Hours, not days: the defensive lessons of AI-run cyber operations

On 10 September 2026 Anthropic published its latest threat intelligence report, covering misuse of its Claude models that it detected and disrupted between December 2025 and August 2026. The report spans seven areas, from influence operations and scams to biological misuse and the unauthorised copying of model capabilities. Its cyber section matters most to anyone who runs systems connected to the internet, because it describes attackers who have moved from asking a chatbot for help to letting AI agents carry out large parts of an intrusion.

The cases include an espionage actor that Anthropic links, on the strength of public reporting, to the Russian group known as Midnight Blizzard; suspected affiliates of the ShinyHunters extortion collective; a Chinese-speaking team that included two undergraduate students; and a single French-speaking hacktivist. In one compromise, a single stolen developer token escalated to full administrative control of a victim's whole cloud environment inside about three hours. Anthropic's central conclusion is that AI has erased much of the labour and tooling advantage that used to separate state-backed teams from individual operators.

The report stresses that none of the operations depended on an entirely new technique. Stolen credentials, exposed services, unpatched edge devices and phishing appear throughout. What has changed is the staffing and the tempo, and that matters for every organisation whose detection and response processes assume an attacker working at human speed. The attributions and figures below are Anthropic's own assessments, based on what it could observe on its own platform.

Four cases, one pattern

The actor Anthropic tracks as GTG-20006 targeted more than 20 distinct organisations, concentrated in Ukraine and Europe: ministries, defence and intelligence bodies, embassies, think tanks and defence-industrial firms. Anthropic says its attribution is consistent with public reporting linking the actor to Midnight Blizzard, which the US government ties to Russia's SVR foreign intelligence service. Reuters' account of the report highlighted phishing, hotel Wi-Fi hijacking and WhatsApp account takeovers aimed at Ukrainian government, military and diplomatic targets.

The detail that stands out is a feedback loop. According to the report, AI agents checked whether the group's malware had been flagged by security products and, when it had, modified and rebuilt it until it was no longer detected. In the group's phishing workflows, the human operator mainly stepped in to refine the instructions that drove them.

The ShinyHunters-linked clusters were opportunistic rather than targeted. One operator ran a pipeline that downloaded 1.8 million Android app packages, unpacked them and searched for secrets that developers had hard-coded, then used verified finds to break in. Anthropic describes breaches of a technology provider, an airline where the attackers reached systems holding tens of millions of passenger records, and a software-as-a-service provider used as a foothold to take data from around 200 of its downstream customer organisations.

GTG-10007, whose operators Anthropic believes were likely based in Changsha in China's Hunan province, targeted roughly fifty organisations in sectors including healthcare, energy, finance and government. It ran sustained AI-driven research against security products, and one workflow produced more than a dozen possible zero-day findings in a single month. Finally, of 42 target entities Anthropic tracked for the French-speaking hacktivist, the actor got inside at least 14, running the campaign for a month on stolen API keys.

From chatbot to harness: how the work gets delegated

To see why these cases differ from earlier misuse, it helps to separate two ways of using a model. In conversational use, a person asks questions and copies answers into their own tools. In agentic use, the model sits inside a harness: software that connects it to a command line, a browser, scanners or a decompiler, lets it run code, read the output and decide what to try next.

Several groups in the report went further, running a lead agent that splits a job into pieces and hands them to many sub-agents working in parallel. GTG-10007 also kept persistent campaign memory, so target lists, harvested credentials and progress notes survived between sessions and an operation could resume where it stopped. It ran a fleet of thirteen collection agents that downloaded material from target websites on a schedule, with no human in the loop.

Anthropic places the cases on a spectrum. At one end, Claude acted as an engineering assistant. In the middle, it executed commands on victim networks while a human made each targeting decision. At the far end, multi-agent frameworks ran reconnaissance, exploitation and data theft against several victims at once for hours or days. The report adds that publicly available offensive agent frameworks now supply much of this scaffolding to anyone who downloads them.

Two caveats from the report deserve weight. Humans still chose the targets, decided how to monetise what was stolen and reviewed the results. And autonomy is not the same as harm: several of the most serious compromises came from operations in which a person directed every step.

Why skill no longer identifies the attacker

Investigators have long read sophistication as a clue to who was behind an attack, because advanced capabilities used to demand resources that mainly state-backed teams possessed. The report argues that this heuristic is breaking down. A hacktivist, a financially motivated crew and a state-linked espionage operator all ran multi-victim campaigns with similar agentic methods, at volumes no individual could handle manually.

In Anthropic's words, what now separates these classes of actor is "no longer sophistication but intent". The economic logic is simple. Reconnaissance, exploit development, tool building and sorting stolen data were the labour that set elite operations apart. When that labour is handed to models running in parallel, the cost of a campaign falls while the potential payoff stays roughly where it was.

The report draws the uncomfortable conclusion itself: cheaper operations make previously marginal targets worth attacking and favour higher-volume, lower-touch campaigns. Mid-sized firms, public bodies and specialist suppliers that assumed they were too small to attract a capable adversary should revisit that assumption.

