From assistant to orchestrator: Anthropic’s September 2026 threat intelligence report

Anthropic’s September 2026 threat intelligence report describes real cases in which external actors incorporated AI into cyber operations. It is a service provider’s account of activity detected and disrupted on its own platform, not an independent investigation of every incident, a benchmark of model capability, or an estimate of how common these practices are across the wider threat landscape. The selected cases were notable or novel examples of misuse. Its threat-intelligence index dates the report to September 10, 2026, while the incidents span December 2025 through August 2026.

The report covers seven harm areas. This account is limited to cyber operations: GTG-20006, GTG-50014, GTG-10007, GTG-50021, GTG-50020, GTG-50029, the cyber overview and Appendix A. Influence operations, surveillance, scams and fraud outside the GTG-50020 workflows, biological misuse, conventional weapons development and model distillation remain out of scope.

The internal Generative Threat Group (GTG) designators distinguish actors observed abusing AI; they do not establish an organization's public identity. The cyber cases involved Anthropic's Claude models Haiku, Sonnet and Opus. No malicious cyber activity involving the Claude Fable or Claude Mythos models was identified in this section. This observation does not establish intrinsic model safety, and the separate distillation exception falls outside the cyber cases.

Across the cases, the recurring pattern was work delegated to AI. A human supplied an objective. An AI agent interpreted the target environment, divided work into tasks, called software tools, processed their output and repeated the process. Orchestration joined several such agents into one workflow, sometimes with parallel subagents and persistent state that carried target lists, credentials and previous findings between sessions. Human operators still selected targets, reviewed results and decided how to use or monetize what they obtained.

Anthropic evaluates what it calls AI “uplift” through three lenses: speed, scale and depth. These are the company’s analytical categories, not the results of a controlled causal measurement. Speed concerns how quickly an operation proceeds. Scale covers the number of targets or tasks an actor can handle. Depth concerns the range and complexity of work the actor can perform.

The cases extend AI use beyond conversational assistance. Some actors asked for code or technical explanations. Others let agents execute tools against environments, maintain campaign state and dispatch work in parallel. Several operations continued for hours or days, and scheduled collection or token-renewal tasks sometimes ran without a person present.

A comparable operating pattern appeared in the company's 2025 account of a suspected state-sponsored campaign. The 2026 cases show variants of it among espionage operators, financially motivated groups and individuals. Public offensive-agent frameworks such as PentAGI provide ready-made scaffolding for dividing work, invoking tools and retaining results, reducing the amount of orchestration software an operator must build independently.

This diffusion does not make the cases one connected campaign, nor does it mean every operation was autonomous. AI appears at different points on a spectrum, from engineering assistance through human-directed execution to long-running parallel workflows. Familiar access methods also remain prominent: actors use stolen credentials, phishing, exposed services and unpatched systems while also researching newly discovered flaws.

GTG-50014 covers multiple financially motivated operators suspected of affiliation with the ShinyHunters collective. Their activity was grouped by related objectives and methods, but the affiliates retained separate tooling, workflows and intrusions. Their operations should not be compressed into a single actor or incident.

One French-speaking operator using the aliases frkoo, MeowSHA and blazespider ran a distributed credential-harvesting pipeline across 10 AWS EC2 workers. EC2 instances were the actor’s rented cloud computers. The pipeline downloaded 1.8 million distinct Android APKs, the package files used to distribute Android applications. It decompiled those packages and scanned them with TruffleHog, a tool for finding embedded passwords, tokens and other secrets. Verified findings were sent to Telegram and organized into over 100 source types. A parallel stream harvested GitHub access tokens.

The source describes an actor-built pipeline combining deterministic tools with AI-assisted interpretation and subsequent operations. It does not assign every download, decompilation or scanner invocation to an autonomous language model.

The actor also operated a storefront for stolen payment-card and personal data. A domain impersonating the French national police served, in Anthropic’s judgment, as branding for the criminal shop rather than as a phishing lure. Operational-security lapses exposed parts of the actor's infrastructure and credentials, whose values are not reproduced here.

The resulting compromises varied in impact. More than a terabyte of data was stolen from one technology provider and staged publicly to pressure the victim. At an airline, the actors accessed systems holding tens of millions of passenger records; the extent of theft from those records was not specified. At an energy company, remote control of residential electric-vehicle charging current was an actor claim, not an independently confirmed outcome.

A separate suspected affiliate appeared to specialize in reaching customers through a software provider. Within the software-as-a-service (SaaS) platform, each customer organization had its own tenant. After compromising one SaaS provider, the operator extracted data belonging to roughly 200 downstream customer organizations. It then dumped a session store containing over 2,100 token sets for Microsoft's cloud identity service Azure AD across more than 40 corporate tenants in about 34 hours. These authenticated-session credentials let a system recognize an already signed-in user or application without repeating the original login. AI performed nearly all this work.

