Anthropic published its latest threat intelligence report this past Thursday (09/10), documenting how malicious groups used Claude to carry out attacks between December 2025 and August 2026. The report covers seven categories of misuse — cyber operations, influence campaigns, surveillance, fraud, biological misuse, conventional weapons development, and model distillation — and reinforces a trend already flagged in the company's earlier reports: AI is moving from a one-off task assistant to the orchestrator of entire attacks.

From assistant to orchestrator

According to Anthropic, cybercriminals and state-linked actors have started using Claude not just to write snippets of malicious code, but to plan, execute, and adapt entire campaigns, with the human operator acting more as a supervisor than a direct executor. That includes attack chains where the model decides the next steps, triggers other tools, and reacts to technical obstacles without constant intervention — the same kind of agentic autonomy that is today marketed as a productivity gain for engineering teams.

Espionage and malware that rewrites itself

One of the most detailed cases involves a suspected Russian state-linked actor, identified as GTG-20006, that used AI-automated workflows to cover nearly the entire cycle of an espionage operation: infrastructure setup, phishing, maintaining access to compromised systems, and data exfiltration. According to Anthropic, the group even built a system that automatically detected when its malware was flagged by security tools and rewrote the code until it evaded detection again — an evasion loop running with virtually no human intervention.

The race for capability: mass distillation

The report also describes attempts to extract Claude's capabilities to train other models, a practice known as distillation. Anthropic says it identified and disrupted activity from seven China-based labs — including Alibaba, Moonshot, DeepSeek, and Xiaomi — on this front. The largest-scale case reportedly involved operators linked to Alibaba, with more than 151 million message exchanges recorded between May and July 2026 in an attempt to improve the Qwen model family using Claude's responses.

Other documented misuse

The company also reports identifying actors using Claude to develop software for conventional weapons — from electronic warfare and air-defense suppression systems to tools tied to firearms, missiles, and drones — with incidents reported in China, Russia, and Yemen.

What this means in practice

For people building products on top of language models and autonomous agents, this report is less an abstract warning and more an operational reminder: agentic pipelines that automate infrastructure, network, or security tasks need usage limits, monitoring for anomalous API consumption patterns, and human review at critical decision points — the same defenses that guard against abuse also reduce the risk of misuse. The periodic publication of these reports is itself a market signal: model vendors are increasingly expected to show not just what their systems do well, but what they are doing to contain misuse — a criterion that is likely to weigh more and more in how engineering teams choose vendors.