Anthropic published the most detailed report of his Threat Intelligence team for all time.
The document covers attempts to use Claude for harm from December 2025 to August 2026 and is divided into seven areas – cyber operations, information campaigns, surveillance, fraud, biology, conventional weapons development and distillation. Each of the described operations was interrupted, and the conclusions were sent to protective mechanisms and to the relevant departments.
All episodes featured Haiku, Sonnet and Opus models. Neither case affected Fable or Mythos, with the exception of one distillation attempt.
Military
The report’s most telling story concerns weapons. Under the designation GTG-27005, presumably Russian freelancers are described who assembled an autonomous swarm of FPV kamikaze drones using Claude Code.
The on-board model could independently select targets, including a separate “person” class, and issue a detonation command without operator participation.
The second episode from the same category is related to China. Someone known as GTG-17002 built a complex of approximately 16 modules for electronic warfare and air defense suppression, and in the middle of the work changed the default simulation scenario to 12 targets in Taiwan. The list included a command bunker, an early warning radar site, and Patriot and Tien Kung batteries, and the contractor himself was linked to Chinese research structures, including the PLA Academy of Military Sciences.
The third case came from Yemen. A cell in the north of the country used Claude Code instead of a staff of engineers to develop guidance, navigation and control software for a guided missile and a multi-stage ballistic missile with a stated target range of more than 2,000 km.
The set of options also included a hypersonic glide unit, and field tests of the guided missile, judging by Anthropic data, ended in failure.
Biology
Five cases were analyzed in the biological block. In May 2026, the biosafety classifier blocked a request for a grant proposal to research chikungunya (a viral infection) with a gain of function for a military institute, with traffic going through a bypass platform that later learned to redirect rejected requests to a competitor’s model.
Another user spent weeks planning experiments on adapting bird flu to mammals, but the filters kept the correspondence on the weakest models in the line.
Cyber direction
The key episode of GTG-20006 is attributed according to public information about the group Midnight Blizzard, and one of the operators worked under the nickname “JackPoterz”. More than 20 organizations came under attack, mainly Ukrainian government, military and diplomatic structures.
The access mechanics turned out to be ingenious. The attackers compromised at least three hotel Wi-Fi providers and changed DNS records, after which hotel guests were given malware for Windows, Android and iOS. At the same time, a hunt was carried out on WhatsApp – the victims’ accounts were connected as companion devices through headless browsers with read marks disabled in order to quietly upload correspondence
The group showed particular interest in the drone supply chain. The mailboxes of at least two component manufacturers were emptied and the complete proprietary drone vision system SDK was stolen, which was then dismantled for several days to restore the architecture, parts list, and data on the unannounced product.
The main technical innovation here is different. The group’s AI agents monitored whether antiviruses had begun to detect their intrusion, and when triggered, they automatically rewrote and reassembled the code until the detection disappeared. Anthropic describes this as a reversal of costs towards defenders, who are now unable to roll out signatures faster than the enemy can bypass them.
Finance
Financially motivated groups worked more crudely but on a larger scale. Operators associated with the ShinyHunters collective downloaded 1.8 million Android applications en masse and scanned them for secrets embedded in the code, and one of the compromises of a tech provider resulted in the leak of more than a terabyte of data, including millions of payment card records.
Another participant uploaded over 2,100 Azure AD token sets in 34 hours, spanning over 40 enterprise tenants, with AI agents doing almost all the work.
The case of a lone hacktivist is particularly illustrative. French-speaking user GTG-50029 found an undocumented state race while reinstalling WordPress, gained internal access to 14 of the 42 monitored targets, and downloaded approximately 140,000 user political views. He single-handedly assembled the fafsearch doxxing platform with his own search engine, uploaded tens of millions of lines into it and posted the result in the form of anonymous services on the darknet.
AI services
A significant part of the report is devoted to how AI services themselves have become prey. Stolen API keys give the attacker three things at once – goods for resale, calculations at someone else’s expense, and cover, since the activity is attributed to the legal owner of the key.
The GTG-50020 group extracted combat keys through the injection of instructions into the evaluation sandbox of one of the AI vendors, and then attacked about thirty AI companies in four days, seeking access to the pre-release Claude model. None of the more than a dozen methods tried worked.
Information Operations
Information operations are represented by nine cases. Advertising agency LKM Company from France ran about 70 fake news sites with 70 linked X accounts and more than 250 commentary bots, publishing at least 8,913 articles in about 20 languages.
Istanbul-based BBS Bilisim Teknolojileri sold a platform to manipulate elections in Malaysia with thousands of fake accounts and voter profiling across all 222 parliamentary constituencies.
In the Central African Republic, a Russian-speaking operator produced daily content for Radio Lengo Songo, a radio station affiliated with the powerful Africa Corps wing, and produced fake CAR government documents.
AI-HR
There, Claude was used for personnel work – the model wrote employment contracts with mandatory loyalty to the president of the country and evaluated employee articles according to political criteria.
Surveillance
The section on surveillance adds a few more numbers. A consultant, allegedly working from Bamako, used Claude to build the Lakana 360 platform for Malian intelligence to monitor approximately 25 million SIM cards of three national operators, and the requirement for a court order was removed from the dossier generation module at the direct request of the customer.
Two affiliated Iranian entities with 16 accounts claimed to have profiled 6,388 people over the course of a year, ran 155,216 tweets through social media analysis, and distributed a malicious Firefox extension.
Fraud
The fraudulent block turned out to be the most common and therefore unpleasant. The Chinese studio, under the designation GTG-15001, operated a network of more than 20 dating apps, where 4,700 AI characters corresponded with at least 25,000 real people over two weeks in April 2026, exchanging approximately 2.36 million messages.
Live performers were mixed into the general feed in the proportion of approximately three AI profiles per person, and the characters were forbidden to admit that they were automated.
Data Distillation
The loudest part for the industry concerns distillation. Since February 2026, Anthropic has thwarted such attacks from seven Chinese laboratories. The largest campaign was attributed to Alibaba – the distillation of Opus 4.6 and 4.7 reasoning chains reached almost 3 million exchanges per day from more than 3,500 fraudulent accounts, and in total, from May to July 2026, more than 151 million exchanges were recorded, the transcripts of which were used to train Qwen 3.5, 3.6 and 3.7.
Even more interesting is how the other two laboratories worked. Moonshot AI silently redirected its own clients’ requests to Claude instead of Kimi’s models, running almost 300,000 requests in ten days through 5,380 fake accounts and using a cross-session replay attack on reflection signatures.
DeepSeek used the same technique and collected more than 12.1 million exchanges in 14 days in July 2026, with work credentials from a Russian government base and a Chinese police case management system popping up in the redirected traffic.
Other participants in the section:
-
Zhipu ran 770,609 exchanges in ten days through a chain of reasoning cleaner, targeting cyber capabilities ahead of the release of GLM 5.3
-
Xiaomi has sent over 400,000 requests from over 1,500 accounts
-
SenseTime purchased Claude’s transcripts from third party data providers
-
MiniMax built a proxy network through a shell company that offered only Anthropic and OpenAI models
The AI-created drug reduced the biological age of patients by 3.5 years in four weeks
Anthropic has reportedly discovered a new class of antibiotics against resistant bacteria
Anthropic lists metadata attribution of proxy networks, stronger extraction classifiers, internal reasoning summarization to make stolen transcripts less suitable for training, and Fable 5.1’s preserved thinking mechanism that prevents new API accounts from changing the system prompt, tools, and messages that precede the model’s reasoning.
At the same time, Anthropic’s own systems were not compromised in any of the episodes, and all involved API keys were stolen from clients’ environments.
