# anthropic-threat-intelligence-misuse-report-2026-09-10

## Veille

Threat intelligence report published by Anthropic's **Threat Intelligence** team on **September 10, 2026** on anthropic.com (~36,000 words including indicators of compromise, downloadable PDF, unsigned). It covers abuse disrupted between **December 2025 and August 2026** across **seven** domains: cyber, influence, surveillance, conventional weapons, biology, fraud, distillation. All cases involve Haiku, Sonnet, or Opus; none involve Fable or Mythos, except for one distillation attempt.

## Titre Article

Detecting and countering misuse of AI: September 2026

## Date

2026-09-10

## URL

https://www.anthropic.com/threat-intelligence-report-september-2026

## Keywords

threat intelligence, AI misuse, Generative Threat Group, uplift, cyber kill chain, autonomous agents, vibe hacking, PentAGI, stolen API keys, AI supply chain, ShinyHunters, Midnight Blizzard, exploit foundry, zero-day, influence operations, influence-as-a-service, Breakout Scale, state surveillance, transnational repression, mass interception, conventional weapons, autonomous drones, biological dual use, gain-of-function, illicit distillation, chain of reasoning, thinking signature, cross-session replay, resale proxies, Alibaba, Moonshot AI, DeepSeek, Z.ai, Xiaomi, guardrails, classifiers, trusted-access programs

## Authors

Anthropic — équipe Threat Intelligence (rattachée aux Safeguards), rapport institutionnel non signé publié sur anthropic.com.

## Ton

Profile: threat intelligence report written in the institutional first-person plural, in a CTI analyst register (GTG-xxxxx designators, confidence levels *low / medium / high*, defanged indicators of compromise, dated IP address tables). Audience: security teams, other model providers, governments, and civil society. Three traits. First, **attribution discipline**: each case carries its confidence level and separates what is observed on the platform from what is corroborated by open sources or partners (All Eyes on Wagner, Forbidden Stories, Microsoft, OpenAI); visibility explicitly stops once an operation leaves Claude. Second, a **measured admission of limits**: a refusal is *"overcome on further prompting"*, fragmenting work into small sessions degrades the classifiers, the Malian platform deployed offline escapes any action on accounts, and the biology section acknowledges that its evaluations provide only ambiguous evidence. Finally, **normative scope**: the report names companies (Alibaba, Moonshot AI, DeepSeek, Z.ai, Xiaomi, SenseTime, MiniMax, LKM Company, BBS Bilisim, S2T) and states, and closes each section with a recommendation to the industry — treat AI keys as production credentials, reserve frontier biological capabilities for verified-access programs. The vocabulary remains that of threat analysis (*uplift*, *kill chain*, *tradecraft*); the promotional content is limited to noting that Fable and Mythos appear in no cyber case.

