Anthropic Report Details AI-Assisted Cyberattacks Across 40 Enterprises in Nine Months

Anthropic's September 2026 threat intelligence report documents disrupted cyberattack campaigns conducted between December 2025 and August 2026, spanning espionage, financial crime, and AI-targeted intrusions. Key cases include a Russia-linked operation that used Claude to automate malware recompilation for evasion, a financially motivated group that decompiled 1.8 million Android apps to harvest hardcoded credentials, and a Chinese-speaking team that generated over ten suspected zero-days in a single month. A separate operation targeted roughly 30 AI companies in four days, attempting to steal unreleased model weights via vendor evaluation sandboxes. The report notes that attackers relied primarily on stolen credentials and unpatched edge devices, with one operation exporting over 2,100 Azure AD tokens across 40 enterprise tenants in just 34 hours. Anthropic acknowledges the findings are based solely on its own telemetry and have not been independently verified by third parties.