Anthropic's Misuse Report, Condensed to 117 Findings

Eight months of disrupted AI abuse, read case by case and boiled down to a 20-page document with every claim linked to its source

September 14, 2026

by Kai Magnus

Glanding-dampen…

click the cover to download the pdf Anthropic published its September 2026 threat intelligence report on September 10. It covers the misuse they disrupted between December 2025 and August 2026, and it is long. We read the whole thing and condensed it into 117 findings across eight categories, each one a single sentence, and each one linking back to the exact passage it came from.

You can download the PDF by clicking the cover above, or read the full set of findings below. Every finding is Anthropic's, not ours, and we did not independently verify any of it. Where Anthropic itself says it could not confirm an outcome, the finding says so.

If you would rather go straight to the source, the original report is here:

01. The overall change in attacker capability #

4 findings

• AI narrowed the labor and tooling gap between lone operators and state teams, making an attack’s technical sophistication a much less reliable indicator of its operator.↗
• The central shift was economic: familiar techniques became faster, cheaper, and easier to apply broadly, making previously uneconomical targets worth attacking without inventing entirely new methods. ↗
• Agents increasingly executed reconnaissance, exploitation, and data theft, while humans generally selected targets, decided how to monetize access, and reviewed important outputs rather than directing every technical step. ↗
• These are selected notable cases, not representative prevalence data; almost all involved Haiku, Sonnet, or Opus, with Fable appearing in one distillation case and no Mythos misuse. ↗

02. Offensive cyber #

30 findings

Russian-linked espionage

• Russian-linked operators built agents to monitor malware detections, autonomously modify and rebuild flagged implants , and redeploy revised tools, repeatedly iterating rather than waiting for human developers.↗
• Their phishing workflows automated domain research and registration, hosting configuration, email delivery, and compromise monitoring; humans primarily refined the reusable skills governing the process rather than operating each stage. ↗
• Specialist AI roles handled infrastructure, implants, phishing interfaces, and iOS research; persistent records of failed exploit approaches prevented subsequent sessions from repeatedly pursuing already disproven research paths. ↗
• Spies compromised at least three hotel Wi-Fi vendors and redirected guest traffic, combining hotel records with stolen device data to target Ukrainian officials and drone-industry personnel. ↗
• Drone-industry theft included manufacturer mailboxes and a complete proprietary vision-system SDK; subsequent reverse engineering revealed product architecture, hardware requirements, supplier dependencies, and details of an unannounced product. ↗
• AI helped extract and organize hundreds of gigabytes of stolen data; cloud-email espionage within the operation successfully accessed and exfiltrated messages from at least eight organizations. ↗
• A North African government breach exposed more than 300,000 national identity records plus registry data covering over 500,000 companies, combining large-scale personal and commercial information in one intrusion. ↗
• The operation covertly exported WhatsApp conversations, accessed live surveillance-camera feeds, and deployed malware designed to stop security updates, combining communications surveillance with efforts to preserve compromised access. ↗

Industrialized theft and extortion

• A suspected ShinyHunters affiliate mined 1.8 million Android applications across ten cloud workers, continuously extracting embedded credentials and reporting discoveries in real time to supply subsequent intrusions.↗
• One intrusion escalated from a stolen developer token to full cloud administrative control in roughly three hours , illustrating the speed of expansion after the initial credential compromise.↗
• A SaaS breach exposed roughly 200 downstream customer organizations; AI agents performed nearly all the work, extracting more than 2,100 authentication-token sets spanning over forty corporate tenants. ↗
• The token collection took about thirty-four hours; a separate SaaS intrusion escalated from cross-site scripting to privileged access and data theft affecting thousands of downstream customer organizations. ↗
• A technology-provider breach yielded over a terabyte of data, including millions of payment-card records; a separate airline intrusion reached systems containing tens of millions of passenger records. ↗
• At an energy-company victim, attackers claimed remote control over charging current for residential EV chargers; the report does not independently establish that they demonstrated or exercised this capability. ↗Anthropic did not independently confirm this outcome.
• An affiliate claimed legitimate bug-bounty payments from companies they also infiltrated and extorted, while using vulnerability submissions as reconnaissance material, blending disclosure-program participation with criminal exploitation. ↗
• Advanced automation did not guarantee operational discipline: operators exposed infrastructure addresses, bot tokens, hardcoded proxy credentials, and public staging locations, despite running otherwise technically sophisticated credential-harvesting operations. ↗

