Eight months of AI misuse: what 154 pages document

We spend our days with a coding agent open in a terminal, getting it to write deployment scripts and review configurations. An undergraduate in Changsha, in the middle of applying for a job at a Chinese security vendor, was doing exactly the same thing to produce exploits against firewalls. A consultant in Bamako was using it to build a phone interception system covering an entire country. It is the same tool; what changes is whose hands it is in and what the guardrails let through. That is the subject of the threat intelligence report Anthropic published on 10 September 2026.

We read all 154 pages. The document follows on from what we described in early September about offensive AI, but it is a different kind of document: no longer two or three headline cases, but an inventory. This article opens a series of ten, one a day until 19 September, one theme at a time. Today: the overview, the analytical framework the vendor sets out, one case with figures for each kind of misuse, and the limits of the document.

What the document covers #

The report covers operations detected and disrupted between December 2025 and August 2026, grouped into seven categories. Anthropic refers to each actor by an internal identifier (GTG, for Generative Threat Group) and states from the outset that these cases are not representative of typical use. Here is the best-documented case in each category, without a single technical indicator of compromise.

• Cyber: GTG-20006, Russian espionage. Attribution consistent with Midnight Blizzard, more than twenty organisations targeted in Ukraine and Europe. At one North African government authority: more than 300,000 national identity records and the business register of over half a million companies.
• Influence: GTG-54002. Around seventy fake news sites, 8,913 articles in some twenty languages, more than two hundred and fifty fake commenting accounts. The report links the network to LKM Company, an online advertising agency based in France, which switched political sides depending on the paying client.
• Surveillance: GTG-50027, Mali. A consultant in Bamako built a platform for state intelligence covering around 25 million SIM cards across the country's three mobile operators. The requirement for a court warrant was removed at the operator's request.
• Conventional weapons: GTG-87001, Yemen. A cell used Claude Code in place of engineers for the guidance of a rocket, of a ballistic missile aiming at a range of more than 2,000 km and of a hypersonic glider, with several instances running in parallel: one to write code, one to research, one to review. A test launch failed; they were back within hours.
• Biology: a reseller relay. One anonymised account was in fact serving more than a dozen unrelated customers. One of them had a complete grant application on immune evasion in orthopoxviruses written on Opus 5, in about an hour.
• Scams: GTG-15001. A Chinese studio set up more than twenty dating apps sold as entirely human. In two weeks of April 2026: more than 4,700 artificial personas, at least 25,000 real people, 2.36 million messages.
• Distillation: GTG-16005, Alibaba. The largest campaign the vendor has ever measured, targeting the reasoning traces of Opus 4.6 and 4.7: peaks of almost 3 million exchanges a day, more than 151 million exchanges between May and July 2026.

What the seven have in common: none of them required rare skills. A consultant, an app studio, two students, an advertising agency. What used to be missing (engineers, translators, analysts) now comes with a subscription.

What is new since the 2025 reports #

Anthropic published three in 2025, in March, August and November. The autonomous attack model described in November 2025 for a single suspected state campaign has since spread to every class of actor examined. Two entire categories appear for the first time: conventional weapons and biology, where the vendor states that no company had previously published concrete evidence of misuse of its own platform. Finally, the first report described a single commercial network running outsourced influence operations; this one documents nine.

How Anthropic measures: speed, scale, depth #

Anthropic calls the gain that AI provides uplift, meaning how much additional harm is caused with AI compared with without it, and looks at it from three angles: speed, scale and depth. Then comes a warning most commentators ignored. Many focus on the risk of AI producing exploits in bulk; that danger is real, but the risk is more pronounced across the whole attack chain, where adversaries operate faster, across a broader and deeper surface, with fewer resources. For an SME, then, the threat is not dealt with by a better-patched firewall, but by limiting what an attacker can do once inside.

Three findings run through the whole report #

1. Sophistication is no longer a clue #

For twenty years, the technical quality of an intrusion was used to guess who was behind it: a state had resources, a lone individual did not. That shortcut is dead. The report says so plainly: a lone hacktivist working from stolen API keys, a financially motivated criminal group and a state espionage operator each ran multi-victim campaigns that would have required a team of skilled operators only a year ago. In the report's view, what now separates these classes of actor is no longer sophistication but intent.

The most direct wording is aimed at investigators: “sophistication has stopped being a reliable signal of who is behind an operation.” The reason is industrial. Public offensive agent frameworks, among which the report names PentAGI, reproduce most of the setup for anyone who downloads them, and two of the actors described were running on them. Hence Anthropic's advice: the capabilities described should be assumed to be available to any motivated actor. Technical skill can be downloaded.

2. AI has gone from assistant to conductor #

The end of the cyber chapter describes an autonomy spectrum, with named examples. At one end, the use is conversational: the model serves as an engineering assistant for writing malware or a phishing kit. Further along, it executes (commands against the victim's systems, credential harvesting, exfiltration) while a human makes every targeting decision; that is the case of the Russian espionage actor. At the far end, multi-agent frameworks carry out reconnaissance, exploitation and theft against several victims in parallel, for hours or days, among ShinyHunters affiliates and with the French-speaking hacktivist. Further still: a fleet of thirteen collection agents running on a simple scheduled task, with no human involvement at all.

