Anthropic's September threat report: seven harm areas in eight months, and an AI loop that rebuilt malware until it went undetected

The report's first trend statement is blunt: sophisticated attacks no longer require sophisticated attackers. Anthropic argues that the cybersecurity skills of AI models have collapsed the labour and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators. Its examples are a hacktivist running on stolen API keys, several financially motivated individuals acting separately, and a state espionage operator — each sustaining multi-victim campaigns that, a year earlier, would have required many skilled operators and specialist knowledge. For threat intelligence investigators, sophistication has stopped being a reliable signal of who is behind an operation, because every layer of offensive work has been uplifted, from reconnaissance and tool development to data processing and exploitation. The report measures that gain with a term it calls uplift, viewed through speed, scale and depth, and argues the real risk is not models generating exploits at scale but adversaries operating faster, across a broader and deeper surface, with fewer resources.

The second trend is that AI's role in these operations has become increasingly autonomous. Anthropic says most of the operations described were enabled by AI through direct execution or orchestration, going well beyond chatbot question-and-answer into multi-agent frameworks carrying out reconnaissance, exploitation and data exfiltration, with humans left in the loop mainly to set targets and review exfiltration. Case GTG-20006 is its example: the actor built an AI-assisted workflow that automatically rebuilt and redeployed their toolkit whenever security products detected it. More concretely, they used AI to monitor how well their tools evaded known defences — when a monitoring agent found that a piece of malware had been detected, agents set about autonomously modifying and rebuilding it, iterating until it was undetected, then staged the tools on disposable hosting for operations including phishing, ClickFix and DNS hijacking. The operating model Anthropic documented in November 2025 for a suspected state-sponsored autonomous campaign has now proliferated across every class of actor it investigated, and publicly downloadable offensive agent frameworks such as PentAGI hand most of the same scaffolding to anyone.

The detail inside GTG-20006 is worth reading on its own. Anthropic says its attribution is consistent with public reporting linking the actor to Midnight Blizzard, and that one operator is a Russian speaker using the handle JackPoterz whose tradecraft and targeting line up with Russian state-nexus espionage. Targets included military intelligence targets in Ukrainian and European governments, plus defence and diplomatic organisations and individuals connected to US foreign policy. The toolkit was not crude: two families of Windows-based implants, a mobile exploitation kit, a credential stealer aimed at browser password stores, a phishing platform built to impersonate high-value targets such as government organisations, and an administrative console for managing compromised accounts — each managed and re-tooled on demand by AI-assisted workflows. Anthropic identified more than 20 distinct organisations in the actor's planning, reconnaissance and live operations: government ministries, defence and intelligence bodies, embassies and diplomatic missions, think tanks and defence-industrial companies, concentrated in Ukraine and Europe but extending to the Middle East and maritime-related government agencies in Asia, with a recurring thread of Ukraine and military drone technology providers and supply chains. One theft is documented in unusual detail: the actor bulk-exported the mailboxes of at least two drone component manufacturers, targeted a military drone maker, and stole a complete proprietary software development kit for a drone vision system, spending several days reverse-engineering it to recover the product architecture, hardware bill of materials, supplier dependencies, and details of an unannounced product.

The other half of the report is about breadth. The actors Anthropic lists include suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions and politically motivated individuals, and the cases range from a network of fake dating apps built to defraud users to surveillance systems designed to identify and monitor dissidents. Anthropic frames publication as a responsibility: as models grow more capable, risks increase unless developers and society's defenders act. It says it disrupted each activity it describes, used what it learned to strengthen its safeguards, and shared intelligence with authorities and industry partners where appropriate. One boundary has to be stated clearly: this is Anthropic's own disclosure, so the case count, the designators and the attributions cannot be independently verified from outside. The report also stresses that the misuse involved Haiku, Sonnet and Opus and that Fable and Mythos-class models appeared only in one illicit distillation case — a claim about the effectiveness of the company's tiered safeguards, and therefore another statement to read as a vendor's own account.