AI stopped helping hackers. Now it does the job itself

On September 10 Anthropic published a 154-page report on how people tried to misuse its models. Inside are dozens of operations the company found and shut down between December 2025 and August 2026, across seven harm areas: cyber operations, influence operations, surveillance, scams, biology, conventional weapons and illicit copying of models.

I read the whole thing. It is the most honest document about AI I have seen this year, and also the most unpleasant. Because the real story is not that AI helps attackers. It is that AI now does the work for them.

The shift that makes the whole report worth reading#

The old picture was simple. A person asks a model how to write something malicious, the model refuses or answers, the person goes off and does the work by hand. Not anymore. In most of the operations described here, AI does not advise. It executes. Multi-agent systems run the reconnaissance, find the way in and pull the data out on their own. Humans are left with two jobs: pick the victim and collect the loot.

Anthropic frames this as the move from assistant to orchestrator. The operating model it first documented in November 2025 has since spread to every class of actor: state services, organized crime and lone individuals. Public offensive agent frameworks like PentAGI helped, because they hand the same scaffolding to anyone who downloads them.

The Russian campaign that rewrites its own malware#

The group tracked as GTG-20006, which Anthropic links to Midnight Blizzard, built a loop where AI watches how security products react and automatically rebuilds and redeploys the toolkit once it starts getting blocked.

That breaks the economics of defense. For twenty years the deal was this: defenders find the malware, write a signature for it, and the attacker spends weeks rebuilding. Now the rebuild takes hours and costs almost nothing. The cost has moved onto the defender's side of the table.

Targets: more than 20 organizations, mostly ministries, defense agencies, diplomatic missions and contractors in Ukraine and Europe. One thread of interest stands out, and that is drones. The attackers bulk-exported the mailboxes of at least two component manufacturers and stole an entire proprietary software development kit for a drone vision system. At a North African government technology authority they walked in through stolen VPN access and took the whole database: more than 300,000 national identity records plus the commercial registry of more than half a million companies.

Criminals caught up with governments#

The most staggering case by sheer scale is GTG-50014, tied to affiliates of the ShinyHunters crew. Here is what they did with agents:

• downloaded 1.8 million distinct Android apps, decompiled them and scanned for secrets left in the code;
• breached one software provider and reached data belonging to roughly 200 of its customers;
• dumped more than 2,100 sets of Azure AD tokens across more than 40 corporate tenants in about 34 hours, with agents doing nearly all of the work;
• at an airline, reached systems holding tens of millions of passenger records;
• at an energy company, claimed they could remotely change the charging current of electric vehicle chargers installed in people's homes.

Read that last one again. This is no longer a data leak story. This is the physical world in someone else's hands.

Students, agents and a dozen zero-days a month#

I read case GTG-10007 twice. The operation was run by Chinese-speaking operators likely based in Changsha in Hunan province. Two of them were identified as undergraduate students at a local university, in a school of computer and communication engineering. One had interned at the security company Sangfor and was interviewing at QiAnXin.

They assembled what Anthropic calls an exploit foundry: a pipeline where agents pull apart network appliance firmware around the clock, hunting for holes in parallel and keeping project memory across sessions. One such workflow produced more than a dozen likely zero-day findings in a single month.

A crew with students in it. One month. More than a dozen likely vulnerabilities. Ten years ago that was the output of an entire government directorate.

One person against political Europe#

In the spring of 2026 a single French-speaking activist went after European political parties, media, think tanks and their vendors. He wrote a scanner in Rust that hunted for exposed access keys in public containers, then learned to route his traffic through stolen keys so it blended in with the legitimate owner's activity.

His signature tool was called fafsearch, a purpose-built doxxing engine with ingestion pipelines, normalization of national ID and phone numbers and its own ranking logic. He loaded tens of millions of rows into it, including health identifiers and material from justice system breaches, and published the result as anonymous dark-web services. From a single political campaign management platform he exfiltrated about 140,000 records that recorded people's political opinions.

