Anthropic releases September 2026 threat intelligence report, disclosing seven categories of Claude abuse activity

Anthropic's threat intelligence team disclosed Claude abuse activity identified and blocked between December 2025 and August 2026, covering seven harm areas: cyberattacks, influence operations, surveillance, scams, biological misuse, conventional weapons development, and knowledge distillation, involving the Claude Haiku, Sonnet, and Opus models. The report presents several Generative Threat Group cases, including GTG-20006, a Russian-speaking attacker possibly linked to Midnight Blizzard, who used AI workflows to automate phishing, DNS hijacking, and malware rewriting, targeting more than 20 Ukrainian and European government and defense institutions; GTG-50014, possibly linked to ShinyHunters, used AI to batch-download 1.8 million Android APKs to mine hardcoded keys; and GTG-10007, a Chinese-speaking operator, built an automated vulnerability discovery and exploitation pipeline targeting about 50 institutions.