Anthropic published a threat intelligence report covering December 2025 through August 2026 that documents eight months of Claude misuse across seven categories: cyber operations, influence operations, surveillance, fraud, biological misuse, conventional weapons and unauthorized model distillation. The most affected models were Haiku, Sonnet and Opus, while the newer Fable and Mythos appeared in only one distillation case. The report matters because it is one of the first public accounts of a frontier model being used for weapons software and nationwide surveillance, not just for phishing and fraud.
What the report found
The cyber chapter describes a Russian-speaking espionage actor tracked as GTG-20006 that ran a feedback loop: AI agents checked whether its malware was being flagged by common security products, and when an antivirus tool caught it, the agents rewrote and recompiled the code on their own until it slipped past detection again. More than 20 organizations were targeted, including government ministries, intelligence services, embassies and defense contractors, with a focus on Ukraine and Europe. The actor stole a complete proprietary SDK for a drone vision system, and some access ran through third parties, such as compromised hotel guest Wi-Fi providers whose devices were loaded with malware, a method Microsoft described in July 2026 as CaptiveCrunch.
Anthropic also attributes clusters to the ShinyHunters collective (GTG-50014), which focused on industrial credential mining. One hacker downloaded 1.8 million Android apps, decompiled them and searched for hardcoded secrets. Anthropic calls the approach «vibe hacking»: a human sets a rough goal, and the model assesses the environment and iterates until the task is done. One of the hackers said he collected HackerOne bounties on top of extorting two companies. The core finding is that sophisticated attacks no longer require sophisticated attackers, and sophistication is no longer a reliable signal for attribution.
On distillation, Anthropic identified attacks from seven more Chinese labs since its first disclosure in February. The largest campaign ever measured is attributed to Alibaba's Qwen lab (GTG-16005): a fixed prompt got Claude to write out its reasoning traces before answering, and the transcripts were processed into fine-tuning data for the Qwen 3.5, 3.6 and 3.7 models. The peak hit almost three million exchanges a day from more than 3,500 fraudulent accounts, totaling over 151 million exchanges between May and July 2026, mostly on agentic tasks and software development. Moonshot AI (GTG-16002) relayed nearly 300,000 customer requests to Anthropic over ten days across 5,380 fraudulent accounts, while users believed they were using a Kimi model. DeepSeek (GTG-16001) used strings to detect when requests came from harnesses like Claude Code, flagged those users and routed selected ones to Claude Opus, more than 12.1 million exchanges in 14 days.
What this means for business
For companies that build on frontier models, the report changes the risk calculation in two ways. First, attackers now hand reconnaissance, exploitation and tool-building to models that run in parallel at machine speed, which lowers the cost side of an attacker's math and makes previously unprofitable targets worth pursuing. Second, the same models are being mined for training data by competitors, which means a company's own API traffic can become someone else's training set if access controls are weak. A small team that relies on a single provider has less room to absorb either problem than a large enterprise with its own security staff and contractual protections.
The surveillance and weapons cases show where the limits of provider-side controls lie. In Mali, a single consultant used Claude as the primary engineering workforce for «Lakana 360», a platform to monitor roughly 25 million SIM cards across all three national mobile carriers; suspending the account interrupted only development work, not the operation, because the platform runs on local models on-premises. In northern Yemen (GTG-87001), a cell used Claude Code for the guidance, navigation and control software of three missile programs, including a multistage missile with a target range over 2,000 kilometers, running several instances in parallel so that no single session revealed the intent. A test launch apparently failed, and within hours the actors returned to Claude to find the cause.
Anthropic's biology chapter is the most self-critical: it documents five anonymized cases involving working scientists where Claude assisted with potentially dangerous dual-use projects. In one case, the biosecurity classifier blocked a grant application for gain-of-function work on the chikungunya virus planned at a military research institute, but the platform operator had built a fallback that routed rejected requests to a competitor's model, and Claude itself wrote most of the code for it. The report concludes that classifiers cannot both enable useful work and prevent harm, because a user's intent in dual-use areas cannot be reliably detected. For buyers, that means asking a provider not only what its filters block, but what happens when a request is refused and whether the refusal is logged and reviewable.
The marker to watch is whether Anthropic's next report shows the same actors returning with new accounts or new transfer stations, and whether the number of Chinese labs named keeps growing beyond the seven added this time. If the pattern holds, model access will be priced and governed less like a software subscription and more like an export-controlled input, with identity checks, usage logging and contractual limits becoming standard terms for business customers.