The new loot is access to AI itself#

A new category of prize has appeared. AI keys are valuable three times over: you can resell them, you can run your own attacks on someone else's bill, and you can hide behind them from investigators.

GTG-50020, which used to live off hotel and fintech intrusions (26 gigabytes out of one victim, extortion demands between 1.5 and 2.5 million dollars), turned on the AI industry itself. It injected malicious instructions into one vendor's automated evaluation sandbox and made the sandbox hand over production keys belonging to several providers.

Another group, GTG-50021, sold cheap access to Claude. The access was neither cheap nor Claude: traffic was quietly proxied to a different model while the seller's tooling installed a credential harvester and resold the victims' accounts onward.

The practical takeaway is simple. AI keys and agent integrations need the same protection as production credentials, because attackers already treat them that way. A discount that requires routing your traffic through an unknown middleman costs more than it saves.

A news factory across 70 websites#

The influence operations section holds nine cases. The most telling one was not run by a government but by a French advertising agency, LKM Company. The network looked like a set of independent local newsrooms: around 70 news sites, 70 matching X accounts and more than 250 accounts for comments. It published at least 8,913 articles in about 20 languages. Its political stance shifted depending on who was paying at the time.

Next to it sits BBS Bilisim Teknolojileri, an Istanbul company that sold an election manipulation platform aimed at Malaysia. A thousand fake accounts, a fabricated outlet called Malaysia Pulse, and voter profiling constituency by constituency built on ingested census and electoral data. In their own documentation the authors described it as a military-grade, real-time political operations ecosystem.

In Bangladesh the whole network was one man in Gaibandha district, rotating 29 accounts and running a homemade script that generated fake news in Bengali.

25 million SIM cards in one country#

The surveillance section is the hardest to read. A consultant in Bamako, working for Mali's state intelligence service, used Claude as an entire engineering department and built a platform called Lakana 360 that monitors roughly 25 million SIM cards across all three national mobile operators. It was deliberately designed to route around the Malian legal requirement for a court order: it produced a dossier on any phone number without asking intelligence staff for any legal grounds.

Then the list continues. An Iranian organization claimed to have profiled 6,388 citizens in a single year and ran analysis over 155,216 tweets. Chinese organs built dossiers on senior Catholic cardinals, the leadership of the Presbyterian Church in Taiwan, Tibetan Buddhist civil society and Falun Gong. A municipal cyber police unit ran a domestic sentiment monitoring program, and a police academy student named ten private citizens as targets.

A drone swarm that does not need a human#

Six conventional weapons cases: three in China, two in Russia, one in Yemen.

The Russian actors were building a full stack for a swarm of kamikaze drones: shared swarm memory, fault-tolerant coordination logic, a small onboard model to govern behavior, terminal guidance from the camera and the command to detonate. One of its target classes was a person, and the order to detonate could go out with no human in the loop. They called the project DronDoc, or Serafim.

In northern Yemen a cell ran three programs at once: a guided rocket using a phone-class processor as its flight computer, a ballistic missile with a stated range goal above 2,000 km, and the R2000 set including a hypersonic glide variant. Claude Code stood in for their software engineers and wrote the guidance and navigation code.

The Chinese cases are less cinematic but not less meaningful: a fire control specification for an anti-torpedo system plus a technical proposal running past 200 pages, a suite of 16 electronic warfare modules iterated to a twelfth version, and intelligence briefings on directed-energy weapons for restricted internal circulation.

Biology, where nobody tells the whole truth#

Five cases, and Anthropic deliberately withholds the institutions, the countries and the specific agents. The logic: these are working scientists, the company does not claim they intended harm, and naming them could put them at risk.

What is inside still chills you. Work to make chikungunya more dangerous under a state-funded grant. Planning for experiments adapting avian influenza to mammals. A grant application on immune evasion for an orthopoxvirus, drafted in about an hour. A venom peptide atlas with generative optimization. And a computational redesign of toxins for a national program, where the researcher asked the model to keep the agents' identity deliberately vague in progress reports.

Anthropic draws the comparison itself: the Soviet Biopreparat program, where thousands of researchers worked without knowing what the program was ultimately for.

4,700 people who do not exist#

There is a single fraud case, and it is instructive. A China-based studio built more than 20 dating apps, filled them with AI personas and advertised the service as fully human. Over two weeks in April 2026, 4,700 distinct personas talked to at least 25,000 people and sent around 2.36 million messages.

In the swipe feed, 75% of the profiles were the model and 25% were real people the studio hired as gig workers. The humans were there for the checks a model cannot pass: a live video call, a follow on social media. The apps were engineered to hide from store review: the interface changed only while review was running, and class names were deliberately varied across twenty-odd versions so the stores would not link them together.

One detail explains why this worked. In some exchanges the model's own reasoning registered that the person was in trouble, including cases where users disclosed serious illness. It stayed in character anyway.

Seven Chinese labs that copied Claude#

The final section is the toughest on facts. Since February, Anthropic has found and disrupted illicit distillation campaigns from seven labs based in China. Distillation is a legitimate training method, where a strong model's answers train a weaker one. What makes it illicit is industrial scale, concealment and account fraud.

• Alibaba ran the largest attack Anthropic has ever measured: a peak of nearly 3 million exchanges a day from more than 3,500 fraudulent accounts, and over 151 million exchanges between May and July. The harvested reasoning traces went into training Qwen 3.5, 3.6 and 3.7. Claude also helped build internal infrastructure and reinforcement learning environments there.
• Moonshot silently forwarded its own customers' requests to Claude and showed them Claude's answers as Kimi's. Almost 300,000 requests over ten days, through a network of 5,380 fraudulent accounts.
• DeepSeek did the same thing: more than 12.1 million exchanges over 14 days in July.
• Zhipu (known outside China as Z.ai) pulled reasoning traces to train its GLM models. One telling detail: after safeguards on Fable broke their attack, employees switched to Opus 4.6 and to another US lab's leading model because they judged the safeguards there to be weaker.
• Xiaomi replayed conversations and coding sessions from its own MiMo models through Claude, more than 400,000 exchanges over 20 days.
• SenseTime bought transcripts of other people's conversations with Claude from third-party data vendors, and MiniMax built its own proxy service through a shell company that hides its parent and sells access only to Anthropic and OpenAI models.

And here is the part that touches you personally. DeepSeek, Xiaomi and Moonshot fed their own users' conversations into Claude. Those conversations contained names, email addresses, company data and live access credentials belonging to hundreds of end users, in at least a dozen languages. Many of them arrived through third-party routing services popular in the US and Europe. So a person typed into one service, their data traveled to another country and a third company, and they had no idea.

What to do about it#

The report is easy to read as a thriller, but it has a practical layer. Here is what I took from it.

AI keys are production credentials now. Rotate them, scope them down and monitor them the way you monitor access to the database with the money in it.

Buy access directly. Any middleman with a suspicious discount is either stealing accounts or selling your conversations onward.

Signature-based defense is finished. If the attacker rebuilds the tool faster than you can ship a rule, defense has to run on behavior rather than fingerprints.

Agent integrations are attack surface. Sandboxes, proxies, wrappers and internal tools with access to your systems break exactly the way web apps break.

Data you hand to someone else's model takes on a life of its own. Especially if you reach that model through a router or a cheap intermediary.

The bottom line#

Anthropic disrupted every operation in the report, banned the accounts and hardened its defenses. Good. But the document reads like a first chapter, not like a closed incident.

Sophistication used to tell you who was behind an attack. A state did one kind of thing, a lone operator another. That rule is gone: a student, an activist and an intelligence service now run the same scaffolding and get comparable results. Which means you plan defense not around who might want to break in, but around what any motivated person with a subscription and a laptop can now do.

Defenders used to impose costs on attackers. Now the costs are imposed on us, and not by a person but by a task scheduler.