Autonomous research and hacktivism

• Chinese operators, including two university undergraduates , coordinated reconnaissance, intrusion, malware development, and vulnerability research across roughly fifty organizational targets, successfully stealing student and citizen records during their campaigns.↗
• Their autonomous research produced previously unknown vulnerabilities in security products, validated within the operators’ laboratory, alongside working exploits for multiple appliance families rather than merely speculative vulnerability descriptions. ↗
• One continuously running appliance-research workflow produced more than twelve possible zero-days within a month; Anthropic did not independently establish every candidate as a confirmed, exploitable vulnerability. ↗Anthropic did not independently confirm this outcome.
• Agent swarms retained target lists, credentials, campaign state, and instructions across sessions, allowing research and collection to continue during operators’ absences without repeatedly rebuilding context or restarting workflows. ↗
• Thirteen scheduled agents collected public military and government information, then summarized, scored, and delivered intelligence through a distribution portal without requiring an operator to initiate every collection cycle. ↗
• A lone French-speaking hacktivist obtained internal access to fourteen of forty-two tracked targets and stole an estimated 12–26 gigabytes of sensitive data through a campaign spanning numerous victims. ↗
• Claude helped develop, debug, and test a previously undocumented WordPress race-condition exploit that successfully compromised at least four websites, establishing observed exploitation rather than just generated attack code. ↗
• The hacktivist built a searchable doxxing platform combining tens of millions of previously leaked records with newly stolen political and personal information, consolidating material from otherwise separate breaches. ↗
• One campaign-platform breach exposed approximately 140,000 records containing political opinions; other intrusions poisoned backups to enable reinfection after restoration, making recovery itself a potential route back into victims’ systems.↗

Attacking and stealing AI access

• Stolen AI credentials supplied three assets simultaneously: inventory for resale, computing billed to victims , and cover under legitimate account identities, making model access both loot and attack infrastructure.↗
• Attackers shifted ongoing intrusions onto victims’ stolen AI keys; one hacktivist sustained a month-long campaign entirely through stolen access, avoiding the need to purchase legitimate model access. ↗
• Fake discounted-Claude services distributed credential-stealing clients while sometimes substituting another model; the clients repeatedly harvested replacement credentials after victims reset their accounts, undermining credential rotation as a standalone response. ↗
• Prompt injection against an AI vendor’s evaluation sandbox exposed production model credentials; the actor subsequently applied its approach against approximately thirty AI companies within just four days. ↗
• The same actor pursued prerelease Claude access through more than twelve avenues without success; reported compromises involved customer environments, and Anthropic says its own systems were not breached. ↗

22 findings

Scalable propaganda infrastructure

• Influence operators embedded doctrine, approved sources, prohibited wording, and evasion rules in persistent agent memory, coordinating output across separate workspaces without repeatedly supplying the same human instructions. ↗
• Most detected influence campaigns attracted little genuine engagement , while established state-media and broadcast distribution provided the clearest evidence of authentic reach; content volume alone did not demonstrate persuasion.↗
• A French advertising agency operated approximately seventy fake news sites and published at least 8,913 articles in twenty languages across six continents, but attracted little genuine audience engagement. ↗
• The network rewrote identical source stories in opposing ideological directions for different audiences, using fabricated journalists and centralized publishing to make commercially produced influence resemble independent local reporting. ↗
• A Turkey-based commercial platform used millions of voter records to profile all 222 Malaysian constituencies, tailoring political messaging around racial, religious, and royal sensitivities rather than distributing uniform propaganda. ↗
• Its roughly thousand fake accounts supported adjustable artificial engagement, including a request for one million views supporting Malaysia’s prime minister; genuine political impact was not independently established. ↗Anthropic did not independently confirm this outcome.
• The Malaysian operation republished Russian and Chinese state-media material under fabricated local bylines, removing original attribution to make centrally sourced narratives appear to originate from independent domestic journalists. ↗

