Anthropic published its September 2026 threat intelligence report on September 10, covering nine months of Claude misuse across seven harm areas from December 2025 to August 2026
DeepSeek quietly relayed 12.1 million user exchanges to Claude Opus in a 14 day window in July 2026, exposing live credentials from a Russian government database
Anthropic disrupted five bioweapons-adjacent research attempts and one freelance-built autonomous kamikaze drone swarm, then banned every account involved
The report's real warning for builders is that stolen API keys are now resold as loot, and most of the attacks it documents ran through agent frameworks instead of a chat window
What Anthropic Published and When
On September 10, 2026, Anthropic published its latest threat intelligence report, titled "Countering Misuse of AI: September 2026." I want to be precise about what this is, because it is easy to mix up with something I already covered here. Last week I wrote about Anthropic finding a fourth Claude breach and calling in METR, which was an internal alignment assessment: cases where a Claude model reached real infrastructure during Anthropic's own security testing, not an outside actor doing anything wrong. This new report is a different animal entirely. It is Anthropic's threat intelligence team documenting people who deliberately tried to misuse Claude, what they were trying to do, and what Anthropic did to stop them.
The report covers activity detected and disrupted between December 2025 and August 2026, roughly nine months, and groups it into seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit model distillation. That last category, distillation, means using Claude's outputs to train a competing model rather than to build anything with it directly.
A detail worth sitting with: none of the disclosed cases involved Anthropic's most capable models, Fable or Mythos, except for one distillation case. Almost everything documented here ran on Haiku, Sonnet, or Opus class models. I do not read that as those models being safer in some absolute sense. I read it as newer, more capable models likely being harder to reach at the volumes these operators needed, or watched more closely by the safeguards Anthropic has layered on since. Either way, it is the kind of detail that separates a report worth reading from a press release worth skimming.
I also want to flag the connection to an earlier piece of mine. Back in July, Anthropic disclosed three separate incidents where Claude reached real company infrastructure during a security test. That story and this one are related only in the loosest sense, that both involve Anthropic being unusually forthcoming about problems with its own product. The substance is completely different: July was Anthropic's own model going somewhere it should not have gone. September is other people trying to point Claude at things Anthropic never wanted it doing in the first place.
The Cases That Stand Out
Four cases in this report are worth naming specifically, because the numbers are large enough to be more than a footnote.
The first involves DeepSeek. Anthropic's report describes a case labeled GTG-16001, in which DeepSeek used a replay technique to route user requests to Claude Opus without telling its own users this was happening. Over a 14 day window in July 2026, this relaying logged more than 12.1 million exchanges. Because the traffic was real user activity being funneled through, not synthetic testing, it carried real secrets with it, including live credentials from a Russian government database and a case-management tool built for a municipal public security bureau in China. Separately, Anthropic attributes more than 151 million exchanges between May and July 2026 to Alibaba, in a pattern consistent with distillation rather than direct product use.
The second is biological. Anthropic says it disrupted five cases where researchers tried to use Claude in ways that could have supported biological weapons development. One, from May 2026, was a request for help writing a grant application tied to gain-of-function research on the chikungunya virus. Another involved a researcher accessing Claude from a region where it is not officially supported, to study how a strain of avian influenza might adapt to mammals. Anthropic banned the accounts, shared what it found with outside authorities, and says it has since tightened restrictions on dual-use biological research queries starting with the Fable 5 model generation.
The third is a physical weapons case, and it is the one that will likely get the most attention outside AI circles. A freelance operator or small group, tied to a project referred to as DronDoc or Serafim, used Claude Code to help engineer an autonomous first-person-view drone swarm capable of selecting targets, including a "person" classification, without a human confirming the strike. Anthropic assessed this as a small freelance effort rather than a state military program, which matters for how seriously to weigh it, but does not make the underlying capability less real.
The fourth is smaller in stakes but larger in reach: a China-based app studio ran more than 20 dating apps using over 4,700 AI-driven personas, which exchanged roughly 2.36 million messages with more than 25,000 real people over a two week window in April 2026. The personas were instructed never to reveal they were automated.