Credentials, keys and the AI supply chain

The most practical thread in the report is how often intrusions began with a credential that should never have been exposed. Anthropic lists where legitimate customers leak API keys and session tokens: public code repositories, mobile app installation files, container images, websites and chatbots. Criminal groups mine those sources continuously and test whatever they find.

AI credentials have become a prize in their own right. The report says a stolen AI key gives an attacker three things at once: something to resell, compute paid for by the victim, and cover, because the activity appears to come from the legitimate account holder. ShinyHunters affiliates moved their own attack workloads onto victims' AI keys once they had them, and one stolen key was used for roughly three weeks to attack other organisations.

The tooling around AI is under attack too. One Russian-speaking group planted malicious instructions in an AI vendor's automated evaluation sandbox, which then handed over the production API keys it held, and a follow-on campaign targeted around thirty AI companies in about four days. Its stated aim was access to an unreleased Claude model. Anthropic says every attempt failed, that the keys involved were stolen from customers' environments, and that its own systems were never compromised.

When an attacker's tooling can rebuild itself after every detection, the defender's edge has to come from identity, behaviour and the speed of response.

What is disputed or unknown

The attributions are Anthropic's own assessments, not government findings. The Midnight Blizzard link is framed as consistent with public reporting rather than as independent proof. Reuters reported that Russia's embassy in Washington did not immediately respond to a request for comment, and that China's foreign ministry said it was not aware of the report and opposed smears against the country.

There is partial outside corroboration. On 31 July 2026 Microsoft Threat Intelligence described a campaign it calls CaptiveCrunch, attributed to Storm-2945, which Microsoft describes as a sub-cluster of Midnight Blizzard. Microsoft said the group manipulated traffic on hotel and conference Wi-Fi to push fake updates and phish for sign-ins, and that it had seen AI supporting a significant portion of the operations. Anthropic cites that work as describing the same delivery method.

The numbers are a floor, not a census. Anthropic's view is limited to activity on its own models, and it says it selected the most notable and novel cases rather than typical misuse. Its case studies also show actors moving between providers, including a fake reseller that quietly routed customers to a different model. How much of the wider threat landscape now runs on AI agents is not something one company's report can measure.

Some claims need careful reading. Anthropic presents attackers outrunning new detections as something capable adversaries can now do in principle, not as an established norm. At an energy company, the attackers claimed they could remotely change the charging current of home electric-vehicle chargers, a claim the report attributes to them rather than confirms. The statement that no misuse was found on Anthropic's most capable Fable and Mythos-class models, apart from one distillation case, cannot be checked from outside.

Detection windows built for a slower adversary

The time figures are the ones security teams should sit with. The report cites breaches completed in two to three hours, and an enterprise software compromise that went from first access to bulk data theft within hours. Another affiliate collected more than 2,100 sets of cloud identity tokens across more than 40 corporate tenants in about 34 hours, with AI agents doing nearly all the work.

Where alerts wait until the next business day for triage, or credentials are rotated on a quarterly calendar, a three-hour escalation is over before anyone looks. Against malware that rebuilds itself once it is flagged, a static signature buys far less time than it once did. Once tooling can patch itself the moment it is caught, defenders need to lean on who is acting and how, not on recognising a known file.

The lesson is not that every defender needs autonomous agents of their own, though more automation in response is hard to avoid. It is that controls anchored in identity and behaviour hold up better than controls that depend on recognising a particular file. Microsoft's CaptiveCrunch guidance is a good example: permit the device code sign-in flow only where it is genuinely needed, adopt phishing-resistant multi-factor authentication, and treat guest wireless networks as untrusted.

What organisations running AI and automation should do now

For teams that run AI agents, robotics or automated operations in production, the report reads less like a warning about exotic threats and more like an audit checklist. Six steps follow directly from its cases.

• Hunt for exposed secrets in everything you ship. Scan app packages, container images, public repositories and client-side code for hard-coded keys and tokens, rotate anything found, and prefer short-lived, narrowly scoped credentials.
• Treat AI API keys and agent integrations as production credentials. Give each workload its own key with spending and rate limits, keep keys in a secrets manager, and alert on anomalous automated use of your own accounts, such as sudden volume spikes, unfamiliar models or activity at unusual hours.
• Measure response in hours, not days. Rehearse the scenario of one stolen developer token and test whether you could revoke sessions and contain cloud access inside the three-hour window the report describes.
• Shift weight from signatures to identity and behaviour. Restrict rarely used sign-in flows, deploy phishing-resistant authentication, and watch for bulk exports, new device registrations and unusual token use.
• Vet the AI supply chain. Buy model access only through authorised channels, keep evaluation sandboxes and wrapper services away from production keys, and assume that any agent reading untrusted content can be fed malicious instructions.
• Put connected physical systems in the threat model. A credential that reaches a customer database may also reach fleet, charging or robot control planes, so segment those systems and log every command sent to them.