Anthropic disclosed in its September 2026 threat intelligence report that adversaries used Claude across cyber operations, weapons-related engineering, targeted surveillance, influence campaigns, biological misuse, fraud, and illicit model distillation. The headlines focused on China-linked actors building electronic-warfare software and sprawling scam networks. That framing misses the deeper structural problem. Frontier models are no longer passive text boxes waiting for a jailbreak; when wired into agent loops and external tools, they act as cheap, tireless orchestration layers across the entire attack chain.
I have watched security vendors sell "AI-proof" architectures for twenty years. Every wave of automation promises to eliminate human drudgery, and every wave hands attackers a force multiplier before defenders finish patching their assumptions. Anthropic’s disclosures spanning late 2025 through August 2026 show why surface-level refusals fail: adversaries rarely ask a model to hand over a finished weapon. They ask it to write a parser, rank targets, draft a benign-looking script, or manage a customer-service persona—and assemble the pieces themselves.
Why Model Refusals Miss the Kill Chain
Most public coverage treats AI misuse as a binary switch. Either the model refuses a malicious prompt, or it obeys.
Reality is messier. Anthropic’s threat intelligence team breaks abuse down through what it calls "uplift"—the speed, scale, and depth gained when a model assists an operator versus when the operator works alone. Look closely at how intrusions actually move. An attacker starts with credential stuffing, vishing, phishing, or automated token scraping across code repositories, binaries, and open storage. Once a single token lands, the hard work is lateral movement, secret enumeration, database dumping, and persistence.
An AI model does not need to invent a zero-day exploit to do massive damage here. Give a capable coding model access to shell tools, logs, or APIs via agent workflows, and it compresses weeks of tedious reconnaissance and scripting into hours. In Anthropic’s documented cases, operators used Claude Haiku, Sonnet, and Opus to chain tasks together, validate stolen credentials, and build tooling around target infrastructure. Meanwhile, models with heavier cyber safeguards—such as Claude Fable and Mythos—showed no observed malicious cyber activity in those same windows.
That contrast matters. Safety controls work best when tied to specific operational capabilities rather than vague keyword filters. Yet capability locks create a second problem: once an operator sees a frontier model solve complex coding or reasoning tasks, they try to extract those capabilities into cheaper, less restricted models.
The Shadow Proxy Economy Behind Distillation
Banning commercial access from China does not stop a determined lab or state-aligned operator. It pushes traffic into a gray market of proxy brokers, rotated accounts, and crypto-funded API relays.
In February 2026, Anthropic accused three Chinese AI laboratories—DeepSeek, Moonshot, and MiniMax—of running industrial-scale distillation campaigns to siphon Claude’s strengths in coding, agentic reasoning, and tool use. MiniMax alone generated more than 13 million exchanges. Blockchain intelligence firms tracking the ecosystem later documented spikes in suspected China-linked crypto wallet activity flowing through custodial services into proxy providers right after major U.S. model releases.
Think about what distillation actually is. It is not copying a binary file off a server. It is sending millions of carefully structured queries, collecting high-value outputs, and training a student model to mimic the teacher’s reasoning style. Once those weights exist inside a domestic model hosted on local hardware, U.S. API classifiers lose visibility completely.
A model stripped of its API wrapper is a model stripped of real-time telemetry. Once capabilities migrate into local weights, enforcement moves from the lab to network and endpoint defense.
💡 You might also like: The Pentagon Just Crossed a Dangerous Rubicon in Earth Orbit
There is an uncomfortable counter-argument here that policy hawks hate admitting. Aggressive rate-limiting and account bans can degrade legitimate developers who rely on VPNs, cloud relays, or third-party orchestration layers. Over-broad blocks generate false positives while sophisticated actors simply buy fresh credentials from underground token markets.
Weapons, Surveillance, and the Banality of Dual-Use Code
When reporters read that Claude was used in weapons-related work or surveillance, they picture sci-fi autonomy. The actual mechanics documented in Anthropic’s disclosures are far more mundane—and far harder to police.
