Anthropic’s New AI Threat Report Is One of the Strangest Documents in Tech

2 headlines landed from the biggest US AI labs inside 48 hours, and they could not have been more different in mood. OpenAI said a swarm of roughly 10,000 agents produced a machine verified result on the Navier Stokes problem, one of the 7 Millennium Prize problems, in 88 hours. Anthropic, meanwhile, published a 154 page document cataloguing the people who tried to use its product to hurt other people.

I read the whole thing. It is one of the strangest and most specific documents a major AI company has ever put out, and I want to walk you through what is actually in it, what holds up, and where I think the skepticism is fair.

One caution before any of the details, and it applies to everything below. Anthropic published this report on September 10, 2026. Every claim in it is Anthropic’s own account, investigated by Anthropic, described by Anthropic. None of it has been independently verified by a third party. The company also says these are a hand picked selection of the most sophisticated cases it found, not a representative sample. Keep both facts in mind as you read.

What the report actually covers

The report, Detecting and Countering Misuse of AI, September 2026, covers activity Anthropic says it detected and disrupted between December 2025 and August 2026, sorted into 7 categories, which are cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons, and illicit distillation. Claude Haiku, Sonnet, and Opus are the models named in most cases.

Figure 3. The 7 harm categories the report is organized around. Source: Anthropic, Detecting and Countering Misuse of AI, Sep 2026

The pattern Anthropic keeps returning to is that the techniques here are old, and the economics are new. Nothing in the worst cases required knowledge that did not already exist somewhere. What changed is that a single person, or a tiny cell, got the rough equivalent of a full engineering team for the price of an API subscription.

The scale underneath those categories is worth stating plainly. Anthropic uses roughly 40 internal case designators, which it calls Generative Threat Groups, across the report. It documents 9 influence operations spread over 6 continents, a dating app network running more than 4,700 AI personas in romantic conversations with at least 25,000 real people, 6 conventional weapons cases, and 5 biological ones. One detail I keep thinking about is which models show up. Every case involved Claude Haiku, Sonnet, or Opus. Anthropic’s newer Fable and Mythos class models appear in exactly 1 incident in the entire document, which the company credits to the stronger safeguards on those models. This is Anthropic’s 4th threat report, after ones in March, August, and November 2025, and a February 2026 distillation specific disclosure that named 3 labs and counted more than 16 million exchanges.

The cyberattacks now run themselves, mostly

The theme Anthropic hammers hardest is that AI stopped being an adviser and became the thing executing the attack. In most of the cyber cases, operators pointed a multi agent setup at a general goal and let it handle reconnaissance, exploitation, credential theft, and data exfiltration, with humans stepping in mainly to pick targets and check results.

The clearest example is GTG-20006, an actor whose tradecraft Anthropic says is consistent with Midnight Blizzard, Microsoft’s name for the Russian intelligence linked group behind the 2020 SolarWinds breach. Anthropic is careful with that phrase, since “consistent with” stops deliberately short of naming them outright. Over about 130 days, the operation engaged 24 of 27 targeted institutions, including Ukrainian ministries, defense bodies, and drone supply chain manufacturers. The malware monitored itself and recompiled its own code when security tools flagged it. Anthropic says the operation also touched hotel guest WiFi networks and moved more than 300,000 North African national ID records out.

Then there is the criminal side. Anthropic ties one extortion cluster to affiliates it associates with ShinyHunters, who completed cloud compromises in as little as 2 to 3 hours. One operator spun up 10 AWS compute workers to decompile 1.8 million Android apps looking for embedded secrets. Another pulled more than 2,100 Azure AD tokens across over 40 corporate tenants in 34 hours. A separate China based group automated firmware analysis on security appliances and turned up more than a dozen potential zero day vulnerabilities in one month across roughly 50 targets. The report’s phrase for the general style is “vibe hacking,” where an operator hands the model a goal and lets it improvise the steps.

Chinese labs ran nearly 200 million exchanges through Claude

The distillation section is the one that drew the most coverage, and the numbers are large. Anthropic says 7 China based AI labs ran unauthorized campaigns to extract Claude’s capabilities for training their own models, generating roughly 190 million exchanges in total.

Alibaba accounts for the bulk of that. Anthropic says accounts tied to Alibaba ran more than 151 million exchanges with Claude between May and July 2026, peaking near 3 million a day across more than 3,500 accounts it flagged as fraudulent. The company calls it the largest distillation campaign it has ever measured. The method was specific. A fixed prompt injected into every request forced Claude Opus 4.6 and 4.7 to write out their full chain of thought reasoning inside inline tags, and the pipeline scraped only the text inside those tags. Those reasoning traces went into fine tuning data for Qwen 3.5, 3.6, and 3.7. Anthropic says Alibaba also used Claude for its own research, including building reinforcement learning environments and model architecture work. Using Claude to help build the thing that competes with Claude.

