Anthropic’s September 2026 Report Documents Seven Categories of Malicious Claude Use Across Cyber, Surveillance, Influence, and Research

Top engineers at Anthropic and OpenAI say AI now writes 100% of their code.

If you're not using AI, you're spending 40 hours doing what they do in 4.

These 100+ Claude Code hacks fix that and help you ship 10x faster.

Sign up for The Code and get:

Claim your free playbook

Anthropic’s September 2026 threat intelligence report describes attempted misuse of Claude across seven harm areas. The categories are cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation.

The company says its team identified and disrupted the operations between December 2025 and August 2026. The disclosed cases used Claude Haiku, Sonnet, and Opus. Anthropic says none involved Fable or Mythos class models, except for one distillation case.

The report is a company disclosure, not a population study of artificial intelligence use. It presents selected cases described as notable or novel. Its findings therefore show detected behavior and enforcement decisions, not the frequency of misuse across all models or users.

The cyber section describes an operation called GTG 20006. Anthropic says the group used customized artificial intelligence workflows across development, infrastructure acquisition, phishing, persistence, command and control, and data removal.

The same account describes Windows implants, mobile exploitation tools, browser password theft, and phishing infrastructure. Anthropic says the operation targeted military intelligence, European governments, diplomatic organizations, and people connected with United States foreign policy.

Another case involved a North African government technology authority. Anthropic says stolen virtual private network credentials enabled access to a central account server. The actor then removed a database containing more than 300,000 national identity records and registry data for more than 500,000 companies.

The surveillance section describes a seven department organization that claimed to maintain an identity database of Iranian nationals. Anthropic says the operators profiled 6,388 people in one year and used Claude to analyse 155,216 public posts.

You don't have to scroll every AI thread, track every new tool, or watch every demo. 

The Rundown AI breaks it all down for you — the latest AI news, tools, and tutorials in one free 5-minute email every morning. 

Trusted by 2M+ professionals at Apple, Google, and NASA.

Sign up to start learning.

The report also describes a cloud email espionage platform. Anthropic says the platform used device code phishing and targeted diplomatic and government personnel. Mail records from at least eight organizations were reportedly accessed and removed.

The influence section concerns an information network that published at least 8,913 articles in about 20 languages. Anthropic says most identified material showed little observable engagement from real audiences, and the network was disrupted before it built a genuine audience.

A separate state media example involved Claude assisted rewriting and localization. Anthropic says material was prepared for channels linked to Russian state media. The company describes repeated publication across outlets as an attempt to create a false appearance of independent confirmation.

The distillation section concerns the unauthorized extraction of model capabilities. Anthropic says it identified additional attacks from seven China based laboratories. It describes fake accounts, stolen payment details, login credentials, and application keys as access methods.

These examples raise a measurement problem. The report combines incidents with different goals, evidence levels, and operating environments. A count of cases cannot be converted into a general estimate of how often models are misused.

The report is still useful as a record of observed techniques. It connects language generation with reconnaissance, phishing infrastructure, surveillance analysis, media production, and capability extraction.

It also shows that model safeguards operate alongside conventional controls. Account security, identity protection, endpoint defenses, cloud logs, and information sharing remain part of the evidence chain.

The most defensible reading is limited. Anthropic documented selected attempts and says it disrupted them. Independent reporting confirms the report’s publication and broad subject areas, but the operational details remain primarily company supplied.

The report also provides indicators of compromise for technical review. Those indicators extend the disclosure beyond a general discussion, while still requiring independent validation in each affected environment.

The next A.I. boom could create massive winners just like the 1990s tech surge.

We identified 7 small tech companies positioned to benefit from the next phase of A.I. growth.

See them inside this free report 7 Stocks to Ride The A.I. Megaboom.

View the 7 Stocks