Anthropic Says AI Is Letting Smaller Attackers Run State-Scale Operations

News

1. Apple Tightens Mac Access Rules as AI Agents Gain Reach

2. Trump Puts Intelligence Chief Jay Clayton in Charge of AI Task Force

3. IBM Widens AI, Quantum Research With IIT Bombay, IISc

4. OpenAI, Synopsys Build AI Model That Could Slash Chip Design Time

5. Pentagon Plans Four-Star Command for AI, Drone Warfare

6. California Draws the Line on AI Firings, Layoffs and Workplace Surveillance

Artificial intelligence is starting to erase one of the advantages that once separated state-backed hackers from smaller criminal groups and lone operators: access to large teams of specialists.

Anthropic said in a threat report released Thursday, September 10, that attackers are increasingly delegating reconnaissance, software development, exploitation and data processing to AI systems, allowing individuals and small groups to carry out operations that previously required teams of skilled people.

The attacks themselves are mostly familiar. What has changed is their economics.

“The sophisticated attacks no longer require sophisticated attackers,” Anthropic said, describing cases in which breaches were completed within hours and individual operators handled multiple victims at once.

The company said AI was increasingly being used not merely to advise attackers but to execute and coordinate parts of operations with limited human supervision.

The report covers activity Anthropic says it detected and disrupted between December 2025 and August 2026 across cyber operations, surveillance, political influence, fraud, conventional weapons development, biological research and attempts to copy Claude’s capabilities.

Anthropic cautioned that the cases were among the most notable it had encountered and were not representative of typical misuse of its models.

One Attacker Can Do The Work of A Team

One of the most extensive cases involved an espionage operation whose activity Anthropic said was consistent with reporting on Russia-linked hacking group Midnight Blizzard.

The group used AI across phishing, malware development, credential theft and data extraction while targeting more than 20 organizations, including government, defense, intelligence and diplomatic targets.

Anthropic said the attackers built a system that monitored whether security software had detected their malware. AI agents could then modify and rebuild the malicious software repeatedly until it was no longer detected. The group also used AI to automate phishing infrastructure and process hundreds of gigabytes of stolen data.

The same shift appeared in financially motivated cybercrime.

Operators suspected of ties to the ShinyHunters ecosystem used a distributed system to download and scan 1.8 million Android applications for exposed credentials. In one supply chain breach, attackers extracted data belonging to roughly 200 customers of a compromised software provider, with Anthropic saying AI agents performed nearly all of the work.

Another intrusion went from a stolen developer token to full administrative control of a company’s cloud environment in roughly three hours.

Anthropic said attackers were increasingly giving AI broad objectives, such as gaining access to a target or retrieving valuable data, then allowing the systems to inspect unfamiliar environments, write and execute code and continue until the objective was achieved.

Surveillance Systems Need Fewer People

The same economics are emerging in state surveillance.

Anthropic said China-linked actors used Claude to monitor dissidents, activists, religious groups, ethnic minorities and overseas communities. One operation automated the processing of foreign news and social media into government-style intelligence briefings that ranked material by political sensitivity.

Another China-linked operation monitored Uyghurs and Uyghur groups in Syria, using Claude to process material extracted from more than 100 WhatsApp groups and dozens of Telegram channels and identify people considered vulnerable to recruitment.

In Iran, Anthropic said two units associated with paramilitary and domestic security organizations used Claude to build surveillance tools and analyze social media. One organization claimed to have profiled 6,388 Iranians in a year and ran analysis across 155,216 posts on X.

The software included tools for linking phone numbers to identities, harvesting social media identities and managing surveillance records.

Perhaps the clearest example of AI replacing an engineering team came from Mali.

Anthropic said a single consultant working with the country’s state intelligence service used Claude to help build a surveillance platform covering roughly 25 million SIM cards across all three national mobile operators.

The system was designed to collect call, message and voice data, identify people across different SIM cards using voiceprints and generate intelligence dossiers on phone numbers. Anthropic said a warrant requirement was removed from part of the system during development.

The platform ultimately ran locally rather than on Claude, meaning banning the developer’s Anthropic account did not disable the deployed surveillance system.

Propaganda Becomes Cheap to Produce

Anthropic identified nine influence operations targeting audiences on six continents.

One commercial network operated about 70 fabricated news sites and published at least 8,913 articles in roughly 20 languages. Another operation targeting Malaysian politics maintained about 1,000 fake social media accounts alongside a synthetic news outlet and fabricated dossiers.

In Bangladesh, Anthropic said a single operator rotated through 29 Claude accounts and used automated software to generate at least 1,500 fabricated headlines and 300 false narratives supporting the Awami League and attacking political opponents.

Anthropic said it found no evidence that the party directed or financed the operation.

But scale did not necessarily mean influence.

Many of the networks Anthropic examined attracted little authentic engagement, and some were disrupted before building significant audiences. The report found that AI made propaganda much cheaper to manufacture and distribute, but did not solve the harder problem of persuading real people to consume or believe it.

AI Moves Into Weapons Development

Anthropic also detailed six cases involving conventional weapons, including actors in China, Russia and Yemen.

A group in northern Yemen used Claude Code while working on guidance software for rockets and missiles. Anthropic said the group conducted a live test of a guided rocket, which appeared to fail, before returning to Claude to diagnose the problem.

Russia-based actors used Claude while developing software for an autonomous drone swarm. The system was designed so drones could classify targets and issue detonation commands without a human in the loop, according to Anthropic.

China-based actors used Claude in work involving an anti-torpedo system, electronic warfare and intelligence on directed-energy weapons.

Anthropic said the users generally already had access to weapons hardware or specialist knowledge. AI’s role was to accelerate software engineering, simulation, documentation and analysis rather than conjure a weapons program from nothing.

Biological Research Tests the Guardrails

The report also describes five cases of biological research with potentially dangerous dual uses.

They included work involving chikungunya, highly pathogenic avian influenza, orthopoxviruses and toxin research. In one case, Claude was used to help draft a grant application involving research intended to alter chikungunya’s transmissibility and ability to evade immunity.

Anthropic stressed that it was not accusing the researchers of intending to build biological weapons. Much of the work had legitimate scientific or medical applications, making it difficult for automated safeguards to distinguish beneficial research from potentially harmful use.

The company said older Claude models had previously tested well below the level at which they could meaningfully assist sophisticated users with dangerous biological research. It said today’s more capable systems had made that conclusion less certain, prompting stronger restrictions on sensitive biological queries.

None of the misuse cases in the report involved Anthropic’s newer Fable or Mythos-class models, apart from one case involving attempts to extract model capabilities.

AI Companies Become Targets

AI developers themselves are also becoming part of the attack surface.

Anthropic said it disrupted unauthorized attempts by seven China-based AI laboratories to extract Claude’s capabilities through large-scale model distillation.

It attributed more than 151 million Claude exchanges between May and July to operators affiliated with Alibaba, more than 23 million to Moonshot AI and more than 12.1 million to DeepSeek over a 14-day period. Anthropic also described activity involving Zhipu, Xiaomi, SenseTime and MiniMax.

Anthropic alleged that Moonshot and DeepSeek in some cases silently routed their own customers’ queries through Claude and then collected the exchanges for model training. Some requests contained corporate information, credentials and government-related data, raising a separate privacy and security concern.