# Anthropic Says AI Collapsed the Skill Gap. The Cases Are Live Intrusions. > Anthropic's 10 September threat report covers misuse it disrupted from December 2025 through August 2026. Sophistication is no longer a reliable attribution signal. Named cases include a Russian-linked operator consistent with Midnight Blizzard, ShinyHunters affiliates who dumped 2,100 Azure AD tokens in 34 hours, and a Changsha undergraduate exploit foundry. Source: https://hackerlogs.com/blog/anthropic-sept-2026-threat-intel Published: 2026-09-10 ## Key takeaways - The report is operator intelligence, not another eval-harness breakout. Anthropic says it disrupted the activity, tightened safeguards, and shared with authorities. - Sophistication is no longer a reliable who-did-this signal. A hacktivist on stolen keys, a crime crew, and a state-nexus operator ran campaigns that used to need a team. - GTG-20006, consistent with Midnight Blizzard, hit more than 20 organizations. Agents rebuilt malware when detections fired and ran hotel Wi-Fi DNS hijacks. - ShinyHunters affiliates dumped 2,100 Azure AD token sets across 40 tenants in 34 hours. AI agents did nearly all of the work. One path went stolen-dev-token to admin in about three hours. - Seven China labs, including Alibaba, DeepSeek, Moonshot, Xiaomi, and Zhipu, ran illicit distillation. Alibaba peaked at nearly 3 million exchanges a day from more than 3,500 fake accounts. [CyberScoop](https://cyberscoop.com/anthropic-report-ai-enabled-cyber-attacks/) has the headline: AI let small actors run state-level campaigns. The operator document is Anthropic's [10 September threat intelligence report](https://www.anthropic.com/threat-intelligence-report-september-2026). Eight months of disrupted Claude misuse. Seven harm areas. The thesis is not a forecast. Sophistication has already stopped being a reliable attribution signal. Live misuse of generally available Claude models for espionage, smash-and-grab theft, exploit research, and industrial distillation. High because the cases are real intrusions, not because Fable or Mythos were the tools. Three panels from Anthropic's September 2026 threat report: the collapsed skill gap on Haiku, Sonnet, and Opus; live cases including Midnight Blizzard-linked espionage, a ShinyHunters token dump, and a Changsha foundry; and seven China labs running illicit distillation, with Fable 5.1 preserved thinking as the control. ## What the report actually claims. This is not the [fourth eval-time breakout](/blog/anthropic-fourth-claude-eval-breakout). That assessment covers pre-release CTF harnesses. This report covers outside operators using Claude Haiku, Sonnet, and Opus from December 2025 through August 2026. Anthropic says it disrupted each case, used what it learned on safeguards, and shared with authorities and industry partners where appropriate. The models in the misuse cases are the generally available ones. Anthropic says it found no Fable or Mythos misuse except one illicit distillation case. Mythos still has cyber safeguards that, in Anthropic's words, greatly reduce its ability to perform harmful cyber tasks. The operators did not need those models. > The report's cyber cases ran on Haiku, Sonnet, and Opus. Public offensive agent frameworks such as PentAGI already reproduce the kill-chain scaffolding. The bottleneck that moved is labor, not access to a preview checkpoint. Humans stayed in the loop the same way in the high-end cases: they set targets and reviewed what came back. Agents did reconnaissance, exploitation, rebuilds, and exfiltration. That is the operating model Anthropic first documented in a suspected state campaign in November 2025. The company says it has now proliferated across every class of actor in this report. ## The Russian-linked case. GTG-20006 is the longest write-up. Anthropic's attribution is consistent with public reporting that links the actor to Midnight Blizzard. One operator is a Russian speaker using the handle JackPoterz. Targeting matches Russian state-nexus espionage: Ukrainian and European governments, diplomatic and defense organizations, people connected to US foreign policy, and the drone supply chain. The company counted more than 20 distinct organizations in the actor's planning, reconnaissance, and live operations. Recurring work included mailbox theft at drone-component makers and the theft of a complete proprietary SDK for a drone vision system. The actor spent days recovering architecture, a hardware bill of materials, supplier dependencies, and details of an unannounced product. Not every path was direct. The actor compromised at least three hospitality vendors that run hotel guest Wi-Fi, then changed DNS so guest traffic, device identifiers, and IP addresses landed on actor infrastructure. Microsoft Threat Intelligence published the same delivery method in July 2026 as CaptiveCrunch. WhatsApp accounts were linked as companion devices through headless browsers so conversations could be exported without lighting up read receipts. In North Africa, a government technology authority lost a VPN appliance, then a central account server, then more than 300,000 national identity records and commercial registry data on more than 500,000 companies. The part that changes defender math is the rebuild loop. Agents watched whether security products flagged the implants. When a detection landed, agents modified and rebuilt the toolkit until it was clean, then staged it from disposable hosts. Anthropic's line is that static detections no longer impose the cost they used to. Device-code phishing against Microsoft 365, run through a framework the actor called Embassy Kit, produced mail theft at at least eight organizations. > Do not treat a fresh implant hash as a closed case. In this operating model the hash is an input to the next rebuild, not the end of the campaign. ## The criminal tempo. GTG-50014 covers clusters Anthropic assesses as ShinyHunters