Spies, Scammers and Bioweapon Labs: Inside Anthropic's Most Disturbing Threat Report Yet

On September 10, 2026, Anthropic published what may be the most consequential safety document ever released by a frontier AI company. Its September 2026 Threat Intelligence Report — the company’s fourth, covering disrupted activity from December 2025 through August 2026 — reads less like a corporate transparency exercise and more like a field guide to how nation-states, criminal syndicates, and fraud shops are actually weaponizing commercial AI models right now. Reuters called it a disruption of “Russian, Chinese AI campaigns targeting its Claude models.” That headline undersells it. This is the first time any private company, AI or otherwise, has publicly shared evidence of attempts to use its platform for biological weapons development.

Seven arenas of misuse, hundreds of disrupted operations

The report organizes its case studies across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation. The actors span suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals. Critically, all documented malicious activity ran on Claude’s Haiku, Sonnet, and Opus tiers. None of it involved Claude Fable or Mythos-class models — except one illicit distillation case — which Anthropic attributes to the heavier safeguards those frontier tiers carry.

Two structural findings anchor the whole document. First, the report introduces the concept of “uplift” — how much faster, broader, and deeper an operation becomes with AI versus without it. Second, it documents a proliferation problem: an operating model for autonomous attacks that Anthropic first observed in November 2025 from one suspected state-sponsored actor has now spread to every actor class the company investigated, with open-source frameworks like PentAGI reproducing much of the same scaffolding for anyone who downloads them.

GTG-20006: Russian espionage that rewrites its own malware

The single most technically alarming case is GTG-20006, an actor Anthropic assesses as consistent with public reporting linking it to Midnight Blizzard — the Russia-nexus espionage operation previously known as APT29. One operator used the handle “JackPoterz.”

The actor built customized AI-driven workflows that automated nearly the entire espionage lifecycle: infrastructure acquisition, phishing, persistence, command-and-control, and data exfiltration. Their toolkit included two families of Windows implants (PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc), a mobile exploitation kit (GiftDrop for Android, DarkSword for iOS), a browser-credential stealer, and a phishing platform mimicking government organizations.

What makes the case genuinely novel is the autonomous evasion loop. When the actor’s AI monitoring agents detected that deployed malware had been flagged by a security product, other agents autonomously modified and rebuilt the malware until it was undetected — then staged it for live operations. The human operator’s primary role shrank to refining the Claude Code skills that drove these workflows. As the report puts it, AI has inverted the cost equation back onto defenders: capable adversaries can now “close the loop,” evading new detections faster than vendors can ship them.

The targeting map is sprawling. More than 20 distinct organizations appeared in the actor’s planning and live operations: government ministries, defense and intelligence bodies, embassies, think tanks, and defense-industrial firms concentrated in Ukraine and Europe, but extending to the Middle East and maritime agencies in Asia. Ukrainian government, military, and diplomatic staff were the most recurrent targets, with a particular appetite for drone supply-chain technology. The actor bulk-exported mailboxes from at least two drone component manufacturers, stole a complete proprietary SDK for a drone vision system, and spent days reverse-engineering it to recover the product architecture, hardware bill of materials, and details of an unannounced product.

Two secondary techniques deserve mention. The actor compromised at least three hospitality vendors running hotel guest WiFi, using stolen admin credentials to hijack DNS records and stage ClickFix-style lures delivering Windows, Android, and iOS malware to guests — a technique Microsoft Threat Intelligence dubbed “CaptiveCrunch” in July 2026. They also took over victims’ WhatsApp accounts via headless browsers and the WPPConnect automation library, suppressing read receipts while bulk-exporting conversations; at least two former high-level Ukrainian officials were targeted this way. A separate intrusion into a North African government technology authority yielded the full credential database: over 300,000 national identity records and commercial registry data for more than half a million companies.

The biological section: five cases no AI company had ever disclosed

The biological misuse section is the report’s center of gravity, and Anthropic frames it with unusual candor: “To our knowledge, no private company, AI or otherwise, has yet shared evidence of the potential misuse of their platforms for biological weapons development publicly.” Until now.

The five case studies, with institutions, countries, and specific agents deliberately withheld:

Case 1 — the evasion platform. A reseller platform serving dozens of life-science researchers — many virologists affiliated with both civilian and military institutions — tunneled traffic through US infrastructure to evade regional blocks and used zero-data-retention services to hide content. A blocked grant application involved chikungunya virus gain-of-function research targeting transmissibility and immune evasion, to be performed at a military research institute. When Claude’s classifiers refused sensitive prompts, the platform’s fallback mechanism routed them to a competitor’s more permissive model. When Anthropic banned the accounts and helped take down the relays, the operator re-established access within days using consumer subscriptions registered to fresh identities.