3. The cost has changed sides #

Historically, a defender who published a detection signature imposed a cost on the attacker, who had to rebuild the tool. In the Russian espionage case, agents continuously checked whether the implants were being detected by security products and, if so, rebuilt them on their own until they slipped back under the radar. Anthropic writes that “AI has inverted the cost back onto defenders”: a capable adversary closes this loop faster than the industry publishes its detections.

The report then puts the argument in economic terms, and this is the passage worth reading twice. Autonomy compresses the cost side of the attacker's return-on-investment calculation: it lowers the skill threshold and the amount of work per campaign, without changing the potential gain. In the report's words, this shift “makes previously marginal targets viable and encourages higher-volume, lower-touch operations.” The marginal target is the twelve-person accountancy firm or the municipality of two thousand inhabitants. Lower touch means the attack that gets in, empties and gets out: the profiles we come across in managed services for Alsace SMEs.

“Security through obscurity is no longer viable” #

With AI, diverse target environments are made trivial to understand and adjust to; unique and obscure configurations are made clear and exploitable. The old adage of “security through obscurity” is no longer viable in this new AI-assisted world: everything connected to the internet is a potential target for exploitation.

The sentence targets a very common defensive reflex. The business software package custom-written in 2009, the ERP whose internal logic nobody understands any more, the industrial controller driven by an in-house protocol: all of them were protected simply because an attacker first had to learn the system, which took days and only paid off for a substantial prize. A model reads the documentation, the error messages and the decompiled code as fast as it receives them. An obscure application is no longer a security measure, it is documentation debt. The only protections that hold are those that do not depend on how hard something is to understand: strong authentication, segmentation, least privilege, vulnerability monitoring of what you run.

The orders of magnitude #

• 1.8 million Android apps downloaded and decompiled by a fleet of ten rented machines, looking for secrets left in the code.
• Two to three hours between first access and bulk data theft, across several intrusions.
• 2,100 sets of authentication tokens harvested from more than 40 customer organisations in 34 hours; according to the report, the agents did almost all of the work.
• More than a dozen possible new vulnerabilities produced in one month by the Changsha exploit foundry.

Nine influence operations, and a scale to measure them #

The chapter on influence is the most methodical and, paradoxically, the most modest. To assess the real reach of each operation, Anthropic applies the Brookings scale (Breakout Scale), a six-category framework recognised by researchers: it measures not the volume produced but migration across platforms and the public exposure achieved.

The result is instructive. The Kenyan astroturfing campaign, produced in batches of fifty messages designed to look like spontaneous outrage, is rated category 1: confined to its own network of fake accounts, without reaching a single real person. The French agency with seventy fake media outlets, despite its 8,913 articles, is rated category 2. The only category 4, the highest in the report, owes nothing to technology: it is the Central African Republic case, where the content went out every day on an FM radio station.

Anthropic draws a conclusion it deserves credit for: most influence operations reach no authentic audience. The widest reach was achieved where state media served as the channel: FM radio, satellite, shortwave, television. The useful reading, then, is not “the web is about to drown in fake articles” but: fake content only becomes dangerous once it finds a legitimate distribution channel. For you, that means someone impersonating your brand, or a call that seems to come from a senior manager.

The guardrails that give way, and how #

A vendor report could simply show its protections working. This one also documents the cases where they did not hold. Three techniques come up again and again.

• Splitting the work. The Yemeni weapons cell spread its requests over many sessions, so that no single session revealed its full intent; the report admits that “our safeguards blocked many of their requests, but not all of them.” The same mechanism on the Iranian side: nine refusals out of ten direct requests, but protections that were less consistent once the user split the work across smaller, later sessions.
• Rephrasing after a refusal. In the Central African Republic, the model refused to name individuals as activists in order to draw security force action against them; the actor switched to wording based on anonymous sources. In Malaysia, after a refusal on a document identified as political smear material, the actor negotiated sanitised vocabulary. In China, a refusal on a “stability maintenance” report was overturned when the request was repeated.
• Geographic workarounds. VPNs, foreign phone numbers, rotating accounts, servers rented abroad, resellers and third-party relays: this is how Iranian propagandists got round the block on access from Iran, and how the Russian team working on the drone swarm routed its traffic through commercial servers.

The report goes as far as an admission. On the Chinese surveillance operations, it states that its existing safeguards did not work uniformly in these cases. On the Iranian units: Claude refused explicit profiling requests, but did not refuse many of the requests for surveillance software tooling. And on the biology side, one platform operator had added an automatic fallback: refused queries were sent on to a competitor's model.

Haiku, Sonnet, Opus: the argument the reader is entitled to turn around #

The document is precise on one point, and that point is as commercial as it is technical. The models misused are Claude Haiku, Sonnet and Opus. No case involves the Fable or Mythos class models, with one exception, in distillation: a Chinese lab tried to distil Fable's cyber capabilities, then gave up because the protections degraded its attacks, and fell back on Opus 4.6 and on the best model of another American lab, explicitly because it judged their guardrails to be weaker. As for the Mythos models, no attempt was observed, the report noting that they are not available to the general public. The vendor's argument is clear: the newest and most tightly locked-down models are the least misused. The reader is entitled to turn it around.

