What did Anthropic's September 2026 threat intelligence report find?

Published September 10, 2026, the report covers misuse Anthropic disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons and illicit distillation. Headline cases include a Midnight Blizzard-linked Russian espionage actor that automated malware rebuilding and phishing with Claude Code skills, five biology cases where researchers evaded regional blocks to pursue dual-use work, and distillation campaigns by seven China-based labs. All misuse ran on Claude Haiku, Sonnet and Opus; none on Fable or Mythos except one distillation case.

What is the Alibaba distillation attack Anthropic described?

Anthropic attributes the largest distillation campaign it has ever measured to operators affiliated with Alibaba's Qwen/Tongyi Lab (tracked as GTG-16005). The pipeline injected a fixed prompt forcing Claude Opus 4.6 and 4.7 to write chain-of-thought reasoning inside inline tags, then saved those traces as supervised fine-tuning data for Qwen 3.5, 3.6 and 3.7. Anthropic counted over 151 million exchanges between May and July 2026, peaking at nearly 3 million per day from more than 3,500 fraudulent accounts, after banning an earlier pool of nearly 5,000.

Did DeepSeek and Moonshot really route users to Claude?

According to Anthropic, yes. It says Moonshot AI silently forwarded almost 300,000 Kimi customer requests to Claude over a ten-day period through 5,380 fraudulent accounts, and DeepSeek tagged users of coding harnesses like Claude Code, the Claude Agent SDK and OpenCode and relayed selected requests to Claude Opus. Both used a cross-session replay attack to convert Claude's 'thinking signature' back into full reasoning traces for training. Anthropic counted 23 million exchanges attributable to Moonshot (May–July 2026) and 12.1 million to DeepSeek over 14 days in July. The companies had not publicly responded in detail at publication.

Why does Anthropic say Fable and Mythos were not misused?

Anthropic states that no malicious cyber activity was found on Claude Fable or Mythos-class models, which ship with stronger safeguards that degrade harmful cyber tasks, and that only one distillation case touched Fable. It cites Zhipu (Z.ai) trying to distill Fable's cyber capabilities ahead of GLM 5.3, giving up when safeguards degraded the attack, and switching to Opus 4.6 and another US lab's top model because 'the safeguards were weaker.' Anthropic uses this to argue for trusted-access programs rather than classifiers alone for frontier biological and cyber capabilities.

Quick Answer

Anthropic's September 2026 Threat Report, Explained

Published: September 13, 2026

What the report is

On September 10, 2026 Anthropic published Detecting and countering misuse of AI: September 2026, its fourth public threat-intelligence report after March, August and November 2025. It covers operations disrupted between December 2025 and August 2026 across seven harm areas — cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development and illicit distillation — each written up as a numbered “Generative Threat Group” (GTG) case study.

Two framing facts sit at the top. First, all misuse ran on Claude Haiku, Sonnet and Opus; none involved Fable or Mythos-class models except one distillation attempt. Second, Anthropic measures “uplift” — how much more harm AI enabled versus none — through speed, scale and depth, and its conclusion is that AI has “collapsed the labor and tooling gap” between state operations and lone individuals.

Cyber: from assistant to orchestrator

The cyber section’s thesis is that sophistication no longer identifies the attacker. Three actors with very different resources ran similar multi-victim, agentic campaigns:

GTG-20006 (Russian espionage, consistent with Midnight Blizzard). An operator using the handle “JackPoterz” ran AI-driven workflows spanning tool development, domain registration, phishing, C2 persistence and exfiltration. The notable technique: monitoring agents watched whether deployed malware was detected by security products and autonomously rebuilt it until it wasn’t. Targets exceeded 20 organisations — Ukrainian and European ministries, defence and intelligence bodies, embassies, and military drone suppliers, including theft of a complete drone vision-system SDK. The human mostly edited the Claude Code skills that drove the workflows.
GTG-50014 (ShinyHunters affiliates) — financially motivated “smash-and-grab” crews harvesting credentials from mobile apps and switching their workloads onto victims’ stolen AI keys.
GTG-50029 (hacktivists) — ran for a month entirely on stolen API keys, using a sub-agent framework for reconnaissance, code review and cross-model vetting, planting webshells among font assets and poisoning backups for persistence.
GTG-10007 — Chinese-speaking operators in Hunan (two undergraduates, one interviewing for an offensive-cyber role) ran an exploit-development and reconnaissance programme with collection fleets that kept operating on a schedule while owners were away.

A marketplace has formed around this: GTG-50021 sold “discounted Claude access” that silently proxied traffic to a different model while a credential harvester stole buyers’ Anthropic logins. Public offensive frameworks such as PentAGI reproduce the autonomous kill-chain scaffolding Anthropic first documented in November 2025.