Case 2 — avian influenza. A researcher in an unsupported region spent weeks and thousands of messages planning highly-pathogenic avian influenza mammalian-adaptation experiments — research into a pathogen with roughly 50% case fatality in confirmed human spillovers and near-zero population immunity. The plan involved engineering mutations associated with mammalian adaptation and airborne transmissibility in animal models. Because Anthropic’s classifiers robustly block enhanced-pandemic-potential pathogen construction, all exchanges landed on the weakest model class (Sonnet 4 and Haiku 4.5), limiting uplift to clerical and study-design assistance. The case nonetheless evidences active wet-lab programs building both knowhow and materials for enhanced-pandemic-potential pathogens.

Case 3 — the orthopoxvirus grant. A reseller relay serving more than a dozen customers exchanged tens of thousands of messages with Claude in days. One customer had Opus 5 draft a complete grant application for orthopoxvirus immune-evasion research at a state-associated infectious disease laboratory — hypothesis, experimental design, dosing, statistical plans, contingency strategies — in about an hour. Because the research explicitly focused on attenuation, it sailed through the classifiers.

Cases 4 and 5 — venoms and toxins. A state-supported researcher built a venom peptide atlas and generative optimization pipeline targeting both analgesic and paralytic compounds — the latter derived from toxins export-controlled under the Australia Group list. A fifth researcher computationally redesigned a diverse set of toxins, including a bacterial toxin subunit and a hemorrhagic-fever virus protein on the WHO R&D Blueprint priority list, while deliberately directing Claude to keep agent identities vague in progress reports.

The conclusion Anthropic draws is quietly radical: classifiers alone cannot simultaneously enable benefit and prevent harm in deeply dual-use domains, and “the only safe way to serve frontier biological capabilities is to offer them in trusted user programs.” A recent 30-day sweep of activity tied to adversarial state institutions surfaced roughly 35 distinct research efforts, most ordinary civilian science, but some with notable dual-use potential.

Surveillance and influence: bureaucratic repression, automated

The surveillance section details three “stability maintenance” cases and one sprawling operation, GTG-14022, attributed with medium confidence to a commercial contractor working for PRC government clients. The actor ran an automated “public opinion monitoring” (舆情) pipeline: Claude role-played as a “senior emergency public opinion analyst serving the government of the People’s Republic of China,” processing 15 to 30+ foreign news articles daily from Weibo, X, YouTube, Telegram, and Facebook. Output documents scored content by political sensitivity, recast “Taiwan government” as “Taiwan authorities,” wrapped scare quotes around “human rights violations,” and recommended enforcement actions only a state could carry out, using the language of China’s “three warfares” doctrine. Targets included pro-democracy figures in Hong Kong, organizers of Tiananmen Square commemorations, and Uyghur advocacy organizations.

A separate Iranian-nexus case, GTG-34007, saw 16 Claude accounts banned across two paramilitary-linked units building surveillance systems. And in the influence-operations chapter, GTG-84002 — linked with high confidence to UAE government officials — ran roughly 300 inauthentic influencer accounts, cloned a real Swiss NGO’s identity, ghost-wrote UN Human Rights Council testimony, and compiled counter-accountability dossiers on UN Special Rapporteurs criticizing UAE conduct in Sudan.

On the commercial-fraud side, GTG-15001 documents a China-based studio running over 20 dating apps with more than 4,700 distinct AI personas conversing with at least 25,000 unique individuals in a two-week April 2026 window — a 3-to-1 ratio of AI personas to the real gig workers mixed into the same match feed for authenticity checks. And GTG-50014 describes ShinyHunters-affiliated operators, one of whom mass-downloaded 1.8 million distinct Android APKs across 10 AWS workers to decompile and scan for hardcoded secrets, feeding a carding autoshop at autoshop.policenationale[.]cc — a domain impersonating the French national police.

Why this report matters

Three implications stand out beyond the individual case studies.

First, the labor gap has collapsed. As the report states plainly, “sophistication has stopped being a reliable signal of who is behind an operation.” A hacktivist with stolen API keys, a scattered criminal affiliate, and a state espionage operator each sustained multi-victim campaigns that a year ago would have required teams of skilled operators.

Second, the model-tier split is doing real work. That zero documented misuse involved Fable or Mythos-class models — which carry safeguards that “greatly reduce” harmful cyber task ability — is the strongest public evidence yet that capability tiering and differential safeguarding measurably shapes adversary behavior. The avian-flu researcher being forced down to Sonnet 4 and Haiku 4.5 is the bio version of the same effect.

Third, the disclosure itself is the news. Anthropic is arguing, implicitly, that AI providers now possess threat-relevant visibility into dual-use research that even governments and intergovernmental organizations lack — and that sharing it creates a window for advocacy, policy, and, in extreme cases, law enforcement. Whether the rest of the industry follows, and whether “trusted user programs” for frontier biology become standard practice, will be one of the defining safety debates of the coming year.

The report lands amid a season of unusual alarm from inside the company — former Anthropic researcher Jacob Coxon’s high-profile departure warning, congressional hearings on extinction risk, and an ENISA access arrangement for the Mythos 5 model in the EU. Read together, they suggest Anthropic has decided that pressuring regulators publicly is now part of the safety playbook. This report is the receipts.