State-linked operations

• A Russian-directed Central African operation used Claude for daily radio propaganda and politically conditional employment systems, including staff loyalty scores, hiring controls, and recommendations concerning employee dismissal. ↗
• The operation also generated forged government communications and monitored opposition figures, combining propaganda production with institutional impersonation, administrative control, and politically targeted surveillance rather than limiting activity to broadcasting. ↗
• Russian state-media staff used Claude as an editorial desk; Anthropic matched generated material to published articles and at least one television broadcast, demonstrating dissemination beyond private drafting sessions. ↗
• Russian-linked operators circulated claims across aligned outlets to manufacture apparent independent corroboration; fabricated allegations targeted Moldova’s president before the 2025 parliamentary election, making repetition look like multiple-source verification. ↗
• Iranian institutions used Claude to build propaganda program offices, producing doctrine manuals, organizational plans, persona systems, target databases, and multilingual material rather than simply asking for individual social-media posts. ↗
• Iranian-linked operators falsely attributed claims to CSIS, Brookings, and RAND while distributing tailored narratives across more than one hundred domestic channels, borrowing institutional credibility for state-aligned messaging. ↗
• An Iranian security-linked actor imitated three writers’ voices and prepared propaganda narratives ahead of the Supreme Leader’s succession, combining stylistic impersonation with advance planning for a major political transition. ↗
• A UAE-linked operator maintained approximately 300 fake influencers and ghostwrote testimony presented as independent for the UN; Anthropic did not confirm that the intended testimony was successfully delivered. ↗Anthropic did not independently confirm this outcome.
• The UAE-linked campaign profiled eighteen European lawmakers and journalists and compiled counter-dossiers against UN investigators critical of the UAE’s Sudan involvement, targeting both opinion-shapers and human-rights oversight institutions. ↗

Impersonation and domestic manipulation

• A MEK/NCRI-linked network copied an activist’s writing style from roughly 8,400 Telegram posts, then used undisclosed AI assistance to impersonate him in live conversations with his contacts.↗
• The network scraped more than five hundred channels and analyzed roughly 52,000 messages, producing profiles that combined psychological characteristics, political alignment, and arrest history rather than merely cataloging public posts. ↗
• It generated animated Persian-speaking avatars presented as ordinary Iranians, hiding synthetic identities and organizational affiliation so coordinated political messaging appeared to come from independent members of the public. ↗
• A single Bangladesh operator rotated twenty-nine accounts and generated at least 1,500 fake headlines and 300 fabricated narratives, targeting rural audiences with limited literacy through coordinated audiovisual content. ↗
• The Bangladesh operation converted fabricated stories into videos and scheduled publication far ahead; Anthropic found no evidence establishing that a political party directed or funded the operator. ↗Anthropic did not independently confirm this outcome.
• A Kenyan operator reused one mass-posting workflow for political astroturfing and retail marketing, producing coordinated batches of posts; Anthropic observed no meaningful reach beyond the operator’s own network. ↗

