Countering misuse of AI: September 2026

Evidence record

The report documents agentic cyber workflows used by state-linked, criminal and hacktivist actors, including GTG-20006, GTG-50020 and GTG-50029.

Read the original source ↗

Claim-level citations (57)

• supportsAnthropic accused Alibaba of large-scale unauthorized Claude distillation: Anthropic's later September 2026 reporting described much larger Alibaba-linked distillation activity, so the 28.8 million figure is a disclosure-specific lower snapshot rather than a stable lifetime total.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says Russian freelancers used Claude Code to develop autonomous FPV attack-drone software: Anthropic assessed the developers as likely freelance Russia-based threat actors; the public report does not establish direct state command.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says Russian freelancers used Claude Code to develop autonomous FPV attack-drone software: The case is human-directed weapons-development assistance using Claude Code, not an autonomous drone operation executed by Anthropic systems.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says Russian freelancers used Claude Code to develop autonomous FPV attack-drone software: Anthropic reports a Russia-based freelance group using Claude Code to develop autonomous lethal-drone software and train vision components on Ukraine combat footage.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says Russian freelancers used Claude Code to develop autonomous FPV attack-drone software: The actors combined Claude Code with software-in-the-loop simulation and rented GPU capacity for model training.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says Russian freelancers used Claude Code to develop autonomous FPV attack-drone software: Anthropic reported Claude-assisted development of shared swarm memory, fault-tolerant coordination logic, an onboard small language model, terminal guidance, operator geolocation, acoustic detection and programmable-chip logic.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic attributed Claude-assisted content production to Russian state-media-linked influence operations: The connection to state-media pipelines is Anthropic's threat-intelligence attribution rather than an independently adjudicated finding.

  GTG-24015, paragraphs 2 and 4

• supportsAnthropic attributed Claude-assisted content production to Russian state-media-linked influence operations: Actors used chains of outlets to make Russian-origin claims appear independently reported and used Claude to scale editorial production.

  GTG-24015, paragraph 3 and Key findings

• supportsAnthropic attributed Claude-assisted content production to Russian state-media-linked influence operations: Anthropic assessed with high confidence that Claude-generated outputs were published or broadcast through Russian state-aligned outlets including Sputnik and RT properties.

  GTG-24015, paragraph 2 and Table 5

• supportsAnthropic attributed Claude-assisted content production to Russian state-media-linked influence operations: Anthropic identified and removed four accounts used as an editorial/news-production workflow.

  GTG-24015, opening paragraph and Disruption and mitigations

• supportsAnthropic attributed Claude-assisted content production to Russian state-media-linked influence operations: Anthropic attributes four accounts to Claude-assisted content work feeding Sputnik/RT-linked media ecosystems.

  GTG-24015, opening two paragraphs

• supportsAnthropic says a Russian procurement operator used Claude to route restricted goods through intermediaries: This is provider-attributed AI assistance to a human procurement operation, not autonomous procurement by Claude.

  GTG-27006, Summary and paragraphs on procurement automation

• supportsAnthropic says a Russian procurement operator used Claude to route restricted goods through intermediaries: Anthropic reports a Moscow design-bureau procurement manager used Claude to identify China/Hong Kong intermediaries and prepare multilingual supplier communications while concealing end recipients.

  GTG-27006, Summary and paragraph following the five workstreams

• supportsAnthropic says a Russian procurement operator used Claude to route restricted goods through intermediaries: The actor asked Claude to reverse-engineer an existing gray-import chain involving a Russian distributor, a China-based import-export firm and a Hong Kong intermediary.

  GTG-27006, paragraph on tender specifications and import intermediaries

• supportsAnthropic says a Russian procurement operator used Claude to route restricted goods through intermediaries: Claude was used to identify third-country intermediaries, draft quote requests and structure routing intended to obscure Russian end users.

  GTG-27006, paragraphs on supplier correspondence and routing through intermediaries

• supportsAnthropic says a Russian procurement operator used Claude to route restricted goods through intermediaries: Anthropic described five workstreams including magnetometers, space-grade photovoltaic wafers, aviation oxygen systems, a hospital project for a Russian National Guard unit, and IT/encryption procurement through Russia's defense purchasing platform.

