Detecting and countering misuse of AI: September 2026
侦测与反制 AI 滥用：2026 年 9 月

OVERVIEW · 概览 The cases we share here aren't typical misuse, but rather examples of the most notable and novel threat activity we've identified to date. We're publishing this work because we believe we have a responsibility to disclose malicious misuse of our services. As models become increasingly capable, their risks will increase, unless AI developers and society's defenders act to make them safer.

The threat actors covered in this report include suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals. The cases range from a network of fake dating apps designed to defraud users to surveillance systems built to identify and monitor dissidents.

CYBER OPERATIONS · 网络行动 Cyber operations: From assistant to orchestrator

Over the past six months, our Threat Intelligence team identified and disrupted a series of cyber operations in which threat actors used Claude. The actors included suspected state-sponsored groups, financially motivated criminals, and politically motivated individuals.

Throughout these case studies, the report will reference Generative Threat Groups (GTGs). These are Anthropic's internal designators for actors observed to be abusing AI. The report also attempts to measure uplift, a term we use to describe the AI capability boost, or how much more harm was caused with AI versus without AI.

Many commentators focus on the risk of AI developing exploits at scale. While this is a danger, the risk from AI adoption is more pronounced across the cyber kill chain, where adversaries can operate faster, across a broader and deeper surface area, with fewer resources.

CYBER OPERATIONS · 趋势 Sophisticated attacks no longer require sophisticated attackers

The cybersecurity skills of AI models means that AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators. In the case studies we report below, a hacktivist using stolen API keys, disparate financially motivated individuals, and a state espionage operator each sustained multi-victim campaigns that, even just a year ago, would have required many skilled operators and specialist knowledge.

For threat intelligence investigators, sophistication has stopped being a reliable signal of who is behind an operation. Every layer of offensive operations has been uplifted by AI, from reconnaissance and tool development to data processing and exploitation. Publicly available offensive agent frameworks, like PentAGI, reproduce much of the same scaffolding for anyone who downloads them. This scaffolding effectively automates each step of the cyber kill chain.

CYBER OPERATIONS · 个案 GTG-20006 GTG-20006: Russian espionage

Historically, cyber espionage actors have followed a pattern of developing and deploying custom toolkits designed to evade detections. Actors would use these tools until defenders identified and built signatures to detect and block them, and there would then begin a new cycle of evasion and detection. Robust defenses and detections therefore created increased costs for adversaries. Now, however, the adoption of AI threatens to quickly and easily subvert defenders' ability to impose costs on adversaries via static detections alone.

GTG-20006 is an actor who has increased their speed by automating their operations using AI. Our attribution is consistent with public reporting linking the actor to Midnight Blizzard.

The actor also used AI to monitor how well their tools evaded detections from known security defenses. If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections.

INFLUENCE OPERATIONS · 影响力行动 Influence operations are neither new nor unique to the internet. An established community of journalists, researchers, and government agencies has studied these tactics, exposed them, and built the frameworks we use to understand them.

However, while a social media site usually sees an operation once its content is already circulating, we may see it on Claude while the operation is still being built. Actors use AI to plan their campaign, choose their targets, and write the material. Those types of tasks produce signals that our systems are trained to detect, which often lets us disrupt an operation before it gets off the ground.

Our visibility into these operations ends once it's live. To verify our findings and understand what happened after content left our platform, we rely on open-source research, cross-platform industry data, and public reporting.

INFLUENCE OPERATIONS · 衡量与趋势 How we measure reach: To accurately evaluate the impact of each influence operation, we apply the Breakout Scale, a six-category framework widely accepted by industry researchers. The scale categorizes impact based on cross-platform migration and reach. Category One represents content that is confined to a single community on a single platform, while Categories Two through Six measure increasingly higher levels of public exposure and distribution.

Trends in influence operations
• Influence sold as a service. ... commercial actors hired by entities (political, government, et cetera) produce content for whoever wishes to pay. This gives plausible deniability to the ultimate commissioners of the influence operations, and puts this capability within reach of actors who can't or do not want to build it themselves.
• AI as a newsdesk. In several cases, Claude was slotted into a human-edited pipeline that was already up and running, playing the role of a sub-editor or content creator. This allowed low-resourced actors to run influence operations at a scale well beyond what they could accomplish alone.

SURVEILLANCE · 监控 AI-enabled surveillance operations

Between January and July of this year, we identified and disrupted a set of operations in which state-aligned actors, state-linked contractors, and commercial spyware vendors used Claude to build, run, and otherwise facilitate surveillance operations. These cases include threat actors from China, Iran, and West Africa, as well as the commercial "surveillance-for-hire" market, and range from operations carried out by a single individual to entire teams.

First, AI is now being used in place of an engineering workforce. A single consultant working for Malian national security authorities used Claude to engineer a mass-interception platform capable of surveilling communications on all of the country's mobile operators and generating dossiers on targets. In this case, Claude was not used to analyze the surveillance dossiers but to design the underlying software that enabled the intelligence gathering.

SURVEILLANCE · 趋势二、三 Second, AI is being used not only to build tools but to ingest data in bulk to identify targets. In one case, an actor uploaded batches of social media posts and directed Claude to produce structured records that outlined targets' locations, demographic data, and political leanings, along with confidence scores. Similarly, an Iranian unit used Claude to analyze hundreds of thousands of social media posts and selected 39 opposition accounts to monitor.