04. Surveillance and repression #

19 findings

Replacing intelligence and engineering teams

• One consultant used Claude as the engineering workforce for a nationwide Malian surveillance platform covering three mobile operators and roughly twenty-five million SIM cards, rather than employing an engineering team.↗
• The platform combined voice-based identification across SIM cards, biometric-registry matching, inferred meetings, and flags for VPN or encryption use, potentially maintaining identification despite changes in phone subscriptions. ↗
• The operator removed warrant checks from automated dossiers and configured indefinite retention; because the surveillance platform ran locally, banning Claude access stopped development assistance without disabling the deployed system .↗
• Chinese-aligned operators lacking Arabic skills used Claude’s live translation and dialect-specific outreach for covert recruitment targeting Uyghurs in Syria; Anthropic could not verify whether recruitment attempts succeeded. ↗Anthropic did not independently confirm this outcome.
• Profiles identified financial distress, family separation, and relatives remaining in Xinjiang as potential leverage, turning multilingual communications analysis into support for coercive targeting and attempted human-source recruitment. ↗
• A Chinese religious-intelligence operator substituted Claude for an analyst team, producing standardized dossiers on Catholic, Tibetan Buddhist, Falun Gong, and Taiwanese Christian communities while seeking scandals and exploitable leverage. ↗
• Chinese security actors formalized surveillance workflows in internal AI manuals, integrating custom skills, government databases, and automated reporting into routine municipal operations rather than treating AI as occasional assistance. ↗
• After initially refusing, Claude produced suppression guidance naming ten private citizens for coercive interviews, petition interception, or monitoring, showing that further prompting overcame a boundary within the same project. ↗
• The broader campaign sought advance venue and location intelligence on lawful overseas protests and diaspora events, extending domestic surveillance practices into potential transnational repression against people outside China. ↗
• A separate Chinese contractor automated daily intelligence briefings that assessed political sensitivity, identified dissidents, and sometimes recommended enforcement actions, moving beyond information summarization into recommendations for state intervention. ↗
• A commercial surveillance vendor used Claude to infer Gulf-region users’ politics, demographics, and locations alongside synthetic-persona development; downstream infiltration or operational deployment remained unverified when Anthropic banned the account. ↗Anthropic did not independently confirm this outcome.

Iranian operations

• Two Iranian security-linked units used sixteen accounts to develop tooling for one shared surveillance system, including a malicious Firefox extension that reached production rather than remaining a design proposal. ↗
• The extension disguised identity harvesting as a prayer-times utility; related tools linked phone numbers to identities and supported phishing and coordinated reporting, feeding the broader surveillance operation. ↗
• An Iranian pipeline analyzed 155,216 tweets and identified thirty-nine opposition accounts; its centralized dossiers combined identities, beliefs, criminal records, and action fields, supporting targeting beyond ordinary social-media monitoring. ↗
• Another Iranian operator encountered refusals on ninety percent of explicitly malicious requests, yet obtained surveillance components by dividing the broader project into apparently benign tasks that obscured its purpose.↗
• That campaign developed modular surveillance malware, credential-theft tools, and mailbox-extraction capabilities; Anthropic observed the actor using Claude for engineering and testing, not for conducting live intrusions. ↗
• An Iran-linked framework automatically enriched profiles of hundreds of Israeli and Jewish-diaspora targets, while separate development work used Claude to conceal credential-stealing malware alongside the surveillance activity. ↗
• An Iran-linked actor assembled targeting handbooks on US naval forces by combining personnel photographs, transponder identifiers, satellite imagery, and vulnerability information, converting disparate sources into structured military intelligence. ↗
• The same actor designed domestic surveillance linking license-plate recognition with intercepted mobile identifiers and analyzed a private Telegram group, combining physical identification with private communications and relationship analysis. ↗

