Claude Became Part of Malicious Operations

Claude was embedded in real malicious workflows

The key shift is striking: Claude was used not just for suggestions, but as an operational component in multi-step campaigns. In its official September 2026 Threat Intelligence Report, Anthropic describes detected and disrupted activity from December 2025 through August 2026.

The company grouped the cases into seven areas: cyber operations, influence, surveillance, fraud, biological misuse, conventional weapons development, and illicit model distillation. The shared pattern is clear: the model lowered the barrier to entry, accelerated repetitive tasks, and connected separate attack stages into a more coherent process.

In cyber operations, Anthropic says Claude assisted with reconnaissance, phishing, social engineering, code generation, and malware adaptation. The report specifically cites a Russia-linked campaign whose methods resembled Midnight Blizzard: AI was used across nearly the entire chain, including attacks through hotel Wi-Fi and the takeover of WhatsApp accounts belonging to Ukrainian targets.

Another revealing case involved a mass-interception platform covering roughly 25 million SIM cards. At that scale, an LLM is no longer simply speeding up script writing; it becomes an interface for a complex surveillance and decision-making system.

A separate section of the report addresses the extraction of Claude’s capabilities through illicit distillation. Anthropic describes several attempts by Chinese laboratories, including the largest campaign it has recorded, linked to operators affiliated with Alibaba. Here, the target is no longer merely the model’s users, but the economics of building the model itself.

Response filters are no longer enough

The main engineering lesson is straightforward: security must be designed around the full chain of actions, not just an individual prompt. An innocuous request for code or target analysis can become dangerous once a model has tools, memory, and the ability to execute a sequence of steps.

• Agentic loops need constraints. Sensitive actions require separation between planning and execution, approvals, and access controls for tools.
• Distillation is becoming a distinct threat model. Repeated synthetic tasks and unusual request sequences may indicate systematic extraction of capabilities.
• A universal filter is insufficient. Cybersecurity, biology, surveillance, and weapons require different classifiers, rules, and expert review.

This is not a measurement of misuse prevalence across the entire internet, but a sample from Anthropic’s own visibility. Even so, it shows an uncomfortable reality: the risk boundary has shifted from a harmful answer to a harmful process—and processes are always harder to observe in full.

We previously covered how a Claude self-reflection flaw exposed prompt-injection and denial-of-service risks. That analysis provides useful context for the threats outlined in Anthropic’s latest intelligence report.