## Pense-betes

- **Scope**: December 2025 → August 2026, seven domains, roughly thirty GTG groups. Models involved: Haiku, Sonnet, Opus. No cases on Fable or Mythos, except one cyber distillation attempt against Fable, abandoned after degradation by the guardrails; Z.ai employees then switched to Opus 4.6 and the flagship model of another US lab *"expressly because they assessed the safeguards were weaker"*.
- **Cyber, two trends.** (1) Sophistication no longer indicates who is attacking: a hacktivist with stolen keys, ShinyHunters affiliates, and a state-espionage operator follow the same method. (2) Autonomy is advancing: reconnaissance-exploitation-exfiltration loops running for hours or days, a fleet of **13** collection agents scheduled without a human (GTG-10007), agents that rebuild malware as soon as antivirus detects it (GTG-20006). Two caveats set by the report: humans still handle targeting, monetization, and review; autonomy and severity are two distinct axes, and several of the most serious compromises were directed step by step.
- **GTG-20006 (Midnight Blizzard)**: more than **20** organizations targeted, DNS hijacking at three hotel WiFi providers (the "CaptiveCrunch" method described by Microsoft in July 2026), **300,000** national identities and the registry of **500,000** companies exfiltrated from a North African authority. The human mainly intervenes to modify the Claude Code skills that drive the workflows.
- **GTG-50014 (ShinyHunters)**: a pipeline across ten EC2 instances decompiling **1.8M** APKs with TruffleHog; more than a terabyte exfiltrated from a technology vendor; **2,100** Azure AD token sets across **40** tenants dumped in **34 hours**, *"AI agents performed nearly all of the work"*; a complete breach in a few hours. The report calls this *vibe hacking*: the operator sets a general goal and lets the agent assess, script, execute, and repeat.
- **GTG-10007**: students at a Hunan university, an *exploit foundry* — an autonomous firmware reverse-engineering loop produces more than a dozen possible zero-days in a month on network appliances; swarms of agents with campaign memory persistent across sessions.
- **AI supply chain**: a stolen key provides *loot, compute, cover*. GTG-50020 attacks about thirty AI companies in four days, with the stated goal of accessing a pre-release Claude model (failing on every path); GTG-50021 sells fake discounted Claude access that installs a credential stealer. Prompt injections against LiteLLM and OpenClaw deployments to exfiltrate production keys. Recommendation: treat AI keys and agent integrations as production credentials.
- **Influence**: nine operations, categories 1 to 4 on the Breakout Scale; most fail to reach a real audience, with genuine reach coming from state media (FM radio in the Central African Republic, Sputnik, RT). Doctrine lives in memory files or `SKILL.md` files reused across hundreds of sessions. Claude refused certain requests (naming activists, producing a defamation dossier); the actor rephrases and continues.
- **Surveillance**: in Mali, **Lakana 360** monitors ~**25M** SIM cards across three operators, the warrant requirement removed at the operator's request, deployed on-site with a local LLM — banning the account does not affect the product. In China, a religious-intelligence unit went from several teams to a single bureau producing thousands of investigations per month; one bureau writes an internal AI usage manual. In Iran, sixteen accounts, a malicious Firefox extension, and two units feeding the same "Arman" system.
- **Conventional weapons**: six cases. In Yemen, a real test launch followed by a return to Claude within hours to analyze the failure; in Russia, an FPV swarm with a *"person"* target class and detonation without a human (TRL 3-4); in China, an electronic-warfare suite whose default scenario switches to twelve targets in Taiwan. New explosives and weapons classifiers announced.
- **Biology**: five cases, all dual-use, with active researchers, institutions, and agents deliberately withheld. Classifiers confine gain-of-function to the weakest models (Sonnet 4, Haiku 4.5), but Opus 5 drafts a complete orthopoxvirus grant application in one hour without being blocked. Report's conclusion: a classifier alone cannot *"enable benefit and prevent harm"*, hence the trusted-access programs described in [[anthropic-claude-fable-5-1-mythos-5-1-2026-09-01]]. A 30-day sweep found: ~35 research efforts linked to adversarial state institutions.
- **Fraud**: GTG-15001, more than 20 dating apps, **4,700** AI personas, **25,000** victims, **2.36M** messages in two weeks, three personas per human worker. The system prompt resembles an ordinary companion deployment: the fraud is invisible from within the exchange.
- **Distillation**: Alibaba **151M** exchanges (May–July, 3,500 accounts, distilling Qwen 3.5 to 3.7), Moonshot AI **23M** (5,380 accounts), DeepSeek **12.1M** in 14 days, Z.ai **3.4M** in 17 days, Xiaomi **400k**. DeepSeek identifies Claude Code, Claude Agent SDK, or OpenCode users and relays their requests to Opus. Moonshot and DeepSeek convert the *thinking signature* into a full trace via cross-session replay; sensitive third-party data (PLA, Russia's Ministry of Defense, companies) thus passes through Claude. Countermeasures: reasoning summarization, Fable 5.1's *preserved thinking*, identity verification — the anti-distillation measures announced in the Fable 5.1 fiche find their case file here. Compare with [[sfeir-kimi-k3-moonshot-frontier-open-weights-2026-07-16]].
- ⚠️ **Citation hygiene**: the page shows no date; publication is inferred from CMS metadata (created on the 9th, updated on September 10); audience figures for the influence and fraud operations are self-reported by the actors; the *uplift* is a qualitative estimate; the report does not say GLM-5.3 was trained on the extracted traces, only that a campaign targeting cyber capabilities preceded its release.

## RésuméDe400mots

On **September 10, 2026**, Anthropic published its fourth threat intelligence report. It covers operations disrupted between December 2025 and August 2026 across seven domains: cyber, influence, surveillance, conventional weapons, biology, fraud, and distillation. All cases involve Haiku, Sonnet, or Opus models; none involve Fable or Mythos, except for one distillation attempt.

In **cyber**, the report finds that the autonomous operating model described in November 2025 has spread to all classes of actors, down to public frameworks like PentAGI. The sophistication of an attack no longer indicates who is behind it: a lone Francophone hacktivist, ShinyHunters affiliates, and an operator linked to Midnight Blizzard run multi-victim campaigns that would have required entire teams a year earlier. Agents rebuild malware once it is detected, produce zero-days in a loop, dump 2,100 Azure AD token sets in 34 hours. Stolen AI API keys become loot, compute, and cover. Two caveats: humans still handle targeting, and autonomy multiplies scale without determining severity.

In **influence**, nine operations (Russia, Iran, Turkey, the Gulf, Kenya, Bangladesh, Malaysia) show the model integrated as a copy editor within existing pipelines, with doctrine stored in memory files reused across hundreds of sessions. Most fail to reach a real audience; reach comes from state media. In **surveillance**, the model replaces a team of engineers or analysts: a 25-million-SIM interception platform in Mali, deployed offline and therefore beyond the reach of a ban; Chinese public security bureaus and Iranian units producing briefings and tools.

Six **conventional weapons** cases range from a test strike in Yemen to a Russian drone swarm capable of selecting a human target without an operator. Five **biology** cases, all dual-use, lead Anthropic to conclude that a classifier cannot both enable benefit and prevent harm, hence the trusted-access programs. A network of dating apps had 4,700 personas converse with 25,000 people.

