Anthropic Says Claude Was Used for Cyberattacks, Espionage and Weapons Work
Anthropic disrupted a series of operations in which suspected state-sponsored groups, financially motivated criminals and politically motivated individuals used Claude to support cyber operations, espionage and weapons-related work.
The findings appear in a September 2026 report titled "Detecting and countering misuse of AI: September 2026". Anthropic said its Threat Intelligence team identified and disrupted the activity in the six months prior to the report. The cyber cases covered span December 2025 through August 2026. Anthropic
The report covers seven areas of harm ranging from cyber operations to biological misuse. Influence operations and surveillance are listed among the seven. Anthropic also documented disruption of bioweapons research efforts involving Claude, as well as Russian hacking activity and Chinese misuse of Claude models. Reuters Separately, Anthropic said several actors had used its Claude AI models for activities including weapons, spying and cyber operations. Reuters
For tracking, Anthropic uses Generative Threat Groups (GTGs) as internal designators for actors observed abusing AI. It defines uplift as the AI capability boost, or how much more harm was caused with AI versus without AI, viewed through speed, scale and depth.
Autonomous operations become standard
In November 2025, Anthropic documented an operating model used by a suspected state-sponsored campaign to carry out autonomous attacks. In the September 2026 report, it assessed that the model had proliferated across every class of actors investigated.
The timeline is compressed. Publicly available offensive agent frameworks like PentAGI reproduce much of the same scaffolding for automating each step of the cyber kill chain. Anthropic assessed that more actors, from lone wolves to organized entities, will continue to adopt AI frameworks to enable more sophisticated cyber attacks at greater speed and scale as models evolve.
That assessment builds on earlier disclosures. Anthropic published a report titled "Disrupting an AI-orchestrated cyber espionage campaign" about a sophisticated AI-led cyberattack and its disruption on Nov. 13, 2025. Its August 2025 Threat Intelligence report discusses Claude misuse cases including a large-scale extortion operation. Anthropic
Models, safeguards and disruption playbook
In all cases in the September 2026 report, Claude Haiku, Sonnet and Opus models were used. No malicious activity was found on Claude Fable or Mythos. Anthropic said Claude Mythos has safeguards in place that greatly reduce its ability to perform harmful cyber tasks.
Anthropic announced Claude Fable 5.1 and Claude Mythos 5.1 on Sept. 1, 2026. It described the releases as its most advanced models for coding and knowledge work.
In each disrupted case, Anthropic said it disrupted the activity, strengthened AI safeguards based on what it learned, and shared intelligence with authorities and industry partners where appropriate. The formula is consistent. Detection leads to account-level action, then to control updates informed by observed tactics.
Geopolitical fallout
The attributions carry diplomatic weight. Disruption notices involving Russian and Chinese activity, plus bioweapons-related research, place a commercial AI safety report inside state-level competition over capabilities and norms.
A Chinese state newspaper branded Anthropic CEO Dario Amodei's call to slow AI development a "Cold War playbook" targeting China. Reuters
The broader context here is the collision between incident reporting and strategic narrative. Threat intelligence designators like GTGs are built for internal tracking and cross-industry sharing. Once they surface alongside country names and weapons-related claims, they are read in capitals as political signals, regardless of technical intent.
In my view, the operational detail matters more than the labels for practitioners. The shift from human-operated prompting to autonomous scaffolding changes cost structures for intrusion, reconnaissance and payload development. Speed compresses defender reaction time. Scale allows smaller teams to run parallel campaigns. Depth extends reach into later stages of the kill chain that previously required specialized skill.
Looking at what this means for defense, the report points to three priorities. First, detection must account for agent frameworks, not only single-model prompts. Second, safeguards tuned to Haiku, Sonnet and Opus abuse patterns may need revalidation with each capability jump, including Fable and Mythos lineage systems. Third, sharing with authorities and industry partners will shape whether similar autonomous tooling is caught early elsewhere or encountered as a novel intrusion set.
The open question for the next reporting cycle is adoption rate. Anthropic expects continued uptake of AI frameworks across actor types. Whether safeguards, information sharing and law enforcement disruption slow that curve will determine if autonomous operations remain an advantage for well-resourced teams or become baseline tradecraft.
