What changed
Anthropic's September threat-intelligence report describes cases observed from December 2025 through August 2026 across cyber operations, influence, surveillance, fraud, biological misuse, weapons and model distillation. It says several cyber campaigns used multi-agent frameworks for direct execution while humans selected targets and reviewed results, and alleges large-scale distillation and live-user-query routing by other model providers.
Why it matters
The cases show how distributed accounts, stolen API keys, agent frameworks and external infrastructure can hide a coordinated campaign from any single model or cloud provider. The alleged routing of live user queries also makes vendor-to-vendor data handling a customer governance issue.
What to do
Rotate exposed AI credentials; correlate identity, payment, network, tool and egress signals across accounts and gateways; detect autonomous task chains; document whether vendors route prompts to third-party models; and review Anthropic's indicators before importing them into monitoring.
Caveat
Attribution, scale and operational details are Anthropic's findings and allegations, not adjudicated facts or independently reproduced measurements. Some evidence is necessarily withheld, and disruption does not establish that every related account, infrastructure path or victim has been identified.