Figure 1. Exchanges Anthropic attributes to each lab. Alibaba dwarfs the rest. Source: Anthropic, Sep 10 2026 (alleged, not independently verified)

The Moonshot case is the one that made me sit up. Anthropic says Moonshot silently forwarded around 300,000 customer requests to Claude over a 10 day window through thousands of fake accounts, mostly to Opus, and showed users Claude’s answers as if Kimi had produced them. DeepSeek did something similar but more targeted, screening inbound requests for signals that a user was coming through a coding harness like Claude Code, then routing those users to Claude Opus. Anthropic says it counted more than 12.1 million exchanges tied to DeepSeek over 14 days in July.

Sit with what that means if you were a Kimi or DeepSeek customer in that window. You typed something into a Chinese AI product, and Anthropic says it was quietly handed to an American company you never agreed to send anything to. Some of those exchanges, Anthropic says, carried sensitive data belonging to individuals, multinational companies, and state affiliated organizations. Among the rerouted DeepSeek traffic, the report describes one engineer’s specification for a municipal Public Security Bureau case management system.

Figure 2. Users Anthropic says were routed to Claude without being told. Source: Anthropic, Sep 10 2026

4 more labs get named. Anthropic says Xiaomi replayed more than 400,000 of its own users’ coding sessions through Claude to make training data. Zhipu, known internationally as Z.ai, rotated through 273 accounts and pushed more than 770,000 exchanges through an automated reasoning cleaner tool to train its GLM-5.3 model, and interestingly went after Claude Fable first, gave up when the safeguards degraded the output, then switched to an older Claude model and another provider. SenseTime, by Anthropic’s account, skipped the work and simply bought harvested transcripts from third party data brokers. The seventh, MiniMax, ran an unbranded proxy service through a shell company offering only US models, which Anthropic assessed was likely built to collect user exchanges for training rather than proving that intent outright.

China rejected all of it. The Commerce Ministry said the allegations had no factual or legal basis and warned that countermeasures could follow, and the foreign ministry accused Anthropic of distorting facts. Alibaba later prohibited its employees from using Claude Code. Beijing’s other line was that distillation is a neutral technique, and that US companies have distilled Chinese models too.

That last point deserves a fair hearing. Distillation is a normal training method. What Anthropic describes is the covert, industrial scale version run through fake accounts and stolen cards, which is a different animal. I think that distinction is real, and I also think it is going to get flattened in every retelling until “distillation” and “theft” read as the same word.

A weapons cell in Yemen used Claude as its engineering team

This is the case that stays with you. Anthropic says it identified a cell in northern Yemen, tracked under the designator GTG-87001, running 3 weapons programs at once, a guided rocket using a commercially available phone class flight computer, a multi stage ballistic missile with a stated range goal over 2,000 km, and a missile family it calls R2000 that included a hypersonic glide vehicle variant.

Anthropic did not name the Houthis. The cell operates in Houthi controlled territory, and later reporting from Bloomberg and others has drawn the link, but I want to be precise about what the report claims and does not claim. Anthropic says the actors used Claude Code for guidance, navigation, and control software, in its own words “in place of human software engineers,” running several instances in parallel with different roles and splitting the work across sessions so no single prompt revealed the whole picture. Then they test fired the guided rocket. It failed. Within hours they were back in Claude asking why.

I laughed at that, then felt bad about laughing. A group builds a rocket with a chatbot, the rocket does not work, and they open a fresh session to debug it like a broken deployment script.

The scary headlines leave out the part that matters most. Anthropic explicitly said it had no evidence the cell ever fielded an operational weapon. The only physical test in the report is a guided rocket that appears to have failed. Anthropic did not formally establish that the Houthis controlled the cell. What the report does establish is narrower. A weapons development cell existed in northern Yemen, it used Claude for guidance and simulation work, it ran one failed live test, it tried to evade safeguards, and it had already built an offline simulation toolkit that runs without Claude or any commercial tool like MATLAB. That toolkit persists whether or not the accounts get banned, which is the genuinely uncomfortable detail, more than the missile ranges.

The conventional weapons section has more. Anthropic describes likely freelance Russian actors building an autonomous FPV drone swarm with a small onboard model that could select human targets and detonate without a person in the loop, trained on captured Ukrainian combat footage. It describes a Chinese actor building roughly 16 modules for electronic warfare and air defense suppression, where the default simulation scenario at one point switched to 12 targets positioned in Taiwan.

