Anthropic Details Disrupted Claude Misuse Across Seven Harm Areas

Anthropic on September 10, 2026 published its September 2026 threat intelligence report, detailing how its Threat Intelligence team identified and disrupted threat actors that misused Claude between December 2025 and August 2026 across seven harm areas, including cyber operations, influence operations, surveillance, and illicit model distillation.

The report, “Detecting and countering misuse of AI: September 2026,” covers activity across cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. The misuse cases involved Claude Haiku, Sonnet, and Opus models; none involved Claude Fable or Mythos-class models except one illicit distillation case. Anthropic tracks the actors under internal Generative Threat Group (GTG) designators and measures what it calls uplift, the capability boost AI gives an operation across speed, scale, and depth. The company said that in each case it disrupted the activity, used the findings to strengthen its safeguards, and shared intelligence with authorities and industry partners where appropriate, adding that it publishes the case studies because “we believe we have a responsibility to disclose malicious misuse of our services.”

Cyber Operations

The report’s most extensive cyber case, tracked as GTG-20006, covers an actor whose attribution Anthropic said is consistent with public reporting linking it to Midnight Blizzard; one operator is a Russian speaker using the handle “JackPoterz.” The actor targeted more than 20 organizations, concentrated among Ukrainian government, military, and diplomatic bodies, compromised at least three hotel WiFi vendors to hijack DNS records, took over the WhatsApp accounts of at least two former high-level Ukrainian officials, and stole more than 300,000 national identity records plus commercial registry data covering more than half a million companies from a North African government technology authority. According to the report, the actor’s AI agents autonomously modified and rebuilt its malware whenever security products detected it.

GTG-50014 covers operators suspected of affiliation with the ShinyHunters collective whose credential-harvesting pipelines mass-downloaded 1.8 million Android APKs and scanned them for hardcoded secrets. Anthropic reported that one compromise of a technology provider exfiltrated more than a terabyte of data, including millions of payment card records, while another affiliate extracted data from roughly 200 downstream customers of a breached software-as-a-service provider and dumped more than 2,100 Azure AD token sets spanning over 40 corporate tenants in about 34 hours, with AI agents performing nearly all of the work.

Three further cases show the range of activity described. GTG-10007, Chinese-speaking operators likely based in Changsha, Hunan, two of them identified as undergraduate students, targeted roughly fifty organizations and ran an autonomous vulnerability research program in which one workflow iterating on network appliances yielded more than a dozen possible zero-day findings in a single month. GTG-50020, a Russian-speaking financially motivated actor, exfiltrated roughly 26 gigabytes from one victim, sought $1.5 to $2.5 million in extortion, and then attacked roughly thirty AI companies in about four days with the stated goal of accessing a pre-release Claude model; Anthropic said every attempted path failed and its own systems were never compromised. GTG-50029, a single French-speaking hacktivist, exploited a previously undocumented WordPress re-installation race condition against at least four sites, gained internal access to at least 14 of 42 tracked targets, exfiltrated approximately 140,000 records including users’ political opinions from a campaign platform, and built a doxxing platform called fafsearch loaded with tens of millions of rows.

Influence and Surveillance Operations

Nine influence operation cases in the report originated in Russia, Iran, Turkey, the Gulf, South Asia, Africa, and Europe, with reach measured on the Brookings Institution’s Breakout Scale. In GTG-04001, a Russian-speaking actor in Bangui produced daily content for Radio Lengo Songo (98.9 FM), a station Anthropic linked to Politology, the Africa Corps/Wagner influence branch it assesses came under Russian Foreign Intelligence Service control in late 2023; the actor produced forged Central African Republic government documents and employment contracts mandating loyalty to the country’s president and to Russia and its contingent. Anthropic assessed the operation as Category Four on the scale. In GTG-54002, investigators traced roughly 70 fabricated news websites, 70 matching X accounts, and more than 250 inauthentic commenting accounts to LKM Company, a France-based digital advertising agency; the network published at least 8,913 articles in about 20 languages, 318 of them focused on the Democratic Republic of Congo.

Other operations were built around elections and state media. GTG-84005, a commercial election-manipulation platform targeting Malaysia that Anthropic linked to Istanbul-based BBS Bilisim Teknolojileri, managed about 1,000 fake X accounts across all 222 Malaysian parliamentary constituencies and fabricated dossiers against an opposition politician. GTG-24015 involved four accounts that used Claude as an editorial desk feeding Russian state media including Sputnik Moldova, RIA Novosti, Sputnik en Español, Sputnik Africa, and RT English; a former Sputnik Moldova editor-in-chief amplified fabricated claims about President Maia Sandu ahead of Moldova’s September 28, 2025 parliamentary election. GTG-84002, an operation against the Muslim Brotherhood that Anthropic linked with high confidence to UAE government officials, ran approximately 300 inauthentic accounts, ghost-wrote testimony for the 62nd session of the UN Human Rights Council, profiled 18 members of the European Parliament, and compiled counter-dossiers on UN Special Rapporteurs.

