On September 11, 2026, Anthropic released the Threat Intelligence Report "Detecting and countering misuse of AI: September 2026," revealing the high-risk activities it identified and blocked between December 2025 and August 2026. The report covers seven types of risks: cyberattacks, surveillance, influencing operations, fraud, biological misuse, conventional weapons development, and model distillation. The most noteworthy change for security teams is not that malicious users have gained another chat tool, but that AI has begun to take over the continuous processes of reconnaissance, tool modification, execution, and result processing.
Attackers no longer just ask models to answer technical questions
Anthropic stated that in most cases, Claude was involved in direct execution or orchestration, while some operators used multi-agent frameworks to perform parallel reconnaissance, exploitation, and data organization, with humans primarily responsible for identifying targets and reviewing results. The Russian-language espionage activities cited in the report allow agents to monitor whether malicious programs are identified by security products, and once exposed, continue modifying and rebuilding them until they evade existing detection. The related activities are planned to involve more than 20 organizations, targeting governments, diplomatic, and defense agencies.
This kind of closed loop changes the rhythm of offense and defense. In the past, defenders issued a check-in rule, which usually temporarily raised attack costs; now agents can continuously observe failures and redo tools. It does not eliminate human operators, but turns repeated trial and error, environmental understanding, and cross-target adaptation into parallel machine tasks, so attack scale and speed may rise in sync without significant personnel growth.
AI credentials themselves have also become supply chain targets
The report also lists API Keys, session tokens, and review sandboxes as new attack surfaces. In one case, the attacker injected malicious instructions into an AI vendor's automated review sandbox, obtained the production API key held by that environment, and then attempted to attack around 30 AI companies within about four days. Anthropic emphasized that the attackers did not breach Anthropic's own systems nor obtained pre-release Claude models. This distinction is important: the risk comes from customer integration, proxy tools, and sandbox permission chains, not necessarily from the foundational model service being directly compromised.
The company's line of defense should shift from content filtering to the execution chain
Only checking prompts or final replies can no longer see what agents are doing in between. Enterprises should move control points forward to at least three positions: tool calls use minimal privileges and manually confirm high-risk actions; Review and browsing environments prohibit access to production credentials, and network exits are restricted by task whitelists; API Keys are isolated by workload to monitor abnormal throughput, cross-region calls, and prolonged unattended behavior. Static malicious sample detection remains valuable, but must be combined with behavior detection, credential rotation, and audit logs.
The report also has boundaries that need to be preserved
These cases were compiled by Anthropic based on its own platform observations and represent the most significant and novel threats it considers the most significant, do not represent Claude's typical usage, nor can it directly infer the industry's overall occurrence. Vendor disclosure can help other platforms identify patterns, but key conclusions still require cross-validation by law enforcement agencies, security researchers, and affected organizations. For enterprises, reasonable judgment is not about stopping proxy use, but treating proxies as software entities with execution capabilities: first restrict what they can access and invoke, then assess whether the model itself is secure.