affiliates. The shared lifecycle is credential harvest, qualify, smash, extort. One French-speaking operator ran ten AWS workers that decompiled 1.8 million Android APKs and scanned them for secrets. Verified finds went to a Telegram group sorted into more than 100 source types. The number on the social card's neighbor is the session-store dump: more than 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours. Anthropic says AI agents performed nearly all of the work. Another compromise moved from a single stolen developer token to full administrative control of a victim cloud environment in roughly three hours. Stolen AI API keys were both loot and compute. Affiliates switched their own attack workloads onto victim keys. Anthropic is explicit: those keys came from customer environments. Anthropic's own systems were not compromised. A parallel criminal market now sells discounted "Claude" that is neither cheap nor Claude, and harvests the buyer's real credentials on the way through. ## The Changsha foundry. GTG-10007 is a Chinese-speaking cluster Anthropic places in Changsha, Hunan. Two operators were undergraduates in a School of Computer and Communication Engineering. One had interned at Sangfor and was interviewing at QiAnXin for an offensive role. The group used Claude as the engineering and orchestration layer across intrusion attempts, foreign-government reconnaissance, standing vulnerability research against endpoint-security products, malware development, and an intelligence-collection platform. Targeting covered about fifty organizations. Confirmed theft included bulk student personal data from an education-technology company's cloud storage, access to a retail production environment, and citizen records from a Southeast Asian government agency. Hands-on follow-through, Anthropic says, concentrated on domestic China victims even when the AI workflows pointed overseas. The foundry itself is the new piece. A continuous workflow against network-appliance firmware yielded more than a dozen possible zero-day findings in a single month. Lead agents split work across parallel subagents. Campaign memory (targets, credentials, standing instructions) survived between sessions. A fleet of thirteen collection agents ran on a schedule against public US military and government sites. That is an exploit factory staffed by students and an API key, not a 20-person APT cell. ## Distillation and the joint advisory. Since February, Anthropic says it has disrupted additional distillation attacks from seven labs based in China, including Alibaba, DeepSeek, Moonshot, Xiaomi, and Zhipu. The campaigns targeted generally available Opus-class models. Anthropic has not observed attempts against Mythos 5 or Mythos Preview, which are not generally accessible. Alibaba is the largest case Anthropic has measured: a chain-of-thought pipeline against Opus 4.6 and 4.7 that peaked at nearly 3 million exchanges a day from more than 3,500 fraudulent accounts, more than 151 million exchanges from May through July. Moonshot and DeepSeek silently forwarded some of their own customers' requests to Claude and returned Claude's answers as their own. Relayed traffic included surveillance footage Anthropic assesses as PLA-affiliated, live credentials from a major PRC state-owned enterprise, and, on the DeepSeek side, material from a Russian defense-linked agency and a municipal Public Security Bureau case-management build. That lands next to [joint advisory AA26-251A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a), published 8 September by NSA, CISA, and the FBI. The agencies name industrial-scale distillation by China-based AI companies as a core development strategy, not a side channel. Anthropic's Fable 5.1 [preserved-thinking change](https://support.claude.com/en/articles/16761192-preserved-thinking-changing-how-the-messages-api-handles-thinking-blocks-to-protect-against-distillation) is the product control: new API accounts created after 31 August 2026 cannot edit the system prompt, tools, or messages that sit in front of a thinking block. Existing accounts are not in that lock for Fable 5.1. Claude Code and claude.ai are not in it either. ## What to do. If you defend a network that issues AI keys, or that runs Microsoft 365 and guest Wi-Fi: 1. Treat Anthropic, OpenAI, and other frontier API keys as production credentials. Rotate anything that has ever sat in an APK, a GitHub repo, a container, or a chatbot. Stolen keys in this report were attack compute and cover, not just loot. 2. Assume a stolen developer token can become tenant admin in hours. Hunt Azure AD token reuse and device-code phishing against cloud email, not only password sprays. 3. Do not buy discounted Claude, or any frontier model, through an unknown proxy or "reseller." That path is how credentials and customer prompts leave your tenant. 4. Watch hotel, campus, and guest Wi-Fi vendors the way you watch a managed-service provider. A DNS change on a captive portal is an initial-access path. 5. Stop using sophistication as the nation-state tell. Score campaigns on targeting, data stolen, and persistence. The toolkit will look expensive either way. The report is a vendor document. The cases are still the cases. If your threat model still says "only a state can run this," it is a year late. ## Sources - [Detecting and countering misuse of AI: September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026) (2026-09-10) - [AI lets small actors run state-level hacking campaigns, Anthropic report finds](https://cyberscoop.com/anthropic-report-ai-enabled-cyber-attacks/) (2026-09-10) - [China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a) (2026-09-08) - [Preserved thinking: changing how the Messages API handles thinking blocks](https://support.claude.com/en/articles/16761192-preserved-thinking-changing-how-the-messages-api-handles-thinking-blocks-to-protect-against-distillation) (2026-08-31)