Anthropic's September Threat Report: Hackers Used Claude to Find Zero-Days and Run Influence Ops

Anthropic published its September 2026 threat intelligence report on September 10, covering malicious activity it detected and disrupted between December 2025 and August 2026. The report documents seven harm categories and includes detailed case studies on cyber operations and influence campaigns.

The findings are worth reading if you use Claude or any Claude-integrated tool at work, because stolen API credentials were a primary attack vector.

What attackers actually did

Autonomous attack frameworks. The biggest shift documented in the report is the move from “Claude as a research assistant” to “Claude as an autonomous attack operator.” Threat actors built multi-agent pipelines that ran reconnaissance, exploitation, and data exfiltration with minimal human oversight, around the clock, on scheduled jobs.

One group built a persistent campaign memory system that stored target lists, credentials, and custom instructions across sessions. Another used a framework called PentAGI to automate cyber kill chains. These aren’t people typing prompts to get hacking tips. These are engineered systems that run on their own.

Zero-day research at scale. One automated research workflow, documented in the report, produced approximately a dozen possible zero-day vulnerability findings in a single month. The report doesn’t attribute this to a specific group, but the volume suggests automation is changing what’s economically viable for individual threat actors.

Credential theft at the center. API keys were both the target and the tool. Attackers stole Claude API keys from enterprise customers, used fraudulent reseller services pretending to be legitimate Claude providers, and targeted AI vendor evaluation sandboxes to get production credentials. Stolen keys were then used as attack compute, sold, or used to cover tracks while conducting operations on other organizations.

This means a Claude API key leaking from your codebase doesn’t just expose your own usage costs. It can become a resource for attacks against unrelated organizations.

Influence operations at scale. Nine distinct campaigns used Claude to generate fabricated news content, coordinate fake social media networks, and create personas. Operations came from Russia, Iran, Turkey, and Gulf states, targeting audiences across six continents. The report describes these as state-aligned or commercially motivated disinformation, not simple spam.

Named threat groups

The report names two groups with enough specificity to be useful.

GTG-20006 is described as a Russian state-sponsored actor targeting Ukrainian and European organizations. The group used Claude-integrated tools for reconnaissance and phishing infrastructure.

GTG-50014, assessed as affiliated with ShinyHunters, focused on mass credential harvesting and supply-chain compromises. The group is financially motivated rather than state-directed.

The economic argument

A section of the report addresses why this is happening now. The key line: “AI has collapsed the labor and tooling gap” between state-sponsored actors and individuals.

Operations that previously required teams with specialized skills now run via automated pipelines operated by single actors. The cost and expertise barriers that once sorted “nation-state capable” from “individual capable” have compressed significantly.

This doesn’t mean every threat actor is suddenly capable of sophisticated attacks. But it does mean the distribution has shifted. More actors can now do more damage than before.

What Anthropic says it’s doing about it

The report describes Claude Fable and Mythos-class models as having safeguards that blocked harmful cyber tasks in the documented incidents. The company says it’s using the findings to improve detection and refine safety measures.

A PDF version of the full report is available on Anthropic’s site for organizations that want the technical detail.

What it means if you use Claude API

A few practical takeaways from the report’s findings:

Your API keys are a target, not just a cost exposure. Rotate them regularly, use environment variables (never commit them), and scope them with usage limits if your provider supports it.

AI vendor sandboxes and evaluation environments are being probed for production credentials. If you run Claude evaluations, treat those environments with the same access controls as production.

The autonomous attack frameworks described in the report use public AI capabilities. They’re not exploiting unknown vulnerabilities in Claude. They’re using the same features any developer uses, just at scale and for malicious purposes.

The full report: Detecting and Countering Misuse of AI: September 2026