Anthropic publishes a threat intelligence report on how it disrupted efforts to misuse Claude for cyberattacks, influence operations, surveillance, and more

Sophisticated cyberattacks can now be launched with less specialized skill, directly from your current software.

Anthropic has released a threat intelligence report detailing its efforts to counter malicious use of its AI models, specifically Claude. The report, covering the period from December 2025 to August 2026, outlines disrupted operations across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation. Anthropic identified threat actors, including suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, and politically motivated individuals, attempting to leverage Claude for harmful activities. The company disrupted these operations, enhanced its safeguards based on learned intelligence, and shared findings with relevant authorities and partners. The report highlights a trend where AI capabilities lower the barrier to entry for sophisticated attacks, enabling less skilled actors to conduct multi-victim campaigns with increased speed and scale. Claude Haiku, Sonnet, and Opus models were implicated in these misuse cases, with limited involvement from Fable and Mythos models.

The report underscores a significant shift in cyber operations, where AI models are democratizing sophisticated attack capabilities. Previously, complex operations required substantial human expertise and resources, creating a clear distinction between state-sponsored actors and individual threat actors. However, AI has collapsed this gap, enabling less resourced entities to orchestrate multi-victim campaigns with speed and scale previously unattainable. This fundamentally alters threat intelligence, making sophisticated attack patterns less indicative of the actor's true capabilities or origins, and demanding a re-evaluation of how cybersecurity defenses are built and maintained.

Anthropic's findings suggest that the AI-driven uplift in offensive cyber capabilities is pervasive across the entire cyber kill chain, from reconnaissance to exploitation and data exfiltration. The automation facilitated by AI, including multi-agent frameworks and self-modifying malware, allows threat actors to operate with unprecedented autonomy and adaptability. This necessitates a move beyond traditional signature-based defenses towards more dynamic and resilient security architectures capable of detecting and responding to AI-augmented threats in real-time.