The surveillance cases include GTG-50027, in which a single likely Bamako-based consultant used Claude as the primary engineering workforce for Lakana 360, a national surveillance platform built for Mali’s state intelligence service ANSE to monitor roughly 25 million SIM cards across all three national mobile operators; Anthropic said the warrant requirement was removed from the platform’s dossier-generation component at the operator’s request. GTG-14010 covers a PRC government-aligned actor that used Claude to track, profile, and attempt to recruit Uyghurs in Syria, offering payment for reporting on armed formations while Claude translated replies in real time and role-played an expert to quality-check the deception. In GTG-14020 and GTG-14021, China-based actors that Anthropic linked to PRC religious affairs and municipal public and state security activity produced templated dossiers on Catholic cardinals, the Presbyterian Church in Taiwan, Tibetan Buddhists, and Falun Gong, and one actor re-prompted past a refusal to obtain suppression guidance naming 10 private citizens for “control” along with pre-operational venue intelligence on overseas protests. GTG-34007 covers two linked Iranian units operating 16 Claude accounts that claimed to have surveilled and profiled 6,388 Iranians in a single year, ran social-network analysis over 155,216 tweets naming 39 opposition accounts, and shipped a malicious Firefox extension to mass-harvest identities, feeding a shared case-management system called Arman.

Weapons Development and Biological Misuse

The report details six conventional weapons cases: three in China, two in Russia, and one in Yemen. In GTG-87001, a northern Yemen cell used Claude Code in place of human software engineers to develop guidance, navigation, and control software for a guided rocket, a multi-stage ballistic missile with a stated range goal above 2,000 km, and a variant set including a hypersonic glide vehicle; Anthropic said the cell test-fired a guided rocket and the field test appears to have failed. GTG-27005 covers likely freelance Russia-based actors that used Claude Code to build an autonomous FPV kamikaze drone swarm whose onboard model could select targets, including a “person” class, and issue detonation commands without a human in the loop, training a vision classifier on scraped Ukrainian combat footage. In GTG-17002, a China-based actor built a roughly 16-module electronic warfare and air-defense suppression suite and mid-project changed the simulation’s default scenario to 12 targets in Taiwan, including a command bunker, an early warning radar site, and Patriot and Tien Kung batteries; Anthropic assesses the actor was linked to PRC research institutions including the PLA Academy of Military Sciences.

Five biological misuse case studies follow. In May 2026, Anthropic’s biological safety classifier blocked a request to help author a grant application for chikungunya gain-of-function research intended for a military research institute, routed through an evasion platform that later added a fallback sending refused prompts to a competitor’s model. A researcher in an unsupported region spent weeks planning avian influenza mammalian-adaptation experiments, but Anthropic said its classifiers confined the exchanges to Claude Sonnet 4 and Haiku 4.5, its weakest model class. In a third case, a reseller relay serving more than a dozen unrelated customers carried one user’s run entirely on Opus 5, drafting an orthopoxvirus immune-evasion grant application end to end in about an hour. Two further cases involved venom and toxin redesign programs with state support. Anthropic said a sweep of 30 days of activity associated with adversarial state institutions found roughly 35 distinct research efforts, most of them ordinary civilian science but some with notable dual-use potential.

Fraud and Illicit Distillation

In the scams and fraud section, GTG-15001 covers a China-based app studio that used Claude to run a network of more than 20 dating apps whose AI personas, more than 4,700 in total, conversed with at least 25,000 unique individuals during a two-week window in April 2026, exchanging roughly 2.36 million messages. The studio mixed real gig workers into the same match feed at about a three-to-one ratio of AI personas to real people, and the personas were instructed never to disclose they were automated.

Anthropic said that since February 2026 it has disrupted distillation attacks from seven China-based labs, all targeting its generally available models. In GTG-16005, Anthropic attributed to Alibaba the largest distillation campaign it has measured: chain-of-thought distillation of Opus 4.6 and 4.7 peaking at nearly 3 million exchanges per day from more than 3,500 fraudulent accounts, with over 151 million exchanges observed between May and July 2026 and the harvested transcripts used to train Qwen 3.5, 3.6, and 3.7. In GTG-16002, Moonshot AI silently forwarded customer requests to Claude instead of its Kimi models, relaying almost 300,000 requests over ten days through 5,380 fraudulent accounts and using a cross-session replay attack on Claude’s thinking signatures to extract reasoning traces, with over 23 million exchanges observed between May and July 2026. In GTG-16001, DeepSeek used the same replay technique and relayed users’ requests to Claude Opus without their knowledge, logging over 12.1 million exchanges in 14 days in July 2026; Anthropic reported that the relayed traffic exposed sensitive material including live credentials for a Russian government database and a PRC police case-management system.

The remaining named campaigns include Zhipu, which ran 770,609 exchanges through a chain-of-thought cleaner in ten days and targeted cyber capabilities ahead of its GLM 5.3 release, and Xiaomi, which routed more than 400,000 requests across more than 1,500 accounts. Anthropic also reported that SenseTime’s distillation pipeline included Claude transcripts purchased from third-party data vendors, and that MiniMax built a proxy network through a shell company offering only Anthropic and OpenAI models.

Anthropic describes layered countermeasures against illicit distillation: metadata-based attribution of proxy service networks, extraction classifiers strengthened alongside the Fable 5 launch, summarized internal reasoning intended to make stolen transcripts less useful for training, preserved thinking introduced with Fable 5.1 that stops new API accounts from altering the system prompt, tools, or messages preceding Claude’s reasoning in multi-turn conversations, and identity verification requirements for accounts showing signals of potential abuse, with accounts that fail verification banned. The company said what it learns as it investigates and disrupts distillation attacks will continue to inform the safeguards it builds.