,000 national identity records, and the commercial registry data of more than half a million companies." The report states the actor used AI to monitor whether its malware had been detected and to autonomously rebuild it until undetected, concluding that "AI has inverted the cost back onto defenders."
Surveillance operations
The report describes operations by state-aligned actors, state-linked contractors and commercial spyware vendors from China, Iran and West Africa, disrupted between January and July 2026, and names three trends.
AI is used "in place of an engineering workforce": a single consultant working for Malian national security authorities is described as using Claude to engineer a mass-interception platform "capable of surveilling communications on all of the country's mobile operators and generating dossiers on targets," and "a religious affairs intelligence collection unit in the People's Republic of China that once comprised many teams of analysts has been reduced to a single office, using an AI assistant to produce thousands of investigations per month." AI is used to ingest data in bulk to identify targets, including an Iranian unit that analysed "hundreds of thousands of social media posts and selected 39 opposition accounts to monitor," and a PRC-aligned actor with no Arabic skills who ran "a multiday recruitment operation to infiltrate Uyghur targets in Syria," with the model drafting outreach in the regional dialect and translating replies in real time. And AI is "fully integrated into states' security bureaucracy," with one PRC state security bureau using Claude to produce an internal manual on using AI in surveillance operations.
A separate case, GTG-30005, concerns military reconnaissance rather than dissident surveillance: an Iran-nexus actor used Claude to develop targeting recommendations against US naval forces in the region, compiling targeting handbooks through a Python pipeline built with Claude's assistance from "a roster of US personnel scraped from captions on public military photographs; publicly accessible ship and aircraft transponder identifiers; commercial satellite-imagery query scripts; and an inventory of public websites that exposed US naval movements," and directing Claude to catalogue known vulnerabilities in maritime VSAT terminals, Cisco communications equipment and industrial control products. The same account also designed components of an Iranian domestic mass-surveillance platform combining automatic licence-plate recognition with mobile-device identifier interception, and built analytics over a same-day export of a private 244-member Telegram group. A further case, GTG-30006, covers phishing and delivery tooling, an implant the report names SECOMS64, and Microsoft 365 mailbox theft.
The report states that "in nearly every case described in this section, the operators were state-aligned organizations that targeted the same diaspora and dissident communities these regimes have historically targeted," naming pro-democracy figures in Hong Kong, Tibetan and Falun Gong communities across Asia, and Iranian minority communities abroad. See AI and Surveillance.
Influence operations
Nine trends are listed, including influence sold as a service by working advertising and marketing firms alongside ordinary commercial work; Claude "slotted into a human-edited pipeline … playing the role of a sub-editor or content creator"; the model producing "doctrine manuals, opposition dossiers, ministerial portfolios, persona systems, target databases, employment contracts encoding editorial loyalty, and scoring rubrics"; persistent tooling in which "markdown files containing doctrine were reused almost verbatim across hundreds of sessions"; and laundering of attribution, in which actors "prompted Claude to intentionally strip state attribution from republished material, passing claims through chains of outlets so they read as independently confirmed."
One case is recorded in which an actor tied to a Russian state media operation "produced claims the model flagged as unverified, then instructed it to drop those caveats and present everything as confirmed." Others involve cloning a real activist's account "to hold live conversations with his contacts inside Iran," ghost-written testimony "delivered in a live UN Human Rights Council session," and counter-dossiers on UN Special Rapporteurs.
The ninth trend is a limit on the findings: "influence operations often fail to reach a genuine audience." Because Anthropic sits "at the production stage of operations, upstream of platforms like social media platforms," it may disrupt an operation before it builds an audience; "most of the content we discovered drew little or no authentic engagement," and "the widest authentic reach occurred where state media outlets were the distribution mechanism," including FM, satellite and shortwave radio and global television. See AI-enabled influence operations.
