Anthropic's Threat Intelligence team disrupted operations across seven harm areas between December 2025 and August 2026, publishing the findings to help other developers, governments, and civil society recognize emerging threats. The report details how malicious actors used Claude Haiku, Sonnet, and Opus models for cyber operations, influence campaigns, surveillance, fraud, and more. For IT and security professionals, the cases reveal a critical shift: AI is no longer just an assistant for attackers - it is becoming the orchestrator.
AI tradecraft is proliferating across all threat actors
The main distinguishing feature between classes of actors is no longer sophistication but intent. Previously, state-sponsored groups used greater resources to deploy advanced cyber capabilities. The advance of AI provides non-state actors access to the same capabilities. "Diffusion is occurring across different classes of threat actors, different regions, and different types of mission," the report states. "The capabilities described in this report should be assumed to be available to any actors who are motivated to use them."
None of the operations depended on an entirely novel technique that defenders have never seen. The labor that once set well-resourced operations apart - reconnaissance, exploitation, tool development, and data processing - is now delegated to AI models running at machine speed. A single French-speaking actor was observed in spring 2026 using Claude to target European political parties, media, think-tanks, and their SaaS providers. One person built an entire attack platform using AI-assisted software engineering.
From engineering assistant to autonomous operator
The report documents a wide spectrum of autonomy. At the lower end, actors used Claude conversationally as an engineering assistant to create malware, phishing kits, and surveillance tools. Further along, threat actors directed Claude to execute operations - running commands against victim networks, harvesting credentials, and exfiltrating data - with a human making each targeting decision. Several of the most serious compromises came from operations where a human directed every step, but the AI handled the execution.
Anthropic uses the term "uplift" to measure the AI capability boost through speed, scale, and depth. The most commonly recurring targets were members of the Ukrainian government, military, and diplomatic staff. The actor scanned email services and remote access systems across more than two dozen Ukrainian government organizations. Access to an exposed API removes the barrier to entry for a rogue actor, a pattern seen repeatedly across the case studies.
Specific harm areas and model usage
The disrupted activity covered cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. Threat actors included suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals. Cases ranged from a network of fake dating apps designed to defraud users to surveillance systems built to identify and monitor dissidents.
Claude Haiku, Sonnet, and Opus models were used in the misuse cases. The report notes that no misuse involved Claude Fable or Mythos-class models, with the exception of one illicit distillation case. Malicious actors also use or purchase discounted access to frontier AI models through the broader criminal economy.
Why this matters for IT and development professionals
The report's findings carry direct implications for those building and defending systems. Sophistication has stopped being a reliable signal of who is behind an operation - every layer of offensive operations has been uplifted by AI. For teams monitoring AI for IT & Development, the takeaway is clear: detection strategies must account for adversaries who can now automate reconnaissance, tool development, and data processing at speeds previously reserved for state-sponsored groups.
Security practitioners working in threat intelligence or incident response should study the operating model documented in case study GTG-20006, which describes an autonomous attack campaign. As models continue to improve, more actors - from lone wolves to sophisticated groups - will adopt these capabilities. The AI for Cybersecurity Analysts learning path addresses the skills needed to counter these evolving threats. Anthropic said it will continue sharing intelligence with private- and public-sector partners, and the report is designed to help other developers recognize similar patterns on their own platforms.
Your membership also unlocks:
