Anthropic reports Claude misuse by state-linked actors, criminals, and AI-model replicators

Anthropic Says Russian, Chinese Threat Actors Used Its AI Model Claude For Malicious Activity Authored by Aldgra Fredly via The Epoch Times, Anthropic said on Sept. 10 that it had disrupted malicious campaigns involving the use of its artificial intelligence model Claude, including operations allegedly linked to threat actors in China and Russia. The company said the threat actors include suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals. According to its report, most of the cyber operations detected between December 2025 and August 2026 were enabled by AI through direct execution or orchestration. Humans remained involved in selecting targets and reviewing exfiltration, it stated. "The use of AI went beyond simple questions and responses from a chatbot but rather involved the use of multi-agent frameworks executing reconnaissance, exploitation, and data exfiltration," Anthropic said. Among the threat actors named by the company was a group linked to Russia-based Midnight Blizzard. Anthropic alleged that the group used AI to attack military intelligence targets in Ukraine and Europe, as well as diplomatic and defense organizations and individuals connected to U.S. foreign policy. Anthropic said it also disrupted distillation attacks against Claude from seven labs based in China, including operators allegedly linked to Alibaba, DeepSeek, Xiaomi, and Moonshot. The company defined distillation as "an industrial-scale, covert campaign" aimed at illegally extracting the capabilities of an AI model and replicating them in another model. Operators linked to Alibaba, China's largest e-commerce platform, carried out the largest distillation attack to advance the reasoning capabilities of Alibaba's models, generating more than 151 million exchanges between May and July 2026, the report found. The activity peaked at nearly 3 million exchanges per day launched from over 3,500 accounts that Anthropic deemed fraudulent. Anthropic also alleged that Chinese AI company Moonshot secretly forwarded customer requests to Claude and then displayed the resulting responses to users as if they were generated by its AI model Kimi. In one instance, Moonshot allegedly routed nearly 300,000 customer requests to Anthropic's model over a 10-day period using a proxy service network of 5,380 fraudulent accounts, most of which appeared to be located in Singapore and Japan, according to the report. "Our investigation also revealed that user queries that Moonshot rerouted to Claude included sensitive information about various Moonshot customers," Anthropic said. "We do not know if Moonshot notified their customers that their requests were being rerouted to Anthropic and exposed to a third party." The report also identified new categories of threat actors misusing Claude, including those who seek to develop "software for conventional weapons, including firearms, missiles, armed drones, bombs, and other munitions." Anthropic said it disrupted a "guided weapons engineering cell" operating three weapons development programs in northern Yemen that used Claude "to develop the guidance, navigation, and control (GNC) software that steers and stabilizes a flying vehicle." According to the report, the threat actors allegedly test-fired a guided rocket but failed, prompting them to seek guidance from Claude to identify the cause of the failure. Among other newly categorized threat actors was a China-based threat actor that used Claude to advance three parallel projects on "an anti-torpedo weapons system." Anthropic also identified alleged Russia-based freelance threat actors who sought to build a "full-stack autonomous first-person-view kamikaze drone swarm" and another Russia-based actor who used Claude to research and draft procurement documents for goods likely intended for the Russian government and defense industry customers. The company said it would continue to strengthen its safeguards and work with partners to prevent misuse of its AI model. "In each case, we disrupted the activity, used what we learned to strengthen our safeguards, and shared intelligence with authorities and industry partners, where appropriate," it stated. Tyler Durden Fri, 09/11/2026 - 13:35

Artificial intelligence is increasingly being used not just to help people carry out malicious activities, but to take over several steps of those operations, according to a new report by AI company Anthropic.The company said it identified and disrupted attempts to use its Claude AI models for cyberattacks, espionage, surveillance, scams, influence operations, conventional weapons development and research that could potentially support biological weapons development between December 2025 and August 2026.The cases ranged from a Russia-linked cyber espionage campaign and an automated fake-news operation in Bangladesh to systems designed to identify dissidents and attempts to use Claude in research involving viruses and toxins.Anthropic said the actors involved included suspected state-sponsored groups, criminals, commercial spyware companies, propaganda organisations and politically motivated individuals.The findings are detailed in Anthropic's 154-page report, Detecting and Countering Misuse of AI: September 2026, the company's fourth threat intelligence report. Anthropic said it was publishing the findings because it had a “responsibility to disclose malicious misuse” of its services.The company said its Claude Haiku, Sonnet and Opus models were used in the cases examined. None of the cases involved Claude Fable or its Mythos-class models, except for one case involving attempts to copy the capabilities of its AI through a process known as distillation.Across the cases, Anthropic said it has seen a change in the way AI is being misused. The concern is no longer simply that someone can ask an AI chatbot to write malicious code or provide instructions. Increasingly, AI can be connected to other software and used to carry out several parts of an operation.AI is doing more of the workOne of the biggest findings of the report is that AI is increasingly being used to do more than provide information or write computer code.Anthropic said attackers are using AI to handle several parts of an operation — from finding potential targets and looking for weaknesses to stealing and processing information.In some cases, several AI systems were used to work on different tasks at the same time, with humans setting the broad objectives and checking the results. This could make sophisticated attacks possible with fewer people and less technical expertise than would traditionally have been required, Anthropic said.The company added that AI can also make existing attacks faster and easier to repeat on a larger scale.Chinese-speaking group targeted about 50 organisationsAnthropic described one espionage operation involving Chinese-speaking operators it believes were likely based in Changsha in China's Hunan province.The group used Claude in an operation targeting about 50 organisations, including companies and government agencies across sectors such as education, healthcare, finance, energy and technology.According to Anthropic, the attackers stole hundreds of megabytes of student data from an education technology company. They also gained access to the systems of a retail company and obtained citizen records from a Southeast Asian government agency, including names, phone numbers and home addresses.The group also used AI to look for weaknesses in