AI didn't give attackers new tricks. It gave them a new budget.
14th September 2026What Anthropic's latest report reveals about AI-powered cyber risk
by Dan Pasmore, Senior Underwriter and Technical Lead
Anthropic just published its September 2026 threat intelligence report, a look-back at the previous eight months (December 2025 to August 2026) of real attackers caught using its Claude models and then shut down. I’ve read the report. It's long, it's dense, and it's one of the more useful documents to land in cyber security this year.
Here's what I think matters, why it validates existing thought that has been in the market for a while, , and where I think the cyber industry needs to go next.
The line that matters most
Deep in the cyber operations section of their report is a sentence worth putting on a wall - none of the attacks Anthropic documented relied on a brand-new technique that defenders had never seen before. Stolen credentials, unpatched edge devices, phishing, SQL injection… all very familiar. What changed in the attacks isn't the how. It's the economics.
Reconnaissance, tool development, malware iteration, and data processing, the labour that used to separate a nation-state's operation from a lone operator's has been delegated to AI, running in automated pipelines at machine speed and in parallel. The result isn't more exotic and complex attacks. It's more attacks, run faster, by fewer people, at a fraction of the cost.
That's the story of this report in one sentence: sophistication has stopped being a reliable signal of who's behind an operation.
The labour gap has collapsed
A few case studies presented make this concrete:
- A hacktivist working alone built a purpose-made doxxing platform, ingestion pipelines, cross-referencing against breach dumps, ranking logic, the works and loaded it with tens of millions of records, including national health identifiers, to target European political figures. One person. No team.
- Two Chinese university students, one with a security-industry internship on his résumé, ran a parallel operation that combined live intrusion attempts, foreign-government reconnaissance, and an always-on vulnerability research pipeline that reverse-engineered firmware. It produced more than a dozen candidate zero-days in a single month.
- A cluster of financially motivated operators tied to the ShinyHunters collective ran credential-harvesting pipelines across cloud infrastructure, downloaded and decompiled 1.8 million Android apps hunting for hardcoded secrets, and in one case went from a single stolen developer token to full administrative control of a victim's cloud environment in roughly three hours.
None of these are state intelligence services. They're a small number of people using AI in place of the workforce they don't have. Anthropic's own framing is blunt: “the main thing separating a criminal from a state actor these days isn't capability anymore, it's intent.”
From assistant to orchestrator
The most unsettling shift in this is autonomy. In the case Anthropic attributes to the Russian group tracked publicly as Midnight Blizzard, the actor didn't just use AI to write phishing emails. They built AI-driven workflows that monitored their own malware in the wild, and when a security product flagged it, the workflow automatically rewrote and redeployed it until it evaded detection again. That's a closed loop that used to cost defenders very little to win, publish a signature, force the attacker back to the drawing board. AI collapses that redraw time toward zero.
This isn't just Anthropic's telling of the situation either. Microsoft's own threat intelligence team independently published a report detailing their findings on a related campaign - they call it ‘CaptiveCrunch’ – describing an actor group compromising hotel and conference Wi-Fi to redirect travellers into credential-stealing malware, with Microsoft explicitly noting the actor was leveraging AI to support a significant portion of these operations. Two independent vendors, converging on the same conclusion, is a stronger signal than either report alone.
The AI supply chain is now the target
One of the more novel findings was how attackers aren't just using AI but they are also stealing user access to it. Anthropic documented a group that compromised an AI vendor's own evaluation sandbox to steal production API keys, then used those stolen keys to run further attacks against roughly 30 other AI companies in about four days. Separately, fraudulent "cheap Claude access" resellers have sprung up whose actual business model is harvesting the credentials of anyone who signs up.
A stolen AI credential gets an attacker three things at once: free compute, resale value and credibility - because the activity gets attributed to the legitimate account holder. That makes API keys and session tokens a target class worth guarding the way you'd guard production database credentials, not a minor operational detail.
Surveillance built in days, not years
The part of Anthropic’s report that should worry policy and civil-society audiences as much as security teams is their statement that building a mass surveillance capability no longer requires the budget of a major intelligence service. Anthropic disrupted a national-scale interception platform, nicknamed ‘Lakana 360’, that was built for Mali's state intelligence service to analyse communications across roughly 25 million mobile SIM cards, all engineered by essentially a single consultant. In parallel, it shut down Iranian-nexus actors building their own surveillance tooling and a malicious browser extension, and multiple Chinese security-bureau operations that used AI to compress what used to take a roomful of analysts into a much smaller team, including one bureau that generated thousands of investigative briefs on dissidents, religious minorities, and protest movements in under a month.
Different governments, wildly different resource levels, same underlying pattern. AI took a capability that used to require a well-funded, well-staffed program and put it within reach of a handful of people.
My take: this is self-propagating ransomware with a bigger toolbox
I keep coming back to comparing AI-driven attacks to self-propagating ransomware. Both are fast, and both punish defenders who rely on static rules. But ransomware worms had one entry vector and one propagation method, nasty, but at least predictable once you'd seen it. What Anthropic is describing is the same speed and now with many entry vectors and many propagation paths, changing per target, per session, sometimes per hour. The vectors used to be static. Now they're dynamic.
That has a direct implication as prevention on its own will fail. Not because controls are bad, but because an adversary that can regenerate its tooling every time you block it will eventually find the gap. The Midnight Blizzard case is a working demonstration of exactly that loop.
What can work is fighting speed with speed. Detection that mutates, rotating hunts, varying detection logic, running multiple parallel rule sets instead of one static signature, is achievable with the same class of technology attackers are using. So is containment and eradication at machine pace. The tools are not out of reach as it's the same agentic tech but pointed the other way, and with one real advantage. Defenders know their own environment. That home-field advantage is the thing worth building the next few years of security investment around.
The bottom line
Nothing in Anthropic’s report should make anyone believe AI is inventing new categories of attack. The report is providing CISOs and policymakers qualifiable case studies to benchmark detection and defense investments against, rather than hypothetical risk scenarios. The report is showing us how, in relatively simple use, AI is compressing the cost, skill, and time required to run the attacks that we already know about, and it's doing that for state actors, criminal crews, and lone individuals alike, in roughly equal measure. To be able to keep up, organisations need to treat this as a speed problem, not just a tooling problem.
If you'd like to discuss the practical implications for your clients or organisation, Dan Pasmore would welcome the opportunity to share his perspective.
Anthropic, “Detecting and countering misuse of AI: September 2026”, published September 10, 2026.
Corroborating detail on the Midnight Blizzard/CaptiveCrunch campaign from Microsoft Threat Intelligence, July 31, 2026.