Biological misuse: five dual-use cases

Anthropic says it is the first private company to publish evidence of its platform potentially being used toward biological weapons. The five cases are deliberately anonymised:

A reseller platform evaded regional blocks to serve virologists on a state-sponsored chikungunya gain-of-function grant; the classifier blocked the exchanges, so the developer rerouted biology prompts to more permissive models — and had Claude write the routing code, framed as “over-refusal mitigation.”
A researcher in an unsupported region spent weeks planning avian influenza mammalian-adaptation experiments; classifiers confined the work to Sonnet 4 and Haiku 4.5, and Anthropic judged the uplift “primarily clerical.”
A reseller relay had Opus 5 draft a complete orthopoxvirus immune-evasion grant application in about an hour.
A state-supported researcher built a venom-peptide atlas and generative optimisation pipeline spanning analgesic and paralytic targets (Australia Group-controlled toxins).
A researcher computationally redesigned toxins for a national programme and asked Claude to keep the agents’ identities vague in progress reports.

Anthropic’s takeaway is institutional, not technical: classifiers cannot distinguish intent in dual-use science, so “the only safe way to serve frontier biological capabilities is to offer them in trusted user programs” — the approach behind Fable’s stronger safeguards and OpenAI’s GPT-Rosalind deployment.

Illicit distillation: seven Chinese labs

The section that drew the most coverage. Anthropic defines illicit distillation as “an industrial-scale, covert campaign to extract a model’s capabilities and replicate them in another model without authorization,” typically via fraud — fake accounts, stolen cards, stolen API keys, and “transfer station” proxy services. It attributes campaigns with high confidence to specific PRC labs:

GTG	Lab	What Anthropic alleges	Scale
16005	Alibaba (Qwen / Tongyi Lab)	Fixed prompt forced Opus 4.6/4.7 to emit chain-of-thought in inline tags; traces became SFT data for Qwen 3.5, 3.6, 3.7; Claude also used to build RL environments and architecture research	>151M exchanges, May–Jul 2026; peak ~3M/day from >3,500 fraudulent accounts
16002	Moonshot AI (Kimi)	Silently forwarded Kimi customer requests to Claude and displayed the answers as Kimi’s; CoT extraction via cross-session replay of the “thinking signature”	~300K requests in 10 days via 5,380 accounts; >23M exchanges May–Jul
16001	DeepSeek	Tagged users of Claude Code / Agent SDK / OpenCode harnesses and relayed selected requests to Opus; same replay attack	>12.1M exchanges in 14 days of July 2026
16006	Zhipu (Z.ai)	CoT cleaning pipeline against Opus 4.8 via 273 rotating accounts; tried to distill Fable’s cyber capabilities before GLM 5.3, gave up, switched to Opus 4.6 and another US lab’s model	770,609 cleaned exchanges in 10 days; >3.4M in 17 days
16008	Xiaomi	Distillation campaign (details in report)	—

The privacy angle is new: because Moonshot and DeepSeek relayed their own users’ traffic, Anthropic says it saw sensitive data pass through — a PLA-affiliated user analysing CCTV footage from Chengdu, an engineer’s live credentials for major PRC companies, a Russian defence-agency database login, and a municipal Public Security Bureau case-management tool. Anthropic notes these users “had no way of knowing” their requests reached Claude.

The technical novelty is the cross-session replay attack: Claude returns a “thinking signature” reference instead of raw reasoning; attackers saved the signature, opened a new session, and elicited Claude to reconstruct the full trace. Anthropic says it is deploying new defences.

Why it matters for builders

If you use a Chinese model router or coding assistant, assume your prompts may have been relayed to a third party in 2026. Check the vendor’s data-handling terms and prefer self-hosted open weights for sensitive code.
API key hygiene is now a cyber-defence control. Multiple case studies ran on stolen keys; rotate them, scope them, and alert on anomalous spend.
Trusted-access programmes are becoming the norm for frontier bio and cyber capability — expect more gated model variants (Fable/Mythos, Gemini 3.8 Flash Cyber, GPT-Rosalind) rather than public endpoints.
The report coincides with policy moves: OpenAI’s September 9 call for mandatory US safety rules and CISA’s AA26-251A advisory on Chinese distillation both cite the same pattern.

What the report does not settle

Attribution is Anthropic’s, not a court’s; Alibaba, Moonshot, DeepSeek, Zhipu and Xiaomi had not responded in detail at publication. Scale figures count exchanges, not unique tokens or the fraction that became training data. And the bio cases are explicitly presented as evidence of intent to evade controls, not proof that Claude materially advanced a weapon.