A surveillance state, built by one consultant

The surveillance section is quieter than the missile one, and in some ways it unsettled me more. Anthropic describes a single consultant who used Claude to help build a platform called Lakana 360 for Mali’s state intelligence service. As designed, it would cover roughly 25 million SIM cards across all 3 of the country’s mobile operators. The feature list is the part that lands. Warrant free dossier generation. Voice identification that recognizes the same speaker across different phone numbers. Detection of anyone using a VPN or encryption. Geofenced watchlists that alert an analyst when a flagged person enters an area. Integration with the national identity registry. One person, with a coding model, drafting the machinery of a national watch apparatus.

Anthropic lists more in this category. It says China based security bureaus generated 2,475 investigative briefs in 30 days covering dissidents, Uyghurs, pro democracy protests abroad, and religious figures, and that one bureau used Claude to draft an internal manual on using AI for surveillance. It describes Iranian units analyzing 155,216 tweets and producing open source intelligence on US naval fleet positions, and a commercial vendor profiling diaspora populations with synthetic accounts. The common thread is the one Anthropic keeps returning to, that a single operator or a small team now produces the software, interfaces, and analysis pipelines that used to need a whole staff.

Did Anthropic read people’s chats to write this?

This was the top question in the replies. The report is built from investigations of accounts that were already flagged. Detection starts with automated classifiers, metadata, and abuse signals like proxy networks, unsupported regions, extraction patterns, and safety flags. When those fire, investigators look at the associated prompts and sessions to attribute the activity, ban the accounts, and describe what happened.

So did Anthropic read user chats? Yes, the chats of investigated and banned accounts. Did Anthropic read everyone’s chats to write this report? No. Its stated default is that staff cannot browse conversations unless something is flagged, legally required, or routed through a controlled review path. The report is evidence of targeted safety investigation, not routine human reading of every Claude conversation.

I do not think the discomfort is irrational, though. The detail here goes down to Telegram bot IDs and individual operator aliases, and Anthropic’s recent record on privacy does not fully settle the nerves. The company called San Francisco police on a user over a threatening chat and then reportedly declined to hand over the messages. Its privacy policy was updated to make sharing conversation data with law enforcement easier at its own discretion. In July, a flaw exposed shared Claude conversations to search engines. If you are a developer, a researcher, or someone asking Claude about a health or money problem, “we only look when something is flagged” still requires trusting whoever writes the flagging rules.

Not everyone thinks publishing this was a public service

The criticism splits into 2 lines, and I find both worth taking seriously.

The first is that the report is fear marketing. Everything in it came from publicly available information, the argument goes, and bad actors do bad things with or without a chatbot. The report’s own defense is the economics point I mentioned, that the techniques are old and the cost collapsed, which I think is the stronger side of this particular argument. Nothing in the Yemen case needed knowledge that did not already exist. What changed is that a small cell got the equivalent of a software team on tap.

The second criticism is about the messenger, and it is harder to wave off. Anthropic is a commercial company publishing unverified findings that happen to position it as the responsible adult in the room, while it competes directly with several of the labs it is naming and lobbies Washington on export policy. Alibaba’s US listed shares dropped toward a 52 week low after an earlier version of these allegations circulated in June. A report can be accurate and self serving at the same time, and this one reads as both. When every disclosure lands as “everyone is attacking us, everyone is copying us, everyone needs us,” a reasonable person is allowed to raise an eyebrow.

2 more findings complicate the tidy China versus America framing. Research published in July by CTGT found that censorship baked into Chinese models does not reliably survive distillation into models trained on them, which undercuts one of Washington’s main arguments against Chinese open weights. A separate study covered by Fortune looked at 10 models and found refusal rates for political criticism averaging 34% for models from restrictive countries and 14% for models from freer ones, with wide variation between individual models. American models are not neutral ground either.

Figure 4. Refusal rates for political criticism, restrictive versus freer countries. Source: Study covered by Fortune, 2026

Why this is really an argument about rules

I keep coming back to one fact about this report. Anthropic caught these cases, and I believe it caught the ones it describes. But every single case is one where a commercial company decided, on its own timeline and by its own rules, what counted as misuse and what to do about it. No external body saw any of this before it went live.

Nothing in these 154 pages involves runaway self improving AI. It is a cell in Yemen with a chatbot, a hacktivist with stolen API keys running an operation that used to need a team, and a drone that picks its own target. That is the near term version of the control problem, and it is already here, not in 2030.

There are proposals floating for the longer term. Sam Altman floated a compute cap for frontier development, which has the same shape of weakness as every arms control idea, since it lowers risk only if the major powers, China included, accept verifiable rules, and neither the participation nor the verification exists right now.

I think the takeaway is simple to state and hard to do. The big AI companies need real constraints on their own models, and governments need rules that do not depend on a lab volunteering the information when it suits them. Regulation will lag the technology no matter what. The gap only grows while we wait, so the sensible time to start closing it was before a cell in Yemen filed a bug report against a rocket.