Named operations span a Russian information-manipulation operation in the Central African Republic (GTG-04001), a commercial influence-as-a-service operation spanning six continents (GTG-54002), a commercial election-manipulation platform targeting Malaysia (GTG-84005), Russian state-media editorial pipelines (GTG-24015), Iranian state-aligned operations (GTG-34001), a pro-Awami League fake-news operation targeting rural Bangladesh (GTG-54006), a distributed MEK/NCRI-aligned operation (GTG-84006), a domestic campaign in Kenya (GTG-54004), and a UAE-directed operation (GTG-84002).
Conventional weapons
The report identifies use of Claude "to develop software for conventional weapons, including firearms, missiles, armed drones, bombs, and other munitions, as well as the targeting and control systems that operate them" as a new category since the November 2025 report. Six cases are presented — three in China, two in Russia, one in Yemen — split into weapons development and design, and intelligence collection and procurement.
The development cases are a Yemen-based guided weapons engineering cell whose guidance software was subject to a live field test (GTG-87001); a China-based operation drafting a fire-control specification and acquisition documentation for a torpedo-interception system (GTG-17001); a Russia-based operation engineering an autonomous military drone swarm, tested in simulation with code loaded onto real boards (GTG-27005); and a China-based operation building targeting software for electronic warfare and air-defense suppression (GTG-17002). The procurement cases are a Russia-based operation sourcing mixed military and civilian goods (GTG-27006) and a China-based operation collecting intelligence on directed-energy weapons and their suppliers (GTG-17003).
The report states that across these cases "the actors used Claude to build and refine software for weapons hardware and firmware with which they already had expertise and to which they had access," splitting work "across many sessions to conceal the full nature of their programs." Anthropic's Frontier Red Team published companion evaluations for tactical intelligence targeting and conventional weapons development, which the report says "show that models are making consistent progress on simulated intelligence and weapons development tasks," and Anthropic states it launched "a new set of classifiers designed to better detect and block traffic related to high-yield explosives and weapons development." See Autonomous Weapons, Export Controls (AI).
Biological misuse
The report states that "to our knowledge, no private company, AI or otherwise, has yet shared evidence of the potential misuse of their platforms for biological weapons development publicly," and presents five case studies. It records a shift in Anthropic's own assurance: evaluations of Claude Opus 4 and Sonnet 4.5 "clearly showed that these models were well below the threshold where they could meaningfully assist a sophisticated user," but "for today's models … the evidence is no longer certain, and we cannot make that same assurance," which the report gives as the reason Claude Fable 5 launched with safeguards restricting "a wide range of dual-use biological research queries."
| Case | Activity | Outcome |
|---|---|---|
| 1 | A reseller platform tunnelled traffic through US infrastructure and used a zero-data-retention service to serve virologists pursuing state-funded chikungunya gain-of-function work on transmissibility and immune evasion at a military research institute | Classifiers blocked all associated exchanges; accounts banned May 2026; operator re-established access within days and added a fallback routing refused prompts to a competitor's more permissive model, with Claude writing much of that routing code "presented to it as over-refusal mitigation" |
| 2 | A researcher outside the US spent weeks planning mammalian-adaptation and airborne-transmissibility experiments on highly pathogenic avian influenza, exchanging thousands of messages | Classifiers confined the work to Claude Sonnet 4 and Haiku 4.5; uplift assessed as "primarily clerical assistance in data analysis, study ideation and design" |
| 3 | A reseller relay serving more than a dozen customers had Claude Opus 5 draft an end-to-end orthopoxvirus immune-evasion grant application — hypothesis, experimental design, dosing, statistical plans, contingencies — in about an hour | Not blocked; the report attributes this to the research's dual-use nature and explicit focus on attenuation |
| 4 | A state-supported researcher built a venom-peptide atlas across multiple venomous animal lineages and a generative optimization pipeline, with scaffolds for both analgesic and paralytic targets, some export-controlled under the Australia Group common control list | Proceeded largely unimpeded; account banned May 2026 for unsupported-region evasion |
| 5 | A researcher computationally redesigned toxins under a national public research programme, covering a bacterial toxin subunit and a protein of a hemorrhagic-fever virus on the WHO R&D Blueprint priority list, directing Claude to keep agent identities "deliberately low fidelity" in co-written quarterly progress reports | Proceeded largely unimpeded; account banned May 2026 |
The report's conclusion distinguishes what the classifiers did and did not do: they "robustly guard content in domains that they have been designed to restrict (Cases 1-2)," while "an increasing range of dual-use content is becoming highly valuable to beneficial and potentially malicious users alike (Cases 3-5)." It states that "since it is not possible to reliably identify the intent of the user in highly technical dual-use areas, a classifier cannot simultaneously enable benefit and prevent harm," and concludes that "the only safe way to serve frontier biological capabilities is to offer them in trusted user programs," pointing to OpenAI's GPT-Rosalind deployment as an analogous step by a peer.
