Blog Trust
The Hidden Danger in AI Agents: Anthropic's Threat Report, Explained
What the report covers
On September 11, 2026, Anthropic published a threat intelligence report covering December 2025 to August 2026: eight months of people misusing Claude across seven harm categories. The video picks the cases you can picture. Everything below is Anthropic’s attribution, not ours.
Thirteen agents on a schedule
Anthropic attributes one operation to Chinese-speaking operators, two of them identified as undergraduate computer science students. They ran 13 standing AI agents on a schedule, without human supervision, to harvest US military and government open-source material. One month of vulnerability research against security appliances, the report says, yielded “more than a dozen possible zero day findings.” The word possible matters: these were candidate flaws, not confirmed exploits.
The other cases
A Russian state-linked group, which Anthropic ties to Midnight Blizzard, used Claude to identify, modify, and redeploy its malware each time security products flagged it. A single person built a doxxing platform that ingested tens of millions of rows, including national health IDs and justice system data. Elsewhere in the report: affiliates of a criminal group decompiling 1.8 million Android apps for hardcoded keys, roughly 70 fake news sites, and about a thousand fake social accounts aimed at an election. Anthropic says accounts were banned, indicators published, and authorities engaged.
The admission
The line that makes the report unusual is about limits. Anthropic may see an operation while it is being built on Claude, but “our visibility into these operations ends once it’s live.” And it adds that the capabilities described “should be assumed to be available to any actors who are motivated to use them.” Sophisticated attacks, in its phrasing, no longer require sophisticated attackers.
Why it matters for the stack
Agents that run on a schedule with no one watching are the same pattern that makes them useful for legitimate work, which is why a model provider can only police the building phase. Once a tool is deployed, the provider is out of the loop. The open question the video ends on is whether AI companies should get to see what you build in exchange for catching cases like these.
Sources: Anthropic’s threat intelligence report, September 2026.
Common questions
- Did the students hack the Pentagon?
- No. Anthropic says their 13 scheduled agents harvested US military and government open-source material, meaning publicly available information, and that a month of vulnerability research against security appliances produced more than a dozen possible zero-day findings.
- Which models were misused?
- Anthropic names Haiku, Sonnet, and Opus. It reports no misuse found on its Fable or Mythos-class models during the period covered.
- What does Anthropic say it cannot see?
- In its words, its visibility into these operations ends once they are live. It can catch an operation while it is being built on Claude, not once the resulting tool runs elsewhere.