Consider the conventional weapons example cited in reporting on Anthropic’s findings: a China-based actor used Claude to build an electronic-warfare and air-defense suppression software suite capable of ranking targets and modeling radar jamming. Strip away the geopolitical tension, and what is the software artifact? Linear algebra, signal-processing routines, optimization scripts, and data pipelines. No model vendor can ban matrix math without breaking scientific computing.
Surveillance follows the same dual-use curve. Anthropic reported cases where actors built systems to identify and monitor dissidents, targeting Hong Kong pro-democracy figures, Tibetan and Falun Gong communities, and Iranian opponents abroad. Other operators used Claude to source dual-use defense goods or map public supply chains for directed-energy hardware. Again, the core building blocks—entity resolution, log correlation, OSINT scraping, translation—look identical to legitimate enterprise analytics.
Even influence operations rely on ordinary workflow automation. Anthropic pointed to fabricated claims aimed at Moldova’s president ahead of a September 2025 vote and synthetic grassroots posts prepared ahead of Kenya’s 2027 general election. Models draft variations at scale; humans still choose the narrative wedges and distribution channels.
Industrial Fraud Without Hollywood Sophistication
If state espionage gets the press conferences, commercial fraud gets the volume.
In one case highlighted in Anthropic’s September 2026 report, a China-based studio used Claude to build a network of more than twenty consumer applications and drive conversational personas across them. Over a two-week stretch in April 2026, more than 4,700 distinct AI personas interacted with at least 25,000 unique users. Where automation hit a wall, paid human workers stepped in to keep high-value targets on the hook.
No zero-day needed. No exotic cryptography broken. Just low marginal cost per conversation combined with human escalation at the point of monetization.
Compare that to a hypothetical scenario to see why enterprise defenders keep misreading the threat. Suppose a mid-sized financial firm deploys an internal coding assistant connected to internal documentation and ticket queues. A rogue contractor does not ask the assistant to exfiltrate customer records. Instead, the contractor asks it to summarize onboarding scripts, generate test fixtures, and map service dependencies—cutting manual discovery time from three weeks to two days before handing credentials to an external broker. That hypothetical captures the exact gray zone where productivity tools and insider risk collide.
What Security Leaders Overlook
Most CISOs still evaluate AI risk by asking whether employees paste proprietary source code into a public chat window. That question is three years out of date.
The real attack surface sits at three junctions:
- Agent tool permissions: An LLM with read-only access to a sandbox is a nuisance if compromised. An LLM wired to CI/CD pipelines, cloud IAM roles, or OAuth tokens is an internal operator with non-deterministic judgment.
- Credential and token hygiene: Anthropic’s lifecycle breakdown shows adversaries harvesting exposed session tokens from mobile APKs, container images, metadata endpoints, and victim-deployed agents. Model guardrails cannot fix leaked API keys.
- Telemetry blind spots: Security teams log API calls to SaaS vendors, yet rarely monitor prompt patterns, tool-call chains, or sudden spikes in automated sub-agent traffic.
Nor is Anthropic’s own playbook a silver bullet. Detecting, investigating, attributing, banning accounts, and hardening classifiers takes time. Every public threat report also acts as a syllabus for adversaries studying what classifiers flag. Transparency helps defenders, yet it inevitably sharpens evasion tactics.
Practical Moves for Teams Running AI in Production
Security teams cannot wait for frontier labs to solve alignment once and for all. Actionable controls start at the perimeter of your own infrastructure.
- Treat AI agents like privileged service accounts. Enforce least-privilege scopes, short-lived credentials, and strict egress allowlists on every tool an agent can invoke.
- Audit token exposure before model safety. Scan mobile binaries, repositories, build artifacts, and cloud metadata endpoints for static keys and session tokens that attackers harvest at scale.
- Log tool chains, not just prompts. Record every external API call, file read, and network request triggered by a model loop so anomalies stand out during incident response.
- Separate high-impact actions behind deterministic gates. Never let probabilistic text generation directly approve financial transfers, production deployments, or identity changes without policy checks.
Frontier models have lowered the cost of building software, running campaigns, and automating abuse. Treating them as mere chatbots guarantees surprise when an attacker turns a helpful assistant into an autonomous operator.