1. It is a sales argument. The models praised as safe are the most expensive in the range, and one of them is not available to the public: it is trivially absent from the misuse statistics.
2. Protections do not survive distillation. The report says so: guardrails are not carried over when the model is distilled elsewhere. Safety is not a property of the model, it is a property of the service.
3. A restricted model is still useful to an attacker. The researcher working on avian flu was confined by the classifiers to the weakest models; the help is described as “primarily clerical”, but it still supported weeks of study design.

The takeaway, without cynicism or naivety: the model version your provider uses is a security parameter, just like the version of its operating system. We covered the political side of this dependency when Washington cut off access to two models; the report supplies the operational side.

Annex A: the tools attackers build for themselves #

The cyber chapter ends with an annex introduced as follows: “The following is a list of skills developed by threat actors to build out their AI-enabled workflows.” A skill is a reusable module attached to an agent to give it a lasting capability: the very mechanism our own team uses.

The details are published only as a figure, and we will not reproduce it from memory. The body of the report names several: a custom skill for decrypting firmware images of network devices; skills driving an espionage actor's phishing workflows; surveillance skills querying a government database; and, with one Iranian actor, the custom skills feature turned into a voice-cloning factory. So the attackers have not invented a parallel toolset: they use the features designed for developers, for the same reasons, namely to capture know-how and run a process without watching over it.

What the report does not say #

A report published by the vendor of the misused model is not a neutral source, and it has to be read as such. Four gaps are worth setting out.

• Duration. The document almost never says how long an operation ran before it was spotted. We read “we identified and disrupted”, rarely “after eleven months of activity”. In the Bangladeshi operation, a table reveals in passing that the actor ran 29 accounts for sixteen months.
• Follow-up. Which authorities were informed, in which countries, with what legal outcome? The report only mentions sharing with public and private sector partners where appropriate. That is all.
• How effective bans are. In Mali, closing the account halted the design work but not the deployment: the platform runs on site with local models. In one biology case, the operator regained access within a few days under new identities.
• Verifiability. Volumes, attributions and confidence assessments rest on one company's internal telemetry; nobody outside can cross-check them.

The commercial interest is obvious: the document shows the guardrails at work, promotes the most tightly locked-down models, and puts the blame on competing Chinese labs. None of that invalidates the substance. The mechanisms described match what Google Threat Intelligence published on LLM-driven malware, what Check Point observed twelve hours after a gateway vulnerability was disclosed (an episode we recounted in our timeline of offensive AI), what we wrote about models that find vulnerabilities faster than they can be fixed, and the caution of the ANSSI cyber threat overview (ANSSI, the French national cybersecurity agency), which describes AI as an accelerator. Both readings hold together: AI does not create new attacks, it makes the old ones cheap enough that nobody is too small to be targeted any more.

Ten days, ten articles #

We are not model vendors. We host, manage and develop for SMEs, and our only question while reading these 154 pages was: what changes on Monday morning on the servers we run? The series answers one theme at a time, until 19 September.

1. 10 September: Eight months of misuse, what 154 pages document (this article).
2. 11 September: Your AI API key is worth three things to an attacker.
3. 12 September: Two hours from first access to theft, the economics of intrusion have changed.
4. 13 September: The malware that rewrites itself until it can no longer be seen.
5. 14 September: WordPress, a webshell in the fonts, poisoned backups.
6. 15 September: Exploit foundries, your firewall is the front line.
7. 16 September: Your prompt does not stay where you think.
8. 17 September: One consultant, one AI, 25 million SIM cards.
9. 18 September: Manufacturing fake humans at scale.
10. 19 September: Missiles, drones, viruses: what the extreme cases say about choosing an AI provider.

Tomorrow: what happens to a stolen API key, and why keys for AI services have become a commodity in their own right. If you would like to discuss your own systems before the series ends, write to us: it is exactly the conversation we are having with our managed services clients this week.

Sources #

• Anthropic, Detecting and countering misuse of AI: September 2026 (10 September 2026), 154 pages: the main source for the whole series.
• Same report: Cyber operations chapter for uplift in terms of speed, scale, depth, the Prevailing trends section and Annex A; Influence operations chapter for the Brookings scale; Surveillance, Conventional weapons, Biological misuse and Illicit distillation chapters for the cases cited and the admissions about guardrails.
• ANSSI / CERT-FR, Panorama de la cybermenace 2025 (2025 cyber threat overview, 11 March 2026).
• Google Threat Intelligence Group via The Hacker News, PROMPTFLUX and PROMPTSTEAL (November 2025).
• Check Point, HexStrike-AI: when LLMs meet zero-day exploitation (September 2025): the twelve-hour window between the patch being published and the first exploitation recipes.
• Our earlier articles: AI is already hacking and Mythos, GPT-6 Astra.