Anthropic Threat Intelligence Report: 5 Disrupted State-Sponsored Exploitation Campaigns Targeting Claude

Anthropic's Threat Intelligence team has published its September 2026 report, detailing the disruption of five major state-sponsored exploitation clusters targeting its Claude models between December 2025 and August 2026. The findings provide the clearest empirical evidence to date of how advanced persistent threat (APT) groups from Russia, China, and Iran are weaponizing commercial large language models for offensive cyber intrusions, mass surveillance, and automated intellectual property theft.

The report highlights a critical inflection point: generative AI agents drastically lower the resource threshold required to execute sophisticated cyber campaigns, allowing small adversary cells to mount operations that previously required legions of state intelligence operatives.

1. 1.Russian Malware Evasion & Refactoring: Investigators neutralized an operation linked to Russian state actors, including Midnight Blizzard. Operatives used Claude to refactor legacy malware source code to evade modern Endpoint Detection and Response (EDR) signatures, querying the model for obscure Windows kernel hooks and alternative API calls to build polymorphic evasion scripts targeting Ukrainian government networks.

1. 1.Chinese Multi-Target Cyber Espionage: Anthropic disrupted an espionage campaign originating from China that targeted nearly 30 enterprise networks across defense, technology, financial services, and chemical manufacturing. The attackers bypassed safety filters using prompt fragmentation, splitting malicious reconnaissance workflows into modular, seemingly harmless code audit questions to map internal network topologies.

1. 1.Massive Illicit Model Distillation: The report confirmed widespread intellectual property extraction by several China-based AI labs, including Alibaba, DeepSeek, and Moonshot. In the largest incident, automated bot swarms routed over 151 million synthetic queries to Claude between May and July 2026, harvesting latent reasoning chains to distill Claude's outputs directly into domestic open-weight models.

1. 1.Authoritarian Domestic Surveillance: State security apparatuses in Iran and West Africa attempted to deploy Claude as an automated domestic surveillance engine. Operatives built automated scraping pipelines that fed intercepted communications and activist manifestos into Claude to classify political sentiment and track dissident networks.

1. 1.Dual-Use Pathogen and Kinetic Weapons Probing: Anthropic blocked multiple sophisticated inquiries attempting to utilize Claude for dual-use biotechnology and weapons automation. Blocked queries sought actionable synthesis protocols for high-consequence pathogens—including chikungunya and avian influenza variants—alongside automated targeting software for drone swarms.

In response, Anthropic deployed internal Generative Threat Group (GTG) tracking designators, multi-turn prompt fragmentation classifiers, and automated credential revocation for suspicious infrastructure. Furthermore, Anthropic hardened evaluation and production sandboxes with hypervisor-enforced virtualization and eBPF syscall filtering, ensuring models cannot open unauthorized network sockets during tool execution. Telemetry and Indicators of Compromise were shared with US and UK AI Safety Institutes and law enforcement.

For enterprise CISOs, Anthropic's disclosure proves that AI safety is now an operational security perimeter. Organizations deploying agentic workflows must enforce strict kernel-level egress filtering, multi-party administrative approvals, and continuous behavioral telemetry at the infrastructure layer.

• Detecting and Countering Misuse of AI: September 2026 — Anthropic Research
• Anthropic Report: 5 Ways Claude Was Exploited for War, Spying and Repression — Axios
• AI Lets Small Actors Run State-Level Hacking Campaigns — CyberScoop
• Russian State-Sponsored Hackers Use Claude to Rebuild Malware — The Hacker News