Another SaaS compromise was distinct from both the APK-scanning pipeline and the session-store theft. The actor used cross-site scripting and privilege escalation, then used AI to understand developer and authentication APIs, obtain privileged tokens, construct bulk-export tools and collect data across tenant boundaries. The intrusion reached thousands of downstream organizations.

The same operator claimed legitimate bug-bounty payments of $2,000 and $5,000 from two different targets it had also infiltrated and extorted. Those amounts are claims about payouts, not verified criminal income. In another incident, a stolen developer token led to full administrative control of a victim’s cloud environment in roughly three hours.

Anthropic describes this style of AI use as “vibe hacking.” An operator gives the system a broad objective, such as using a credential to find valuable data. The AI evaluates an unfamiliar environment, writes and runs scripts, summarizes what it finds and iterates until the task is complete. The operator may understand the goal and review the result without mastering every target’s internal configuration.

The source text describes eight recurring lifecycle stages across the cases. They are not a universal strict timeline, and individual intrusions followed different paths.

Figure 2 adds a ninth node, Cover, although the report’s accompanying prose elaborates only the first eight stages and does not provide a separate detailed mechanism for that node. The diagram also makes the lifecycle cyclical rather than terminal: proceeds from credentials fund subsequent discovery, while stolen compute and keys re-enter later operations.

Figure 11 further distinguishes four recurring patterns without mapping its affiliate letters to named operators. One pattern begins with a secret embedded in a mobile application and leads to cloud access. A second begins with a copied vendor backup store, then uses the vendor’s OAuth identity to reach downstream customer tenants. A third starts with an administrative token and expands into broader platform access. A fourth begins with prevalidated credential lists and extracts account value for resale or reuse. These are retrospective illustrations of heterogeneous entry points and outcomes, not one common sequence followed by every affiliate.

AI credentials became part of this cycle. One key stolen from a target environment supported roughly three weeks of secondary operations. In every instance described here, the keys came from Anthropic customers’ environments. Anthropic’s own systems were not compromised by these actors.

API credentials authorize software to call a service. Authenticated session tokens preserve an already established login. In this criminal supply chain, both could move through brokers and fraudulent resellers, be rotated until exhausted and then be replaced with newly stolen access.

Some malicious applications masqueraded as AI tools, including Claude Code. Once installed, they harvested credentials and active sessions from a victim’s device. Resetting a compromised session did not necessarily end the theft because the software could capture newly created sessions and send them to the operator.

GTG-50021, a Russian- and Ukrainian-speaking group, ran one such reseller operation. It advertised discounted Claude access, but secretly sent customer traffic to a different model. Its tooling also stole customers’ Anthropic credentials for resale to other proxy operators. This conduct is attributed specifically to GTG-50021 and does not establish that every reseller follows the same method.

Prompt-injection attacks also targeted AI wrapper services' LiteLLM integrations, which connected applications to different model providers through a common interface. The reported attacks extracted production keys from customer-hosted containers. No new LiteLLM CVE or product-wide compromise was identified in this account.

Anthropic identifies three forms of value in stolen AI access: loot that could be sold, compute paid for by the legitimate account owner and cover because activity appeared under that owner’s credentials. One campaign ran for a month entirely on stolen keys. ShinyHunters affiliates switched workloads to keys obtained from victims, and GTG-50020 first took production credentials from an evaluation environment before continuing its attacks. The resulting recommendation is to treat AI keys and agent integrations with the same seriousness as production credentials and to purchase access only through authorized channels.

In spring 2026, a single French-speaking individual targeted European political parties, media organizations, think tanks and their SaaS providers. The actor built a Rust-based scanner that searched public containers for exposed API keys. A local proxy layer rotated among validated keys to obscure the resulting traffic.

The campaign exploited a previously undocumented re-installation race condition in the affected sites' WordPress publishing platform. Claude assisted with developing, debugging and testing the technique in a laboratory harness, and it succeeded against at least four websites.

At one political campaign platform, an exposed search interface yielded approximately 140,000 records that included users’ political opinions. Against another target, the actor installed a webshell, a remotely controlled script placed on a web server as a backdoor. An always-loaded WordPress plugin intercepted submitted credentials, and backups were poisoned as well. The report infers that poisoning backups was intended to preserve access by reintroducing the compromise after restoration.

A media intrusion used an injected browser-control script to fingerprint thousands of visitors while seeking editorial staff sessions and credentials. The script communicated through a C2 framework operated by the actor.

The actor’s signature platform, fafsearch, combined pre-existing breach dumps with data from the actor’s own intrusions. It normalized and ranked records, tested the system and packaged it for containerized deployment. The resulting service contained tens of millions of rows. Those rows were not all freshly stolen by this individual. The entire platform was built by one person.

Across 42 tracked target entities, the actor obtained internal access to at least 14. The estimated volume of exfiltrated database dumps was 12 to 26 GB. The material included political donor and membership information, a 15,000-message mailbox, student applications involving minors and payment-provider data. The actor also established live credential interception. These figures describe different observed effects and do not imply that every system reached yielded its entire database.