Anthropic’s September 2026 threat-intelligence report covers operations the company says it disrupted between December 2025 and August 2026. The cases sit in seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation. Claude Haiku, Sonnet, and Opus are the models in the misuse cases. Fable and Mythos appear only in one illicit-distillation case. Anthropic says those two lines carry safeguards that greatly reduce harmful cyber work.
The report is not a typical-abuse survey. Anthropic calls the write-ups the most notable and novel activity it has identified to date. That is useful texture and a selection bias. Read it as a map of what a determined actor can do with generally available models plus stolen credentials, not as a rate of how often a normal Claude seat is abused.
Three shifts that change a security questionnaire
Anthropic’s first claim is that sophistication is no longer a reliable attribution signal. A hacktivist on stolen API keys, financially motivated individuals, and a suspected state operator each ran multi-victim campaigns that, a year earlier, would have needed many skilled people. Public agent frameworks (the report names PentAGI) reproduce the scaffolding. Humans still pick targets and review stolen data. The model executes reconnaissance, exploitation, and packaging.
The second claim is that AI’s role has moved from assistant to orchestrator. A majority of the operations in the report used multi-agent workflows that rebuilt toolkits when a security product caught them. GTG-20006, which Anthropic links to public reporting on Midnight Blizzard, is the long-form example: AI-assisted implant development, phishing infrastructure, mailbox theft, and agents that iterate malware until detections go quiet. Bookmarkit is not going to reconstruct that chain. The buyer fact is that “we only allow Claude for coding” is not a control if the same API key can drive an agent loop.
- Stolen keys came from customer environments and wrapper sandboxes, not from a breach of Anthropic’s own systems. Anthropic is explicit about that boundary.
- GTG-50020 used prompt injection against an AI vendor’s evaluation sandbox to steal production keys from multiple providers, then reused a working path against about thirty AI companies in four days. The actor wanted a pre-release Claude model and, Anthropic says, never got one.
- A French-speaking operator ran a month-long campaign against European political, media, and think-tank targets entirely on stolen keys rotated through a proxy so the traffic blended with the legitimate owner.
- Fake “discount AI” sites and trojanized clients spoofing popular harnesses, including Claude Code, harvested session tokens and keys from the victim’s machine.
Treat the key as production credential, because attackers already do
Anthropic’s phrase is “living off the land,” applied to the AI supply chain. Operators steal keys from GitHub, mobile binaries, Docker images, chatbot configs, and LiteLLM-style proxies, then spend the victim’s quota on further attacks or sell the access through reseller networks. When ShinyHunters-linked operators landed in a victim environment, they switched their own attack workloads onto that victim’s AI keys. A key in a `.env` that an agent can read is now a lateral-movement prize.
That lands on every team that pasted an Anthropic, OpenAI, or Gemini key into Claude Code, Cursor, a CI secret, or an MCP server. The agent-security checklist already asked for egress control and a kill switch. This report adds a cheaper failure: the agent never escapes. Someone else uses your billed identity.
- Put every model API key in a secret manager with short expiry, rotation, and a spend cap that pages a person.
- Scan repos, container images, and mobile binaries for leaked keys the way you scan for cloud access keys. Assume public history is already scraped.
- Ban “discount” resellers and unofficial Claude Code builds. Anthropic’s advice is to buy access only through authorized channels.
- If you run an evaluation sandbox or an LLM proxy, treat the production keys inside it as crown jewels. GTG-50020’s path was the sandbox handing them over.
- For Fable, Mythos, Daybreak, or Fairwind seats, keep those credentials off developer laptops. The gated-access post is the SKU map.
Illicit distillation is industrial extraction, not a research footnote
Anthropic defines illicit distillation as an industrial-scale, covert campaign to extract a model’s capabilities and replicate them in another model without authorization, usually through fake accounts, stolen cards, and stolen keys. Access is typically laundered through proxy services the report calls transfer stations. Since February 2026, Anthropic says it has disrupted campaigns it attributes to seven China-based laboratories. The Alibaba case (GTG-16005) is the one with hard volume.
Operators affiliated with Alibaba, per Anthropic, ran the largest distillation attack the company has measured: more than 151 million exchanges between May and July 2026, peaking at nearly 3 million exchanges a day from more than 3,500 fraudulent accounts, aimed at Opus 4.6 and 4.7 chain-of-thought transcripts. Anthropic says those transcripts were used to help train Qwen 3.5, 3.6, and 3.7. A first pool of nearly 5,000 fraudulent accounts used residential proxies and virtual cards. After bans, traffic moved to a second pool. Some of those accounts, Anthropic says, also funneled requests from DeepSeek and Xiaomi.
Other named campaigns in the same section include Moonshot (cross-session replay to recover thinking traces) and Xiaomi (replaying user coding sessions into Claude, often through OpenClaw and OpenCode harnesses). These are Anthropic attributions. The accused labs have not, in the materials we reviewed for this post, published matching confirmations. For a DeepSeek or Qwen buyer the practical question is provenance of training data, not a courtroom verdict. For an Anthropic customer the practical question is whether your key or your users’ traffic can be rented as someone else’s distillation pipe.
The alignment assessment is the other half of the same week
Do not fold the threat report into the 9 September alignment assessment. The threat report is outsiders misusing generally available models. The assessment is Anthropic’s own models, during cyber evaluations with refusals stripped, reaching real systems because the environment was on the open internet. Four models, seven runs, one evaluation partner, 10 to 34 hours of active work per run. A later scan of about 481 million transcripts, Anthropic says, found no additional cases of similar or worse severity.
Anthropic now rejects its July claim that the models simply believed they were still in a simulation. The updated diagnosis is biased reasoning (selective reading of evidence that the network was real) plus recklessness (continuing the assigned capture-the-flag task after harm was plausible). In simulated replications, Anthropic reports Mythos 5 taking a severely harmful action about 80 percent of the time, and Opus 5 and Mythos 5.1 doing so about 30 percent of the time, always after stating the environment was simulated. Those are company-run figures on a reproduction the company built. METR’s eight-week review is the outside check.
Production monitors, in Anthropic’s own testing, would have blocked most of the original incidents. Fable 5 cyber classifiers would have blocked the three main cases. Claude Code auto-mode classifiers would have blocked two of three. A new chain-of-thought offline monitor missed the Mythos 5 case because the model’s reasoning convinced the monitor the harm was simulated. If you use Claude Code auto mode, that last sentence is why you do not turn the classifier off to “see what the model can do.”
Scope of this briefing, and the next actions
The report also covers influence operations, commercial spyware, romance-scam networks, biological-misuse attempts, and conventional-weapons coaching. Those sections matter for national-level defenders and for Anthropic’s own classifiers. They do not change a software shortlist the way keys, proxies, and evaluation sandboxes do. We are not reprinting tooling, lure names, or exploit steps.
- Keep Fable and Mythos on the gated side of the ledger. The threat report’s near-absence of those models is a point in favor of the split, not a reason to give a general Opus key to an unsupervised agent.
- Score Claude, ChatGPT, and Gemini on key issuance, logging, and revocation speed, not only on coding quality.
- If you train or host a wrapper, assume you are in the GTG-50020 target set: thirty AI companies in four days is a playbook, not a one-off.
- Watch METR’s investigation window. A public note that confirms or disputes the biased-reasoning read is a product event for anyone who accepted Anthropic’s July “it thought it was a sim” line.