Anthropic published a threat-intelligence report on Sept. 10, 2026, describing activity across seven areas of harm that the company said it had disrupted between December 2025 and August 2026. The publication date is therefore distinct from the dates of the underlying activity: the September event is a disclosure about incidents Anthropic says occurred over the preceding months.
One reason the report belongs in the Record is the division of work Anthropic describes between people and AI systems.
Anthropic said a majority of the cyber operations included in the report involved direct AI execution or orchestration. It described multi-agent frameworks carrying out portions of reconnaissance, exploitation and data exfiltration while people selected targets and reviewed material taken from them. If that account is accurate, the relevant change is not simply that an AI system supplied text or advice. Anthropic is describing systems delegated portions of an operational workflow while human actors retained consequential decisions about targets and results.
That distinction should not be turned into a claim of independent autonomy. Human direction remained part of Anthropic’s own account, and the reviewed evidence does not independently establish the underlying operations.
In one case study, Anthropic said a workflow automatically detected when malware had been flagged, then modified and rebuilt the malware until it evaded detection. That incident-level account remains unverified outside the company’s disclosure.
The report also presents five biological-misuse case studies. Anthropic said unnamed users sought assistance for biological research that could support biological-weapons development, including a grant application involving gain-of-function research on chikungunya. The company withheld identities, locations, institutions, biological agents and specific techniques, and cautioned that its examples did not establish harmful intent in every instance.
The report’s selection method is itself important to interpreting the disclosure. Anthropic says the cases it published are not typical misuse but examples it considered among the more notable or novel activity it identified. They therefore demonstrate what the company says was possible in selected cases; they do not provide a denominator from which to infer how common these workflows are across Claude use, cyber operations generally, or AI-assisted misuse as a whole.
The disclosure also creates an evidentiary asymmetry. Anthropic can investigate activity on its own service and decide what evidence to disclose, summarize or withhold. Outside readers receive only part of that underlying record. Reuters and The Associated Press independently reported that Anthropic made the disclosure and summarized its findings, but the reviewed reporting did not independently verify the incidents themselves. Independent repetition of the company’s account therefore strengthens evidence for the publication event, not for every underlying proposition in the report.
Anthropic said its threat-intelligence work identified and disrupted misuse of Claude, and that it strengthened safeguards and shared information with authorities and industry partners where appropriate. Those claims remain part of the company’s account where independent outcome evidence is absent.
The strongest alternative interpretation is that these selected cases demonstrate possible forms of AI-assisted operational delegation without establishing a broad transition in autonomy, prevalence or realized harm. Evidence that would distinguish those interpretations includes independently corroborated incidents, comparable denominators across reporting periods, measured changes in the share of tasks delegated to systems versus people, and enforcement or disruption outcomes that can be examined beyond the platform operator’s own summary.