So, Anthropic's September threat report will likely spawn a host of deeply unsettling headlines that play to the narrative laid down by Jacob Coxon, the former company researcher who quit with a warning about the growing dangers of AI.
We won't regurgitate the narrative. What we've done here is forensically assessed the latest self-reporting to discern trends, directions of travel.
And the headline conclusion is this: AI has moved from assistant to orchestrator.
Covering activity disrupted between December 2025 and August 2026, the report runs across seven harm areas and reads less like a catalogue of clever prompt tricks than an account of what happens when the labour that used to separate serious threat actors from amateurs becomes available on subscription.
The attacks themselves are routine, familiar in the world of cybersecurity. Stolen credentials, unpatched edge devices, exposed services, SQL injection, phishing.
Anthropic tells us that none of the operations it disrupted depended on a technique defenders have never seen.
What actually changed is the economics.
So, what to I mean by that? Reconnaissance, exploitation, tool development and data processing are now delegated to models running in harnesses at machine speed and in parallel, which compresses the cost side of an attacker's calculation while leaving the payoff untouched.
For example, one breach of an enterprise software company took hours from first access to bulk data theft.
Another escalated from a single stolen developer token to full administrative control of a cloud environment in roughly three hours.
A session-store dump yielding more than 2,100 Azure AD token sets across more than 40 corporate tenants took about 34 hours, with AI agents doing nearly all the work.
Sophistication is no longer a signal
The consequence for anyone trying to attribute an attack is uncomfortable.
A French-speaking hacktivist running on stolen API keys, a loose crew harvesting credentials from 1.8 million decompiled Android apps, and a Russian state espionage operator all displayed broadly similar methodology across the period.
Each ran multi-victim campaigns using agentic AI that would previously have needed teams of skilled operators.
Anthropic's conclusion is that the distinguishing feature between state and non-state actors is no longer capability but intent.
The single hacktivist case is the most worrying illustration.
Working alone, the actor built "fafsearch", a purpose-built doxxing platform with ingestion pipelines, cross-referencing against breach dumps, normalisation for national identity numbers, ranking logic, tests and containerised deployment.
Tens of millions of rows went in, including national health identifiers and material from justice system breaches, fused with data from the actor's own intrusions.
The result was published as anonymously hosted dark-web services where anyone affiliated with a targeted political movement could be looked up by name.
That platform was the work of one person.
Worrying direction of travel
Where AI substitutes for an engineering workforce, the outputs become considerably more serious than data theft.
- A consultant in Bamako used Claude to design a platform intercepting communications across all three of Mali's mobile networks and roughly 25 million SIM cards, with the warrant requirement stripped out of the dossier-generation component at the operator's request.
- A cell in northern Yemen used Claude Code as its software team on three weapons programmes and test-fired a guided rocket.
- A freelance Russian group built a drone swarm whose onboard model could select a target from a class that included "person" and order detonation without human involvement.
- A Chinese defence researcher built an electronic warfare and air defence suppression suite, then set its default scenario to a dozen sites in Taiwan.
Enforcement in these cases is partial by design. Banning an account stops the design work, not the deployed product.
The Malian platform runs on-premises with local models, and the Yemeni cell had already compiled its simulation toolkit into a standalone executable.
Surveillance
The surveillance chapter documents something subtler. AI is being absorbed into the daily routine of state security bureaucracies.
- One Chinese state security bureau wrote an internal manual instructing colleagues how to prompt Claude to role-play as an intelligence analyst serving the national security apparatus.
- Two Iranian units, sharing neither code nor personnel, independently solved the same usability problems in the same state surveillance case management system.
- A single operator ran what amounted to a religious affairs intelligence desk, producing templated Chinese-language dossiers on Catholic cardinals, Presbyterian leaders in Taiwan, Tibetan Buddhist civil society and Falun Gong practitioners, each noting the target's exploitable leverage.
The influence operations chapter details nine cases spanning six continents, several timed to national elections.
Worth noting is that models were used to build the apparatus, not just the content: doctrine manuals, persona systems, target databases, scoring rubrics, and in one Russian-run operation in the Central African Republic, employment contracts mandating staff loyalty to Russia and its contingent.
Most of this content reached almost nobody, because Anthropic sits upstream of the platforms and often catches operations mid-construction.
The exception is telling: the widest genuine reach came where established state media outlets, including FM radio and global television, provided the distribution.
Anthropic's ask
Two admissions stand out. The first is on biology, where the company has broken an industry-wide silence to publish five cases of research that could support weapons development, and concluded that classifiers alone cannot distinguish beneficial from harmful work in dual-use science.
Its answer is trusted user programmes with verified institutional identity and enough data retention to spot misuse.
The second is on safeguard performance, which the report concedes was uneven.
Claude refused nine of ten facially malicious requests from one Iranian actor, but performed less consistently once the work was fragmented across smaller sessions.
In a Chinese stability maintenance case, a correct refusal was overturned on re-prompting, and in another the model complied across many sessions without intervention.
Anthropic's broader message to the industry is that AI keys, sandboxes, proxies and agent integrations are now part of the corporate attack surface, and should be defended like production credentials.
The criminals reached that conclusion some time ago.