A sweep of 30 days of activity associated with adversarial state institutions found "roughly 35 distinct research efforts, most of them ordinary civilian science, but some with notable dual-use potential." The report frames the cases "not of the imminence of biological threats currently uplifted by Claude, but rather as evidence that significant dual-use research efforts are associated with state actors of concern who routinely evade our access controls via relays, ZDR abuse, multi-model fallback, and explicit classifier evasion attempts." Institution names, countries and specific biological agents are withheld, on the stated ground that "the individuals implicated in these case studies are working scientists" whom identification "could expose … to harm." See AI Biosecurity, AI Pre-Release Vetting.
Illicit distillation
The report defines illicit distillation as "an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization," distinguished from legitimate distillation and "typically enabled by fraud: sophisticated networks of fake accounts created with stolen credit cards, login credentials, and API keys." It states that since the February 2026 first disclosure, Anthropic has disrupted attacks "from seven labs based in China," all targeting generally available models, with no attempts observed against Mythos 5 or Mythos Preview.
| Lab (GTG) | Scale as reported | Method |
|---|---|---|
| Alibaba (Qwen / Tongyi Lab), GTG-16005 | Over 151 million exchanges May–July 2026; peak near 3 million exchanges per day from more than 3,500 fraudulent accounts; a first pool of nearly 5,000 accounts using residential proxies, disposable emails and virtual-card payments | A fixed injected prompt forced Claude to write reasoning inside inline text tags before answering; transcripts converted to supervised fine-tuning data used to train Qwen 3.5, 3.6 and 3.7. Also used Claude to develop internal model-development infrastructure, reinforcement-learning environments and model architecture research. Described as "the largest distillation attack we have ever measured" |
| Moonshot AI, GTG-16002 | Over 23 million exchanges May–July 2026; almost 300,000 customer requests relayed over ten days through 5,380 fraudulent accounts, mostly appearing to be in Singapore and Japan | Silently forwarded its own customers' requests to Claude and displayed Claude's responses as Kimi's, while saving the exchanges; circumvented the thinking-signature control by saving the signature, starting a new session and eliciting Claude to convert it back into the full reasoning trace |
| DeepSeek, GTG-16001 | Over 12.1 million exchanges over 14 days in July 2026 | The same cross-session replay attack; tagged inbound requests by harness string (Claude Code, the Claude Agent SDK, OpenCode) and relayed selected tagged users to Claude Opus |
| Zhipu / Z.ai, GTG-16006 | 770,609 exchanges through a chain-of-thought extraction cleaner over 10 days in June; over 3 million exchanges attributed over the same period; 3.4 million over 17 days in June–July; 273 fraudulent accounts rotated | Replayed captured reasoning traces back through Claude to clean them for training GLM models; also used Claude to judge outputs, score and filter training data, write tasks and implement testing |
| Xiaomi, GTG-16008 | Over 400,000 requests over 20 days in March–April 2026 across more than 1,500 accounts | Replayed its own users' MiMo conversations and coding sessions through Claude for supervised fine-tuning and reinforcement learning, and used Claude to reconstruct developer environments and judge answer quality |
| SenseTime, GTG-16012 | Not quantified | Pipeline included transcripts of user–Claude exchanges purchased from third-party data vendors; Claude also used to write the distillation pipeline and to launch and monitor training runs |
| MiniMax, GTG-16003 | Not quantified | Built its own proxy network service through a shell company with no disclosed link to MiniMax, offering access only to Anthropic and OpenAI models and not to any Chinese models, including MiniMax's own |
Two findings go beyond extraction volume. The first concerns transfer: the report states that "a model distilled from a frontier model can help achieve dangerous capabilities, including those in the biological or cyber domains, even when the harvested exchanges contain little about those subjects," and that "the robust safeguards that prevent Claude from being misused by bad actors do not transfer when our models are distilled by an unauthorized lab."