  GTG-27006, five workstreams in Summary and Table 3

• supportsAnthropic says PRC labs relayed user prompts to Claude for distillation, exposing sensitive data: Anthropic says relayed sessions contained sensitive corporate and government-related information, including live credentials in at least one Russian government example.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says PRC labs relayed user prompts to Claude for distillation, exposing sensitive data: These are Anthropic threat-intelligence attributions; the affected labs' user-notification practices and full data-retention behavior are not independently established.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says PRC labs relayed user prompts to Claude for distillation, exposing sensitive data: Anthropic described transfer-station/proxy networks using fraudulent identities, payment methods, credentials and API keys to reach Claude from restricted regions.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says PRC labs relayed user prompts to Claude for distillation, exposing sensitive data: Anthropic reports that several PRC labs relayed/replayed their users' prompts to Claude as part of distillation workflows.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says PRC labs relayed user prompts to Claude for distillation, exposing sensitive data: Anthropic said relayed sessions exposed names, contact data, company information, credentials and other sensitive material from hundreds of end users across at least a dozen languages.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says PRC labs relayed user prompts to Claude for distillation, exposing sensitive data: Anthropic reported more than 12.1 million DeepSeek-attributed exchanges over 14 days in July 2026, including relayed requests containing sensitive enterprise and government information.

  SRC-ANTHROPIC-TI-SEP10

• supportsAnthropic says PRC labs relayed user prompts to Claude for distillation, exposing sensitive data: Anthropic said Moonshot silently forwarded customer requests to Claude and, during one ten-day period, relayed nearly 300,000 customer requests through 5,380 fraudulent accounts.

  SRC-ANTHROPIC-TI-SEP10

• supportsGTG-10007 built an autonomous exploit foundry and used the outputs in real intrusions: Anthropic says the actor extracted hundreds of megabytes of student personal data from an education-technology company and retrieved citizen names, phone numbers and home addresses from a Southeast Asian government agency.

  GTG-10007 campaign impact

• supportsGTG-10007 built an autonomous exploit foundry and used the outputs in real intrusions: Anthropic reports a fleet of 13 standing collection agents running on a schedule without a human in the loop.

  GTG-10007 autonomous collection-fleet loop

• supportsGTG-10007 built an autonomous exploit foundry and used the outputs in real intrusions: Anthropic says GTG-10007 targeted roughly 50 organizations and compromised an education-technology company, a retailer and a Southeast Asian government agency.

  GTG-10007 hands-on intrusions

• supportsGTG-10007 built an autonomous exploit foundry and used the outputs in real intrusions: Anthropic reports that one continuously iterating exploit-research workflow in GTG-10007 produced more than a dozen possible zero-day findings in a month.

  GTG-10007 appliance zero-day research loop

• supportsA dating-app network mixed thousands of AI personas with real workers: Anthropic reports roughly three AI personas for every real person mixed into the dating-app feed.

  GTG-15001 key findings

• supportsA dating-app network mixed thousands of AI personas with real workers: Anthropic reports more than 4,700 AI personas engaging at least 25,000 unique people across a two-week window in a network of more than 20 dating apps.

  GTG-15001 overview

• supportsA dating-app network mixed thousands of AI personas with real workers: Anthropic reports that the apps included review-specific behavior intended to hide their normal functionality during App Store and Play Store review.

  GTG-15001 store-review evasion

• supportsA dating-app network mixed thousands of AI personas with real workers: Anthropic reports Claude-powered personas sending roughly 2.36 million messages over the two-week observation window.

  GTG-15001 key findings

• supportsAnthropic says DeepSeek silently routed selected customer traffic through Claude: Anthropic reports that DeepSeek silently relayed selected user requests to Claude Opus while users believed they were using DeepSeek.

  GTG-16001 overview

• supportsAnthropic says DeepSeek silently routed selected customer traffic through Claude: Anthropic attributes more than 12.1 million exchanges over 14 days in July 2026 to DeepSeek distillation attacks.

  GTG-16001 scale

• supportsAnthropic says DeepSeek silently routed selected customer traffic through Claude: Anthropic says relayed traffic included sensitive company information, live Russian government database credentials and PRC police-surveillance development requests.

  GTG-16001 sensitive-data examples

• supportsAnthropic attributes a large reasoning-trace extraction pipeline to Zhipu/Z.ai: Anthropic says Zhipu later used public vulnerability datasets to build capture-the-flag challenges and targeted the cyber capabilities of frontier models during distillation work.

  GTG-16006 cyber-capability targeting

• supportsAnthropic attributes a large reasoning-trace extraction pipeline to Zhipu/Z.ai: Anthropic reports 770,609 exchanges through the chain-of-thought cleaner and more than three million Zhipu-attributed exchanges over the same 10-day period.

  GTG-16006 scale

• supportsAnthropic attributes a large reasoning-trace extraction pipeline to Zhipu/Z.ai: Anthropic reports that Zhipu/Z.ai rotated through 273 fraudulent accounts during a 10-day chain-of-thought extraction campaign against Claude Opus 4.8.

  GTG-16006 overview

• supportsGTG-20006 automated parts of a Russian espionage workflow: Anthropic says humans remained involved in target selection and workflow refinement even as agents automated substantial operational work.

