Artificial intelligence is no longer used only to draft phishing emails or answer technical questions. Anthropic’s September 2026 threat intelligence report describes a more consequential shift: malicious actors are increasingly using AI to coordinate complex workflows across cyber operations, surveillance, influence campaigns, fraud, weapons-related research, biological misuse, and attempts to copy model capabilities.
The report covers activity Anthropic says it detected and disrupted between December 2025 and August 2026. Its examples are not presented as typical day-to-day use of Claude. Instead, they highlight notable and novel cases that may show where AI-enabled abuse is heading.
For security leaders, developers, and policy teams, the most important lesson is straightforward: the risk is not limited to an AI model inventing a sophisticated exploit. The bigger near-term change may be the ability to make existing operations faster, broader, and less labor-intensive.
What Anthropic’s September 2026 report covers
Anthropic groups the disrupted activity into seven areas:
- Cyber operations
- Surveillance operations
- Influence operations
- Scams and fraud
- Conventional weapons development
- Biological misuse
- Illicit model distillation
The company says the actors included suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, propaganda institutions, and politically motivated individuals. Anthropic also says it banned or disrupted the accounts it identified, strengthened safeguards using the resulting intelligence, and shared relevant findings with authorities and industry partners where appropriate.
The major shift: AI is becoming an orchestrator
Earlier discussions of malicious AI use often focused on isolated tasks. A user might ask a chatbot to rewrite a phishing message, summarize stolen data, or debug a script. Anthropic’s new report argues that some operators are moving beyond that assistant model.
In several documented cases, AI was integrated into multi-step systems that supported reconnaissance, infrastructure setup, exploitation, monitoring, and data processing. Humans still selected targets and reviewed important outputs, but automated workflows handled more of the operational chain.
This matters because orchestration changes the economics of an attack. An operation does not need to become fully autonomous to become more dangerous. If AI reduces the time, staffing, or specialist knowledge required for each stage, a smaller team can potentially pursue more targets and adapt faster.
Why traditional signals of sophistication may become less reliable
Security analysts often use technical sophistication as one clue when estimating who may be behind an operation. Highly customized tooling, rapid iteration, and broad infrastructure have historically suggested a well-resourced group.
Anthropic warns that AI may weaken that assumption. General-purpose models and publicly available agent frameworks can help less experienced operators perform work that once required several specialists. That does not make every attacker equally capable, and expert judgment still matters. It does mean defenders should be cautious about treating polished execution as proof of a large or state-backed team.
AI-assisted cyber operations can adapt faster
One of the report’s central examples describes an actor Anthropic labels GTG-20006. According to the company, the actor used AI-assisted workflows to manage and revise cyber tooling, support phishing operations, acquire infrastructure, and monitor whether security products detected deployed malware.
The defensive implication is significant. Static signatures remain useful, but they may lose effectiveness more quickly when attackers can automate parts of the test-modify-redeploy cycle. Organizations therefore need layers of defense that focus on behavior, identity, network activity, endpoint telemetry, and recovery—not only known file signatures.
Surveillance and influence risks are part of the same trend
The report also discusses AI-supported surveillance systems designed to identify or monitor people and operations intended to shape public opinion. These examples broaden the conversation beyond conventional cybersecurity.
AI can process large volumes of text, connect information from multiple sources, translate material, generate tailored content, and help prioritize targets. Those abilities are useful in legitimate analysis, but they can also reduce the cost of abusive monitoring or coordinated manipulation.
Anthropic’s published policy information says domestic surveillance, disinformation campaigns, malicious cyber operations, censorship, and weapons-related misuse remain prohibited. It also notes that selected government agreements may permit some foreign-intelligence analysis under tailored safeguards and applicable law. That distinction is important when evaluating claims about government use: permitted analysis and prohibited abuse are not the same thing.
What security teams should do now
1. Monitor workflows, not just individual prompts
Risk controls should examine how a model is connected to tools, credentials, data, and automation. A harmless-looking request can become more consequential when it is one step in a larger agentic workflow.
2. Apply least privilege to AI agents
Give automated systems only the permissions required for a specific task. Separate read and write access, restrict outbound destinations, rotate credentials, and require approval for high-impact actions.
3. Strengthen behavioral detection
Defenders should look for unusual sequences of actions, rapid infrastructure changes, abnormal credential use, suspicious automation, and repeated attempts to evade controls. These signals can remain valuable even when tools or payloads change.
4. Keep humans accountable
Human review should be meaningful rather than ceremonial. Teams need clear ownership, escalation paths, audit logs, and the ability to stop or roll back an automated process.
5. Share threat intelligence responsibly
AI providers see abuse patterns across many customers, while enterprises see detailed activity inside their own environments. Timely, privacy-conscious collaboration can help both sides identify recurring tactics sooner.
Important limitations when reading the report
The findings come from Anthropic’s visibility into activity involving its own services. They do not measure all malicious AI use across the internet, and they should not be interpreted as a complete ranking of global threats. The company also explicitly describes these as notable cases rather than normal usage.
Some claims in threat intelligence depend on attribution judgments and incomplete evidence. Readers should distinguish between activity directly observed by a provider, the provider’s assessment of who was responsible, and broader predictions about future risk.
What this means for the future of AI security
The most useful way to read Anthropic’s September 2026 report is not as evidence that AI has suddenly replaced expert attackers. It is evidence that AI is increasingly being integrated into operational systems that can amplify human intent.
For defenders, the answer is not panic. It is better engineering: narrower permissions, stronger identity controls, richer telemetry, behavior-based detection, safer agent design, and faster information sharing. The organizations that treat AI security as a workflow and governance problem—not only a model problem—will be better prepared for the next generation of threats.
Frequently asked questions
Did Anthropic say these cases represent typical Claude usage?
No. Anthropic describes them as notable and novel examples of misuse identified by its threat intelligence team.
Were the reported attacks fully autonomous?
Not generally. The report says humans remained involved in important decisions such as target selection and reviewing exfiltrated information, while AI handled or coordinated more operational steps.
What is the key defensive takeaway?
Organizations should combine least-privilege access, human oversight, behavioral detection, auditability, and layered security. Static signatures alone may be easier for rapidly adapting workflows to evade.