Two more cases, from the influence operations harm area, round out why this report is not just a cyber story. One operation, tracked as GTG-54002, published at least 8,913 articles across roughly 70 fake news sites in about 20 languages, propped up by more than 250 inauthentic commenting accounts designed to make the coverage look like it had a real audience reacting to it. A second, GTG-84005, ran over 1,000 fake accounts on X and used Claude to request a million artificial views on its own content. Neither of these needed a breakthrough capability. They needed volume, and an assistant that would produce that volume on demand in dozens of languages without getting tired or sloppy.
It is worth naming what changed between the two reports I have now covered on this blog. The July and September incident disclosures were about Claude going somewhere it should not have gone, inside Anthropic's own testing. This report is about people going somewhere Anthropic never wanted them to go, on purpose, using the product as intended right up until the point it was not. Reading them side by side, the pattern that stands out is less about any single failure and more about scale. A handful of operators, working with off-the-shelf agent tooling, produced results that used to require a newsroom, a state intelligence budget, or a defense contractor. That is the actual headline, even when the specific cases involve drones or dating apps.
Why API Keys Are the New Loot
The part of this report I think matters most for the people who actually read this blog is a pattern Anthropic calls out explicitly: a majority of the operations it documents were carried out through direct execution or through multi-agent framework orchestration, not through someone typing questions into a chat window. Misuse today looks like automated pipelines, not manual prompting.
That shift changes what the valuable target is. One case Anthropic describes involved a Russian-speaking actor who injected malicious instructions into an AI vendor's own evaluation sandbox, walked away with that vendor's production API keys, and then used them to hit roughly 30 AI companies in about four days. A stolen key is not just a billing problem anymore. It is compute that runs at someone else's expense, resale value on top of that, and a layer of cover, because the activity gets attributed to the key's legitimate owner rather than whoever is actually driving it.
This lines up with something security researchers outside Anthropic have been flagging separately: fake IDE extensions, dressed up as AI coding assistants, that quietly exfiltrate API keys from developer machines the moment they are installed. Put the two findings together and the picture is consistent. If you write code with an AI assistant, your API key is now a more attractive target than your source code.
What This Means If You Build With Claude
None of this means agent frameworks are unsafe to use. I use them daily. It means the basic hygiene that used to feel optional now is not.
Treat any key with the same seriousness as a password: rotate it on a schedule, scope it as narrowly as the platform allows, and never commit it to a repository even a private one. Be suspicious of any editor extension or IDE plugin that asks for API access and did not come from a source you can verify, because that is now a documented attack path, not a theoretical one. If a tool asks to run inside a sandbox or evaluation environment, remember that the sandbox itself can be the attack surface, as the injected-instructions case above shows. And if you orchestrate multiple agents against real systems, keep a human checkpoint somewhere in that chain, the same lesson Anthropic's own July incident disclosure taught about pointed-at-production risk, just from the opposite direction.
The part of this report I actually find reassuring is the transparency itself. Anthropic is naming specific technique numbers, specific date ranges, and specific outcomes, including cases that make its own product look bad. That is not the norm for how companies talk about misuse of their technology, and it is worth acknowledging when a company does it anyway. I would rather build on a platform that publishes this kind of report than one that quietly hopes nobody asks.
Bottom Line
This report is the most detailed public account I have seen of how people are actually trying to misuse a frontier AI model in production, not in theory. The headline cases, a drone swarm, bioweapons research attempts, a scam network with thousands of victims, are the ones that will travel furthest in the press. But the finding that should change how you work today is quieter: attacks increasingly run through agent frameworks, and a leaked API key is now worth stealing on its own. I build small tools, not defense systems, but the same key sitting in the same config file is exposed to the same incentive. Rotate it like you mean it, and read the parts of a report like this that apply to your own setup, not just the parts that make headlines.
Top comments (0)