  Cyber operations trends and GTG-20006

• supportsGTG-20006 automated parts of a Russian espionage workflow: Anthropic reports that monitoring agents checked malware against security detections and automatically modified and rebuilt detected tools until they evaded those detections.

  GTG-20006, malware adaptation

• supportsGTG-20006 automated parts of a Russian espionage workflow: Anthropic identified more than 20 organizations in GTG-20006 planning, reconnaissance or live operations, concentrated in government, defense, intelligence and diplomatic sectors.

  GTG-20006, targeting

• supportsGTG-20006 automated parts of a Russian espionage workflow: Anthropic reports that GTG-20006 used customized AI-driven workflows from tool development and infrastructure acquisition through phishing, persistence, command-and-control and exfiltration.

  GTG-20006, overview

• supportsGTG-50014 used agentic pipelines to turn exposed credentials into rapid multi-victim theft: Anthropic says one GTG-50014 operator used 10 AWS EC2 workers to download and scan 1.8 million Android APKs for hardcoded credentials.

  GTG-50014 credential-harvesting pipeline

• supportsGTG-50014 used agentic pipelines to turn exposed credentials into rapid multi-victim theft: Anthropic says another compromise escalated from one stolen developer token to full administrative control of a victim cloud environment in roughly three hours.

  GTG-50014 operational tempo

• supportsGTG-50014 used agentic pipelines to turn exposed credentials into rapid multi-victim theft: Anthropic reports a SaaS breach in which the operators extracted data from roughly 200 downstream customer organizations and dumped more than 2,100 Azure AD token sets spanning over 40 tenants in about 34 hours.

  GTG-50014 supply-chain theft

• supportsGTG-50014 used agentic pipelines to turn exposed credentials into rapid multi-victim theft: Anthropic reports that one technology-provider compromise exfiltrated more than one terabyte of data including national identifiers and millions of payment-card records.

  GTG-50014 serious compromises

• supportsGTG-50020 used prompt injection against an AI evaluation sandbox: Anthropic reports that a follow-on campaign from the same infrastructure attacked roughly 30 AI companies in about four days.

  GTG-50020, follow-on campaign

• supportsGTG-50020 used prompt injection against an AI evaluation sandbox: Anthropic reports that GTG-50020 injected malicious instructions into an AI vendor's automated evaluation sandbox and caused it to disclose production AI API keys from multiple providers.

  GTG-50020, AI supply-chain intrusion

• supportsGTG-50020 used prompt injection against an AI evaluation sandbox: The actor used parallel reconnaissance and exploitation agents and a containerized pentest platform that ran injection, XSS, authentication-bypass and SSRF testing with exploitation enabled against production systems.

  GTG-50020, human-directed loop and autonomous exploitation pipeline

• supportsGTG-50020 used prompt injection against an AI evaluation sandbox: Anthropic says the actor pursued access to a pre-release Claude model through more than a dozen avenues but never obtained it, and that Anthropic's own systems were not compromised.

  GTG-50020, campaign objective

• supportsA fake Claude reseller stole the credentials of the customers it claimed to serve: Anthropic says GTG-50021 advertised discounted Claude access while silently proxying customers to a different model.

  GTG-50021 fraudulent reseller

• supportsA fake Claude reseller stole the credentials of the customers it claimed to serve: Anthropic describes stolen AI credentials as providing three attacker benefits: resale value, victim-funded compute and attribution cover.

  AI credentials: loot, compute, cover

• supportsA fake Claude reseller stole the credentials of the customers it claimed to serve: Anthropic reports that the reseller tooling installed a credential harvester that stole Anthropic account credentials and sold them onward to other AI proxy resellers.

  GTG-50021 credential theft

• supportsGTG-50029 used agentic workflows across a European hacktivist campaign: Anthropic reports that one compromised political campaign platform yielded about 140,000 records that included users' political opinions.

  GTG-50029, political campaign platform

• supportsGTG-50029 used agentic workflows across a European hacktivist campaign: Anthropic estimates that the actor exfiltrated 12 to 26 GB of database dumps across affected targets and also obtained a 15,000-message mailbox.

  GTG-50029, campaign scope

• supportsGTG-50029 used agentic workflows across a European hacktivist campaign: Across 42 tracked target entities, Anthropic reports internal access to at least 14.

  GTG-50029, campaign scope

• supportsGTG-50029 used agentic workflows across a European hacktivist campaign: Anthropic reports that a single French-speaking actor used Claude and sub-agent workflows against European political parties, media, think tanks and SaaS providers.

  GTG-50029, overview

• supportsGTG-50029 used agentic workflows across a European hacktivist campaign: Anthropic reports that the actor used Claude to develop and debug a previously undocumented WordPress re-installation race condition that created rogue administrator accounts and succeeded against at least four victim websites.

  GTG-50029, novel exploitation