Third, AI is being fully integrated into states' security bureaucracy. One PRC state security bureau used Claude to produce an internal manual on how to use AI in surveillance operations, suggesting that AI models are being deeply integrated into the daily work of state actors.

CONVENTIONAL WEAPONS · 常规武器 Conventional weapons — Detecting and countering the use of Claude in conventional weapons activity

Since publishing our last threat report in November 2025, we have identified new categories of threat actors misusing Claude in violation of our Usage Policy and terms of service. One of these is the use of Claude to develop software for conventional weapons, including firearms, missiles, armed drones, bombs, and other munitions, as well as the targeting and control systems that operate them.

Over the past year, our threat intelligence teams have investigated and disrupted multiple threat actors who used Claude to develop software for weapons design and development, or to support the intelligence gathering and procurement that weapons programs depend on. In this report, we share details on six of these cases: three in China, two in Russia, and one in Yemen.

CONVENTIONAL WEAPONS · 个案 GTG-17001 GTG-17001: Disrupting a China-based operation using Claude to draft a fire control specification and acquisition documents for undersea warfare

We identified a China-based threat actor who used Claude to advance three parallel tracks of work on an anti-torpedo weapons system:
• First, the actor used Claude to draft a Chinese-language specification for an anti-torpedo fire control system (the core logic that aims and times an anti-torpedo weapon's response). The document was written to win approval from a Chinese defense manufacturer, which would move the work on to technical certification and operational testing.
• Second, the actor used Claude to produce a Chinese-language technical proposal of more than 200 pages, accompanied by an executive briefing deck.

We assess the actor was associated with a Chinese defense industry manufacturer aiming to produce a weapons specification and acquisition proposal for the People's Liberation Army Navy. ... We cannot attribute the activity to a specific entity or actor.

BIOLOGICAL MISUSE · 生物滥用 Biological misuse is one of the most serious risks of frontier AI models. It has long been a concern that AI models might one day reach the level of capability where they can help to make existing pathogens more dangerous—or create entirely new ones. Without the correct safeguards, such capabilities could have catastrophic consequences.

Results from evaluations of older models (for example Claude Opus 4 and Claude Sonnet 4.5, from 2025) clearly showed that these models were well below the threshold where they could meaningfully assist a sophisticated user in carrying out dangerous biological research. ... But for today's models—which are capable of assisting in a range of complex scientific research tasks—the evidence is no longer certain, and we cannot make that same assurance.

BIOLOGICAL MISUSE · 五起案例 Here, we present five case studies of actors using our models in ways that could support biological weapons development. ... In the first example, a reseller platform evaded regional blocks to serve virologists working on a state-sponsored grant to pursue chikungunya gain-of-function work. In the second, a researcher in an unsupported region spent weeks planning avian influenza mammalian-adaptation experiments with Claude, but classifiers confined the work to our weakest models. ... And in the final case study, a researcher computationally redesigned toxins for a national program, asking Claude to keep the agents' identities deliberately vague in progress reports.

We are withholding the names of research institutions, the countries wherein the activity took place, and the specific biological agents or research techniques involved. The individuals implicated in these case studies are working scientists. We do not assert that they intended harm, and identifying them or their labs could expose them to harm.

SCAMS AND FRAUD · 诈骗与欺诈 GTG-15001: Deceptive dating app network

GTG-15001 reflects the reach and the limitations of existing AI models for fraud and scam activity. A China-based app studio used Claude to both build a network of over 20 dating apps and power the AI personas used to converse with users—despite advertising their service as fully human. Over a two-week window in April 2026, we discovered more than 4,700 distinct AI personas that engaged in conversations with at least 25,000 unique individuals.

The studio also recruited real people and mixed them into the same match feed as the bots. These people were primarily included for authenticity checks (live video calls and social media follows) to decrease skepticism by the scam's victims.

ILLICIT DISTILLATION · 非法蒸馏 Since we published our first disclosure in February, we have identified and disrupted additional distillation attacks against Claude from seven labs based in China.

What is illicit distillation?

Distillation itself is a legitimate training method. Researchers use a larger, more capable "teacher" model to generate responses to a set of inputs, then use those exchanges to train a smaller "student" model to mimic the teacher. Distillation is commonly used because it reduces the resources needed to achieve more advanced capabilities.

We define illicit distillation as an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization. Illicit distillation is typically enabled by fraud: sophisticated networks of fake accounts created with stolen credit cards, login credentials, and API keys.

ILLICIT DISTILLATION · 个案与隐私 Operators affiliated with Alibaba ran the largest distillation attack we have ever [measured]. ... Alibaba's illicit distillation campaign peaked at nearly 3 million exchanges per day ... Scale of distillation attacks attributable to Alibaba between May and July 2026: over 151 million.

Additionally, these findings raise concerns about the misuse of user data by PRC AI labs. DeepSeek, Xiaomi, and Moonshot fed conversations between their own models and users into Claude. These labs then used Claude's responses as training data with which to distill Claude's capabilities. Some of these exchanges included sensitive information ... These practices are likely inconsistent with privacy laws and the labs' own terms of service.