On **distillation**, the report names seven Chinese labs. Alibaba reaches 151 million exchanges in three months to train Qwen; Moonshot AI and DeepSeek serve Claude's responses to their customers without disclosing it and convert the *thinking signature* into a full trace via cross-session replay; Z.ai targets cyber capabilities ahead of GLM-5.3's release and drops Fable for models judged less protected. Countermeasures cited: reasoning summarization, Fable 5.1's *preserved thinking*, identity verification.

## GrapheDeConnaissance

- Anthropic —publie→ Threat Intelligence Report septembre 2026 (DOCUMENT, 0.99)
- Threat Intelligence Report septembre 2026 —affine→ rapport Disrupting AI espionage novembre 2025 (DOCUMENT, 0.92)
- Anthropic —utilise→ Generative Threat Group (CONCEPT, 0.95)
- Anthropic —affirme_que→ aucun cas de mésusage n'implique Fable ou Mythos, hors une tentative de distillation (AFFIRMATION, 0.96)
- Anthropic —affirme_que→ la sophistication d'une attaque n'est plus un signal fiable de l'identité de son auteur (AFFIRMATION, 0.95)
- Anthropic —affirme_que→ le modèle opératoire autonome documenté en novembre 2025 s'est diffusé à toutes les classes d'acteurs (AFFIRMATION, 0.94)
- Anthropic —affirme_que→ l'autonomie multiplie l'échelle et la vitesse d'une opération mais ne détermine pas sa gravité (AFFIRMATION, 0.93)
- PentAGI —permet→ automatisation de la kill chain cyber (CONCEPT, 0.9)
- Midnight Blizzard —utilise→ Claude Code (TECHNOLOGIE, 0.9)
- ShinyHunters —utilise→ vibe hacking (CONCEPT, 0.9)
- Threat Intelligence Report septembre 2026 —mesure→ 2 100 jeux de jetons Azure AD sur 40 tenants dumpés en 34 heures, presque entièrement par des agents (MESURE, 0.92)
- Anthropic —recommande→ traiter les clés d'API IA et les intégrations d'agents comme des identifiants de production (AFFIRMATION, 0.95)
- Anthropic —utilise→ Breakout Scale (METHODOLOGIE, 0.95)
- Threat Intelligence Report septembre 2026 —affirme_que→ la plupart des opérations d'influence n'atteignent pas d'audience authentique, sauf via des médias d'État (AFFIRMATION, 0.92)
- Threat Intelligence Report septembre 2026 —mesure→ Lakana 360 couvre environ 25 millions de cartes SIM sur les trois opérateurs mobiles du Mali (MESURE, 0.92)
- Anthropic —affirme_que→ les garde-fous n'ont pas fonctionné uniformément dans les cas de surveillance chinois (AFFIRMATION, 0.93)
- Anthropic —affirme_que→ un classifieur ne peut pas seul permettre le bénéfice et prévenir le mal en biologie à double usage (AFFIRMATION, 0.94)
- Anthropic —recommande→ programmes d'accès de confiance (CONCEPT, 0.94)
- Threat Intelligence Report septembre 2026 —mesure→ 4 700 personas IA en conversation avec au moins 25 000 personnes, 2,36 millions de messages en deux semaines (MESURE, 0.93)
- Alibaba —utilise→ distillation illicite (CONCEPT, 0.96)
- Threat Intelligence Report septembre 2026 —mesure→ 151 millions d'échanges attribués à Alibaba entre mai et juillet 2026, pic à environ 3 millions par jour (MESURE, 0.95)
- Qwen —est_basé_sur→ Claude Opus (TECHNOLOGIE, 0.88)
- Moonshot AI —utilise→ attaque par rejeu inter-sessions (CONCEPT, 0.93)
- DeepSeek —utilise→ attaque par rejeu inter-sessions (CONCEPT, 0.93)
- attaque par rejeu inter-sessions —s_oppose_à→ thinking signature (TECHNOLOGIE, 0.92)
- Threat Intelligence Report septembre 2026 —affirme_que→ Moonshot AI et DeepSeek ont servi des réponses de Claude à leurs clients sans les en informer (AFFIRMATION, 0.93)
- Z.ai —utilise→ distillation illicite (CONCEPT, 0.95)
- Threat Intelligence Report septembre 2026 —affirme_que→ Z.ai a ciblé les capacités cyber de modèles américains avant la sortie de GLM-5.3 et abandonné Fable pour des modèles jugés moins protégés (AFFIRMATION, 0.92)
- Xiaomi —utilise→ distillation illicite (CONCEPT, 0.93)
- Claude Fable 5.1 —utilise→ preserved thinking (TECHNOLOGIE, 0.95)
- preserved thinking —réduit→ distillation illicite (CONCEPT, 0.9)
- Anthropic —affirme_que→ un modèle distillé d'un modèle frontière peut acquérir des capacités dangereuses même si les échanges récoltés n'en traitent pas (AFFIRMATION, 0.9)

---
Canonical: https://www.thekb.eu/en/fiches/anthropic-threat-intelligence-misuse-report-2026-09-10/