September 11, 2026, (Inside AI) — Anthropic has documented a sharp shift in how its Claude models are being weaponized, moving from simple chatbot queries to multi-agent systems that orchestrate entire cyberattacks with minimal human oversight.
The company’s fourth misuse report, covering December 2025 through August 2026, details cases of Russian-linked espionage, dissident surveillance, and automated malware evolution. The findings land weeks after Anthropic engineer Jacob Coxon resigned with a stark public warning that AI could kill everyone by decade’s end.
Anthropic’s Threat Intelligence Team identified activity across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. The models involved were Claude Haiku, Sonnet, and Opus. None of the company’s most advanced models, Claude Fable or Mythos, appeared in the cases except one illicit distillation instance.
The report does not claim AI made attacks fully autonomous. Humans still set targets and review outcomes. But their role has shifted from hands-on execution to supervision of AI agents that handle reconnaissance, exploitation, and data theft.
Multi-Agent Systems Now Run the Kill Chain
Anthropic found that a majority of documented cyber operations involved direct orchestration by AI. Multi-agent systems performed tasks across the cyber kill chain, from finding a target to gaining access, maintaining control, and stealing information.
One threat actor, tracked as GTG-20006, drew particular scrutiny. Anthropic said its assessment aligns with public reporting linking the group to the Russian-linked Midnight Blizzard. The group targeted military intelligence organizations, government agencies, diplomatic bodies, and defense firms in Ukraine, Europe, and elsewhere.
AI was used across much of that operation. Attackers automated reconnaissance, built phishing infrastructure, maintained access to compromised systems, extracted data, and modified malware. The malware modification loop is especially concerning: AI agents monitored whether malware was detected by security products. When detection occurred, agents modified and rebuilt the malware to evade defenses, then repeated the process.
The group hit more than 20 organizations. In one case, attackers used AI to organize hundreds of gigabytes of exfiltrated data. That volume signals a broader shift: AI need not invent new attack types. Making existing attacks faster, cheaper, and easier to repeat may be enough to increase their impact significantly.
Skill Barriers Collapse as Offensive Frameworks Spread
Anthropic observed that state-sponsored groups, financially motivated criminals, and individual operators are now running campaigns that once required teams of highly skilled specialists. AI assists with reconnaissance, tool development, data processing, and exfiltration.
This erodes a key investigative signal. The sophistication of an attack may no longer reveal much about the sophistication of the person behind it. Someone with limited technical expertise can likely use AI-powered tools and publicly available agent frameworks to execute operations that once demanded significant expertise.
Anthropic also flagged the growing availability of offensive AI frameworks. These systems link different stages of a cyberattack, effectively automating parts of the kill chain. The company argues that the biggest risk may stem from AI being used throughout the entire attack process, not from a single breakthrough like detecting a new software vulnerability.
Beyond cyber operations, the report identified misuse involving surveillance, scams and fraud, influence operations, biological risks, conventional weapons, and attempts to extract capabilities from AI models. Detected actors included suspected state-sponsored groups, criminals, commercial spyware vendors, state propaganda organizations, and politically motivated individuals.
One instance involved a network of fake dating apps designed to defraud users. Another involved surveillance systems deployed to identify and monitor dissidents. The common thread is that increasingly capable AI reduces the cost of activities that once required considerable human effort, technical experts, or organizational resources.
Anthropic said it disrupted each documented case and used findings to strengthen safeguards. The company also shared intelligence with authorities and industry partners where appropriate. Defenders, the report argues, will need to use AI themselves, not just to respond to attacks but to find vulnerabilities, detect suspicious activity, and strengthen systems before exploitation.
The report’s cases are not necessarily representative of everyday misuse. They are among the most novel examples the team identified. But the trajectory is clear: the biggest advantage may now lie with whoever has access to the best AI tools and knows how to orchestrate them.