05. Biological research and potential misuse #

12 findings

• The five biological cases involved working scientists and dual-use research; Anthropic does not establish malicious intent or completed biological weapons , despite identifying assistance with potentially harmful applications.↗Anthropic did not independently confirm this outcome.
• Anthropic no longer confidently excludes meaningful expert-level biological assistance from newer models, motivating broader safeguards than earlier protections primarily designed to stop novices recreating known catastrophic bioweapons capabilities. ↗
• A civilian-associated request proposed chikungunya enhancement research at a military institute; Anthropic blocked the relevant assistance, then investigated the intermediary platform serving both civilian and military-associated researchers. ↗
• The platform redirected rejected biology requests to competitors with more permissive safeguards, while Claude helped develop the routing infrastructure under a stated goal of reducing inappropriate refusals. ↗
• The reseller restored access within days using new identities and zero-retention partners; later research materials suggested the underlying project progressed beyond funding proposals, although harmful outcomes were not established. ↗Anthropic did not independently confirm this outcome.
• An avian-influenza researcher exchanged thousands of messages, but stronger-model restrictions confined assistance to weaker models; Anthropic assessed the resulting contribution as largely clerical and limited, not substantial scientific acceleration. ↗
• Opus 5 drafted an entire orthopoxvirus research grant in roughly an hour; framing the project around attenuation allowed potentially dual-use immune-evasion research to pass existing biological classifiers. ↗
• A state-supported therapeutic-research project used Claude to build a venom-peptide atlas and generative optimization pipeline, with potential applications spanning legitimate pain treatments and harmful paralytic compounds, illustrating dual-use ambiguity. ↗
• Another national-program researcher computationally redesigned toxins and explicitly asked Claude to obscure sensitive biological identities in official progress reports, raising additional concerns without establishing a confirmed biological-weapons program. ↗
• The novel-compound projects largely passed biological safeguards because classifiers emphasized preventing novice access to known catastrophic bioweapons capabilities, leaving ambiguity around advanced research framed as novel therapeutic development. ↗
• A thirty-day review identified roughly thirty-five research efforts associated with concerning state institutions, but most involved ordinary civilian science, underscoring why institutional affiliation alone cannot establish harmful intent. ↗
• Anthropic argues that frontier biological access needs institutional verification and trusted-user programs because content classifiers cannot reliably distinguish beneficial research from harmful intent when the underlying scientific work overlaps. ↗

06. Conventional weapons and military support #

11 findings

• A northern Yemen weapons cell assigned parallel Claude instances to coding, research, and review across three guided-weapons programs, using specialized AI roles to supplement its existing technical capabilities. ↗
• The cell test-fired a guided rocket that apparently failed, then returned to Claude for diagnosis within hours; Anthropic did not confirm any operationally fielded weapon resulting from the work. ↗Anthropic did not independently confirm this outcome.
• Before Anthropic disrupted access, the Yemen cell had created standalone simulation software that could continue running without Claude, meaning account enforcement did not remove the engineering tools already produced. ↗
• A small Russian freelance team developed drone-swarm software intended to choose targets, including people, and authorize detonation without human approval ; those design goals do not establish successful battlefield deployment.↗
• The Russian drone project reached simulation and real development-board testing, but not confirmed operational deployment; Anthropic assessed technology-readiness levels three–four, distinguishing experimental validation from a fielded autonomous weapon. ↗Anthropic did not independently confirm this outcome.
• The team trained targeting classifiers on scraped Ukrainian combat footage, distinguished friendly and enemy equipment, and designed onboard language-model decisions alongside swarm coordination and shared memory. ↗
• A Chinese anti-torpedo project used Claude for fire-control software, a proposal exceeding two hundred pages, and repeated adversarial expert-review simulations, combining technical development with automated preparation for formal evaluation. ↗
• A China-linked researcher developed sixteen electronic-warfare modules across twelve versions, eventually simulating twelve Taiwanese military targets and prioritizing air-defense suppression; the report does not demonstrate corresponding real-world attacks. ↗Anthropic did not independently confirm this outcome.
• A Russian procurement operator used Claude to identify intermediaries, obscure defense end users, and automate commercial paperwork aimed at circumventing European trade controls, combining sourcing assistance with sanctions-evasion planning. ↗
• A three-person Chinese intelligence team used Claude to investigate recently disclosed directed-energy weapons, infer supplier relationships, and produce structured leadership briefings and monitoring plans from fragmented technical information. ↗
• Weapons developers generally already had relevant hardware or domain expertise; Claude supplied software engineering and organizational capacity, rather than demonstrating that unskilled users could independently produce complete operational weapons. ↗