The second concerns end-user data. The report states that DeepSeek, Xiaomi and Moonshot "fed conversations between their own models and users into Claude," exposing to a third party sessions containing "names, email addresses, company data, and other sensitive data of hundreds of end users in at least a dozen languages," many relayed from third-party model routing services "commonly used by users in the United States and Europe," and that these practices "are likely inconsistent with privacy laws and the labs' own terms of service." Named examples include a user assessed as likely PLA-affiliated analysing CCTV archive data on a targeted individual from hundreds of cameras in Chengdu; an engineer at a PRC state-owned enterprise who exposed internal code and live credentials; an IT operator working with data from a Russian government agency associated with its Ministry of Defense, exposing live database credentials; and engineers building a case management system for a municipal Public Security Bureau that compares a person's movements against police records by national ID number. See AI and Privacy.
One case records safeguards changing a target's behavior. Ahead of its GLM 5.3 release, Zhipu attempted to distill the cyber capabilities of Claude Fable and "eventually gave up trying to target Fable after Anthropic's cyber safeguards degraded Zhipu's attacks," switching to Claude Opus 4.6 and to another US laboratory's leading model "expressly because they assessed the safeguards were weaker."
Countermeasures described include attribution of proxy-account activity to organizations rather than individual bans, classifiers for adversarial extraction strengthened alongside the Fable 5 launch, summarization of Claude's internal reasoning before responding, "preserved thinking" introduced with Fable 5.1 that "stops new API accounts from altering the system prompt, tools, or messages that precede Claude's reasoning in multi-turn conversations," and identity verification requirements triggered by signals such as unauthorized resale or operation from unsupported countries. See Adversarial Distillation.
Relation to the NSA/CISA/FBI advisory
The report was published two days after joint advisory AA26-251A, which made the first US interagency attribution of the same practice (Joint Cybersecurity Advisory AA26-251A: China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns (NSA/CISA/FBI, September 2026)). The named-firm lists overlap but do not match: both name Alibaba, Moonshot, DeepSeek, Zhipu/Z.AI and MiniMax; Anthropic adds Xiaomi and SenseTime, while the advisory adds StepFun, which Anthropic does not name. Anthropic's account supplies per-campaign exchange counts, fraudulent-account counts and date ranges that the advisory does not, and adds the user-data relaying finding, which the advisory does not address. The advisory in turn covers models from multiple US providers, where Anthropic reports only on Claude.
Provenance
Captured September 11, 2026 from anthropic.com in full, including case studies, indicator-of-compromise blocks and figure captions. The summary above is drawn from the report's framing sections, trend sections, the illicit-distillation section, the biological-misuse section and the conventional-weapons section in full, and from the cyber, surveillance and influence case studies in outline; the per-case indicator lists are held in the raw file but not reproduced here.
Relationships
- supports: Adversarial Distillation — per-campaign volumes, methods and a seventh and eighth named firm.
- related: Joint Cybersecurity Advisory AA26-251A: China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns (NSA/CISA/FBI, September 2026) — the interagency attribution published two days earlier, with a partially different firm list.
- supports: Autonomous cyber-agents — the autonomy spectrum and the claim that attack economics rather than technique have changed.
- supports: AI and Surveillance — state-aligned surveillance built with model assistance.
- supports: AI-enabled influence operations — nine trends, with the reach caveat.
- related: AI Biosecurity — five dual-use case studies and the trusted-user-programs conclusion.
- related: Anthropic — the publisher; the report is also the disclosure vehicle for several of its safeguard changes.
- related: Alibaba / Qwen Team, Moonshot AI, DeepSeek, Zhipu AI, Xiaomi, SenseTime, MiniMax — the seven labs named.