security products and develop ways of exploiting them, Anthropic said.The company said it banned accounts associated with the group and introduced additional measures to detect similar activity.AI-generated fake news targeted rural BangladeshAnthropic also identified an automated operation in Bangladesh that used Claude to generate fake Bengali-language news supporting the Awami League and attacking its political opponents.The operation was run by a single actor who used 29 Claude accounts, according to the company.Anthropic said the actor generated at least 1,500 headlines, 300 fabricated stories and 1,500 image prompts. The material was intended for Facebook, YouTube and TikTok videos aimed at rural audiences, particularly people with limited literacy.The actor's own communications described the material as “fake news” and said it should be “hot and aggressive” while being simple enough for village audiences to understand, Anthropic said.The content attacked the Bangladesh Nationalist Party, Jamaat-e-Islami, the National Citizens Committee, the interim government and student protest leaders.Anthropic stressed that it found no evidence that the Awami League itself directed or funded the operation.The company also said some of the narratives aligned with pro-Indian geopolitical interests, but it found no evidence of state involvement or funding.The operation was largely automated, with AI generating the material and other software turning it into videos and scheduling them for publication.Anthropic said it banned the accounts involved and shared information about the operation with relevant platforms and other partners.AI used to evade cyber defencesIn another case, Anthropic said a group whose activity was consistent with the Russia-linked Midnight Blizzard used AI to help its malware avoid detection.The system could reportedly identify when the malware had been detected by security software and then change the malware in an attempt to get past those defences.The group targeted military intelligence organisations, government agencies, diplomatic organisations and defence-related companies, Anthropic said.AI was used at several stages of the operation, including finding targets, maintaining access to compromised systems and stealing information.Surveillance and tracking dissidentsAnthropic also found cases in which Claude was used for surveillance.In one case, Iranian actors developed a system capable of identifying people through their social media accounts, the company said.Another case involved a contractor working for Malian national security authorities who allegedly used Claude to develop software for an intelligence-gathering operation.Anthropic said these cases point to a broader shift in how AI can be used in state-linked operations. “AI is now being used in place of an engineering workforce,” the company said.AI used in biological and weapons researchThe report also raises concerns about the use of AI in biological research.Anthropic said it identified five cases involving people using its models in ways that could potentially support biological weapons development.The research included work involving chikungunya, a highly pathogenic strain of avian influenza, viruses from families that include smallpox and mpox, as well as venoms and other toxins.Anthropic stressed that the people involved were working scientists and that it was not claiming they intended to cause harm.The company said biological research is particularly difficult to assess because the same information can have both legitimate and harmful uses. Research that could potentially contribute to developing a biological weapon could also be used to develop vaccines or treatments.Anthropic also identified six cases in which Claude was used in developing software for conventional weapons, including firearms, missiles, armed drones and bombs, as well as systems used to control or target them.Anthropic says Alibaba tried to copy Claude's capabilitiesAnthropic also accused operators affiliated with Chinese technology company Alibaba of carrying out the largest attempt to copy the capabilities of its AI that it has ever measured.The process, known as distillation, involves repeatedly asking one AI model questions and using its answers to improve another AI model.Anthropic said Alibaba's campaign focused on Claude's ability to reason through difficult tasks. The company said the responses were collected and used to train Alibaba's Qwen AI models.The campaign peaked at nearly three million exchanges a day, Anthropic said, involving more than 3,500 fraudulent accounts.Between May and July 2026, Anthropic said it recorded more than 151 million exchanges that it attributed to Alibaba's activity.The requests focused on areas such as software development, AI agents and other tasks requiring complex reasoning.Anthropic also alleged that Alibaba used Claude to help with its own AI research and development, including work on systems used to train its models.The company said Alibaba initially accessed Claude through nearly 5,000 fraudulent accounts, using measures such as disposable email addresses and virtual payment cards to disguise the accounts.After Anthropic blocked those accounts, Alibaba shifted to another group of accounts, the company said.Anthropic also accused Chinese AI firms Moonshot and DeepSeek of using Claude's outputs in similar attempts to improve their own models.In Moonshot's case, Anthropic said nearly 300,000 customer requests were sent to its systems over 10 days through a network of 5,380 allegedly fraudulent accounts.The company said some of those requests may have contained sensitive customer information and raised concerns about whether users knew their requests were being routed through Anthropic.What this meansAnthropic refers to the benefit attackers get from using AI as “uplift,”  essentially, how much faster, larger or more effective an operation becomes with AI.The company said the cases in the report are not necessarily representative of everyday misuse. They are among the more significant or unusual cases identified by its threat intelligence team.Anthropic said it had incorporated its findings into its processes “to better prevent, detect, and disrupt these activities in the future” and had shared intelligence with authorities and industry partners where appropriate.The report comes amid growing warnings from AI researchers and industry leaders about the risks posed by increasingly capable AI systems. An Anthropic engineer, Jacob Coxon, recently stepped down after warning that AI could pose an extreme risk to humanity, including the possibility of AI killing everyone by the end of the decade. An Anthropic safety researcher has also warned of the possibility of catastrophic harm, while OpenAI chief scientist Jakub Pachocki has called for the industry to consider “voluntary slowdowns” until adequate safeguards are in place.But Anthropic’s 154-page report offers a picture of risks that are already playing out: AI being used to automate cyberattacks, produce political disinformation, conduct surveillance, support weapons-related work and potentially assist dangerous biological research.The challenge for AI companies, the report suggests, is no longer only preventing models from directly providing harmful information. It is also understanding how increasingly capable AI systems can be combined with other tools and used to carry out real-world operations with limited human involvement.This piece was first published by The News Minute. Become a joint subscriber here.