Summary
- Anthropic’s first major misuse report documents seven categories of harm observed between December 2025 and August 2026, spanning espionage, cybercrime, influence operations, and more.
- A Russian-aligned actor targeting over 20 Ukrainian and European government and defence organisations used AI agents to autonomously rewrite malware whenever security products flagged it.
- Two Chinese undergraduates running an AI-powered vulnerability research workflow produced more than a dozen potential zero-day findings in a single month.
- ShinyHunters affiliates used AI to dump over 2,100 cloud access tokens across 40 corporate tenants in roughly 34 hours; one intrusion moved from a stolen developer token to full cloud environment control in about three hours.
- Anthropic also identified seven Chinese labs — including Alibaba, DeepSeek, and Moonshot AI — conducting large-scale distillation attacks to harvest Claude outputs for training their own models, in some cases re-routing customer queries to Claude without user consent.
Sophistication is no longer a reliable attribution signal
For decades, the complexity of a cyberattack served as a rough guide to who was behind it. Sophisticated tooling and operational security pointed toward nation-state resources; crude intrusions suggested amateurs. Anthropic’s newly published threat report challenges that assumption directly. Covering activity observed between December 2025 and August 2026, the report documents how AI has compressed the capability gap to the point where a single hacktivist operating on stolen API keys, a pair of university students, and a state-linked espionage operator each ran campaigns that, in the report’s own words, “would have required many skilled operators and specialist knowledge” just a year earlier.
Russian-aligned espionage: autonomous malware regeneration at scale
The most operationally significant case centres on an actor using the handle “JackPoterz,” whose behaviour Anthropic aligns with Russian state espionage and patterns associated with Midnight Blizzard. The actor deployed a custom toolkit covering Windows implants, a mobile exploitation kit, a browser credential stealer, and a phishing platform built to mimic government entities. What sets this campaign apart is what happened when defences flagged the malware: AI agents autonomously modified and rebuilt it to evade detection. The actor also bulk-exported mailboxes from drone component manufacturers, recovered the architecture of an unannounced product from a stolen software development kit, hijacked DNS at hotel Wi-Fi vendors to reach guests, took over WhatsApp accounts via headless browsers, and exfiltrated more than 300,000 national identity records from a North African government agency. More than 20 government and defence organisations across Ukraine and Europe were affected.
Chinese undergraduates and the automated exploit foundry
A separate cluster of activity, partly attributed to undergraduates at a Chinese university, illustrates how AI reshapes vulnerability research timelines. The operators used Claude to run agent swarms — a lead agent distributing tasks among parallel subagents — working around the clock on network appliance firmware analysis. One workflow alone yielded more than a dozen potential zero-day findings in a single month. The system maintained campaign memory between sessions, allowing sustained research that would otherwise demand a sizeable specialist team.
ShinyHunters affiliates: cloud compromise in hours, not weeks
Clusters linked to the ShinyHunters criminal collective demonstrate how AI compresses criminal timelines at the operational end. One supply-chain breach culminated in a dump of more than 2,100 Azure access tokens spanning more than 40 corporate tenants in approximately 34 hours, with AI agents performing nearly all of the work. A separate intrusion moved from a single stolen developer token to full control of a victim’s cloud environment in roughly three hours. For security teams accustomed to thinking in terms of dwell time measured in days or weeks, these timelines represent a meaningful shift in incident response expectations.
Distillation attacks: a quiet data exposure risk
Beyond active intrusion campaigns, Anthropic’s report addresses a category of misuse with direct implications for enterprise data governance. The company identified seven Chinese AI laboratories — including Alibaba, DeepSeek, Moonshot AI, Xiaomi, and Zhipu — conducting what it terms distillation attacks: using large volumes of Claude interactions to train their own models. Alibaba’s operation peaked at nearly three million exchanges per day from more than 3,500 fraudulent accounts, harvesting Claude Opus outputs to improve its Qwen systems, drawing on interactions from users who were unaware their data was being used. Moonshot and DeepSeek went further, silently forwarding their own customers’ queries to Claude and returning its answers as their own. Among the intercepted data was surveillance footage of a tracked individual, submitted by a user Anthropic believes was affiliated with the People’s Liberation Army. The report notes these practices are “likely inconsistent with privacy laws and the labs’ own terms of service.” Earlier this week, a joint advisory from the NSA, CISA, and the FBI separately accused Chinese AI companies of systematically distilling US frontier AI models.
Disclosure framing and the limits of obscurity
Anthropic was deliberate in its decision to publish. The report frames these cases not as typical misuse but as the most notable and novel activity identified to date, shared to give defenders an accurate picture of how these threats develop. The company said it disrupted each operation, strengthened its safeguards, and shared intelligence with authorities and industry partners where appropriate. Its conclusion is direct: “The old idea of ‘security through obscurity’ is no longer viable in this new AI-assisted world: everything connected to the internet is a potential target for exploitation.”
Why it matters
For CISOs, this report reframes two foundational assumptions. First, attack sophistication can no longer be used to infer the resources or identity of a threat actor — a single individual with AI access can now mount what looks like a state-level campaign. Second, the timelines for cloud compromise and credential exploitation have shortened dramatically; detection and response programmes calibrated to traditional dwell times may be structurally inadequate. The distillation findings also raise a third concern: enterprise data submitted to third-party AI services may be silently re-routed and exposed in ways users and their organisations never agreed to, with potential privacy law implications.
What to do now
- Review cloud access token hygiene and rotation policies, particularly for developer and service account tokens with broad tenant permissions, given demonstrated three-hour compromise-to-full-control timelines.
- Reassess incident response runbooks to account for significantly compressed attacker timelines in cloud environments — the assumption that defenders have days to respond may no longer hold.
- Audit which AI services your organisation and its supply chain are using, and evaluate whether those services have transparent data handling practices; the distillation findings show that user data can be re-routed without consent.
- Do not rely on malware detection as a stable defensive signal — the report documents AI agents autonomously regenerating malware to evade detections in near-real time, which undermines signature-based controls.
- Brief threat intelligence teams that campaign sophistication is no longer a reliable indicator of actor type or state sponsorship when assessing attribution.