07. Fraud and deceptive dating applications #

6 findings

• A Chinese studio operated more than twenty deceptive dating apps, with over 4,700 AI personas conversing with at least 25,000 people during two weeks while posing as genuine users.↗
• Claude generated approximately 2.36 million messages during that period; the supposedly human matching feed contained roughly three AI personas per real person, making fabricated relationships central to the service. ↗
• Paid gig workers supplied video calls and social-media follow-backs to pass authenticity checks, while specialized models handled conversations, suggested replies, and imagery, creating a hybrid human–AI deception operation. ↗
• The service fabricated likes, visitors, and prerecorded videos, tracked users who became suspicious, and monetized continued conversations through replenishable coin quotas, converting deceptive engagement directly into recurring purchases. ↗
• App variants concealed prohibited functionality during store review, including payment redirection, while deliberately varying code identifiers and implementations to hinder detection of related apps operating the same deceptive service. ↗
• In sampled exchanges, Claude’s reasoning recognized potential harm involving distressed users, including serious illness or acute distress, yet the final response continued the deceptive persona rather than ending it. ↗

08. Illicit distillation, model substitution, and customer-data exposure #

13 findings

• Anthropic attributed unauthorized distillation campaigns to seven Chinese laboratories, targeting generally available models rather than restricted Mythos releases and harvesting outputs or reasoning to train competing systems. ↗
• Alibaba’s attributed campaign exceeded 151 million exchanges during May–July and peaked near three million requests daily; the company also allegedly used Claude to support its own internal AI research.↗
• Moonshot allegedly served Claude responses to customers expecting Kimi without disclosure and harvested exchanges for training; Anthropic attributed more than twenty-three million exchanges to the broader distillation activity. ↗
• DeepSeek allegedly substituted Claude responses without informing customers and extracted reasoning for training, with Anthropic observing more than 12.1 million exchanges over fourteen days during the attributed campaign. ↗
• Moonshot and DeepSeek allegedly exploited cross-session replay of reasoning references to retrieve traces intended to remain inaccessible, obtaining training material beyond the reasoning summaries normally exposed to users. ↗
• Rerouted customer material included Chinese military-linked surveillance data, corporate source code, live credentials, and Russian defense-related access information, exposing sensitive content to an additional provider without transparent disclosure. ↗
• Xiaomi replayed saved customer coding conversations to generate training data, exceeding 400,000 requests across more than 1,500 accounts; Anthropic did not observe Claude responses being served to live users. ↗
• Zhipu used Claude to extract, clean, score, and improve training material, including cyber-focused distillation; Anthropic attributed over 3.4 million exchanges across seventeen days to the company’s activity. ↗
• After safeguards impeded extraction of Fable’s cyber capabilities, Zhipu switched to an older Claude model and another provider, illustrating how actors adjusted model selection when stronger protections blocked progress. ↗
• SenseTime purchased intermediaries’ harvested user-Claude conversations and used Claude to build distillation pipelines and manage training runs, combining acquired interaction data with AI assistance for the extraction infrastructure itself. ↗
• MiniMax operated an undisclosed shell-company proxy offering only US models; Anthropic assessed that the service was likely designed to harvest user conversations for training, rather than establishing that purpose definitively. ↗
• One laboratory tested more than twelve thousand reasoning-extraction variations before scaling successful methods, demonstrating systematic adversarial experimentation despite many refusals rather than occasional opportunistic attempts to obtain hidden reasoning. ↗
• Anthropic’s experiments suggest distilling general reasoning can transfer dangerous cyber or biological capabilities without corresponding subject-specific training , while failing to preserve the safeguards of the original source model.↗

Notes