Anthropic’s September 2026 Threat Report: What It Revealed About Claude Misuse

Anthropic’s September 2026 threat-intelligence report offers a detailed look at misuse its team says it detected and disrupted over eight months. Its most consequential finding is not that AI created entirely new categories of harm; it is that models can increasingly support and coordinate steps that once demanded more specialist time, labor and technical capacity. 13

Seven areas of alleged misuse

The report covers activity disrupted between December 2025 and August 2026 in seven areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional-weapons development, and illicit model distillation. 15

Anthropic said the cases involved Claude Haiku, Sonnet and Opus. It said none involved its Fable or Mythos-class models, other than one illicit-distillation case—an attempt to copy model capabilities. 35

The cases reportedly involved a mix of suspected state-sponsored actors, financially motivated criminals, spyware vendors, propaganda operations and politically motivated groups. That breadth matters: the report presents AI misuse as a cross-sector problem rather than one confined to traditional cybercrime. 1

Cyber operations: from assistance toward coordination

The report’s cyber cases are its clearest warning about increasing operational autonomy. Anthropic described models being used for tasks beyond code explanation or content drafting, including planning workflows, reconnaissance, handling stolen information and supporting intrusion or extortion activity. 1

Its discussion of activity attributed to Midnight Blizzard and suspected ShinyHunters affiliates illustrates the claim. Anthropic linked Claude-assisted activity to intrusions affecting Ukrainian, European and drone-supply-chain targets, as well as alleged mass theft of payment-card and passenger data. These labels and operational conclusions are Anthropic’s assessments, however, and should not be read as independent proof of every actor’s identity or outcome. 1

The broader implication is practical: AI can reduce the time and coordination burden of an attack. That does not eliminate the need for access, infrastructure, operational judgment or human intent—but it can make sophisticated workflows easier to assemble and run.

Biological misuse: serious requests, not proof of a weapon

Anthropic also reported attempts to obtain help related to chikungunya gain-of-function research, mammalian adaptation of highly pathogenic avian influenza, and live orthopoxvirus research. These are highly sensitive dual-use research areas, where legitimate scientific questions can overlap with knowledge that could be misapplied. 1

The crucial distinction is between an attempted request for assistance and a completed biological program. The report describes attempted misuse that Anthropic says it disrupted; it does not establish that a biological weapon was made or that the proposed research was carried out. 1

How Anthropic said it responded

Anthropic said it strengthened safeguards, banned accounts, disrupted associated infrastructure and shared threat indicators and lessons with relevant technology companies and government authorities. It also said it released indicators of compromise to help defenders identify related activity. 1

Those actions reflect an increasingly familiar role for AI providers: they are not only building models, but also monitoring for abuse, deciding when access should be removed and coordinating with outside defenders.

What the report can—and cannot—show

The report is valuable as a casebook of incidents Anthropic says it found. It is not a prevalence study of AI-enabled abuse across the internet or across other model providers. A collection of disrupted cases cannot tell readers how common each category of misuse is, how much activity went undetected or whether use of AI materially changed the final outcome of every operation. 13

That limitation should shape the governance debate. Companies need the ability to interrupt credible abuse quickly, especially in cyber and biological contexts. But safety decisions about monitoring, access restrictions, account terminations and disclosure also carry consequences for privacy, due process and public accountability. The report therefore strengthens the case for clear rules, meaningful external scrutiny and coordination that does not leave high-stakes judgments solely to any one company.

Bottom line

Anthropic’s report documents a wide range of attempted Claude misuse, from cyber intrusions and fraud to surveillance, weapons-related work and sensitive biological research. Its central warning is that AI can help attackers organize more of an operation with fewer resources. Yet the evidence remains bounded: these are detected and disrupted cases, and the report should be read as a signal of evolving risk—not a census of all AI-enabled threats. 13