I firmly believe that AI is genuinely changing the world for the better. It’s accelerating research, expanding access to expertise, and amplifying the capacity of people and organizations who were previously constrained by resources and headcount. Another positive result of AI is that it’s quickly democratizing access to the tools to create and access to information. These are real benefits.
The same capability that makes AI transformative for legitimate work makes it transformative for bad actors and big governments as well. Just because some people and organizations choose to use it for evil is not a reason to stop using AI. It’s a reason to understand the full landscape of what’s happening rather than focusing on the negatives.
In September, Anthropic released its threat intelligence report. It covers nine months of documented AI misuse across seven harm categories including state-sponsored espionage, financially motivated cybercrime, industrial-scale influence operations, and supply chain attacks targeting AI infrastructure itself. Scary stuff!
It’s unusually candid for a frontier lab to publish so much negative information, but I’m glad they published it. Understanding how these systems get misused is exactly how we build better defenses, better policy, and better norms. I encourage you to read past the headlines and dig into the report.
Here’s my take on what the report documents.
The skill gap is gone.
That’s the most consequential finding. For years, sophisticated cyber operations, influence campaigns, and intelligence collection were resource-intensive. They required technical expertise, personnel, coordination, and significant infrastructure. That created a meaningful barrier between well-resourced state actors and everyone else.
AI has collapsed that barrier. No longer are these tools only available to big government and billion dollar tech companies.
The report describes “capability democratization” across every documented category. Actors that previously lacked the skill or scale to run complex operations are now running them. Individuals are doing what teams used to do. And the economics of attack have inverted. Previously marginal targets are now viable because the cost of trying has dropped to near zero. Every operation in this report illustrates this in concrete terms.
What the cyber operations section actually shows.
The report names three operations that represent distinct threat profiles.
GTG-20006 is a Russian-linked actor that automated operations against Ukrainian and European government targets, military drone manufacturers, and over 20 orther groups. When security software detected their deployed malware, AI agents would autonomously modify and rebuild the implants to evade detection. Without human intervention, the system adapted on its own until it found a way through.
By using this trategy, they used AI to execute an attack independent of the traditional hacker/attacker, with humans retaining only the targeting decisions. How the attacks were carried out was relegated to the AI to determine.
GTG-50014, linked to ShinyHunters affiliates, shows the financially motivated side of hacking. One affiliate downloaded 1.8 million Android applications, decompiled them automatically, and automatically scanned the entire corpus for hardcoded secrets. Operations ran from initial access to bulk data theft in hours. The scale that would have taken an entire team months, now takes one person an afternoon.
GTG-10007 is attributed to a Chinese espionage group with university affiliations. They maintained autonomous vulnerability research programs against security products. They generate lots of zero-day exploits and ran parallel “agent swarms” conducting reconnaissance and post-exploitation across multiple victims simultaneously. Not sequentially. Simultaneously. That’s a fundamentally different approach than anything people who defend against these types of attacks have had to deal with in the past.
The pattern across all three of these attack is that humans set the objectives, AI handles the execution. Reconnaissance, exploitation, data exfiltration, and evasion. The human is the strategist. The AI became the ops center.
Influence operations are running at an industrial scale.
Nine documented campaigns. Russia, Iran, Turkey, Gulf-region actors, African actors, European actors. These operations have moved up the threat level from the Nigerian Prince email scams from a generation ago and the 2016 social media troll farms. Today, it’s not just the volume of attacks, it’s the quality, targeting precision, and attribution laundering.
GTG-04001 is a Central African case. A Russian-speaking operator managed daily AI-generated content production for Radio Lengo Songo, 98.9 FM, coordinating directly with Russian state media outlets. The operator’s instructions were to embed pro-Russia, anti-France talking points into news stories, then strip the formatting so it doesn’t look synthetic. Local radio, with a foreign subversion narrative, delivered via an AI production pipeline.
GTG-54002 shows the commercial infrastructure behind this. LKM, a France-based company, created approximately 70 fabricated news websites. They published 8,913 articles in 20 languages, rewriting real news stories into politically slanted versions tailored to regional audiences. Targets included the United States, Brazil, and the Democratic Republic of Congo. This isn’t the normal disinformation operation of the past. This is now being used as a media business model automatically built with AI content production.
GTG-84005 marketed itself openly. BBS Bilisim Teknolojileri sold what it called a “military-grade, AI-driven, real-time political operations ecosystem” for managing roughly 1,000 fake social media accounts targeting Malaysian voters. Influence-as-a-service is now being offered commercially.
What connects all of these operations?AI isn’t just helping draft posts. It’s running the full production stack. Content creation, persona development, platform building, A/B testing, and even attribution laundering.
Supply Chain Targeting
Two operations in the report target AI infrastructure directly.
GTG-50020 involved a Russian-speaking actor who compromised an AI vendor’s evaluation sandbox specifically to steal production API keys from multiple providers. After succeeding, the actor adapted those techniques to target 30 additional AI companies within four days. The objective wasn’t disruption. It was all about stealing credentials. Once they had them, they sold them, used them for their own operations, and even used them as cover that would launder their activity through legitimate accounts.
GTG-50021 was a fraudulent reseller operation. A Russian-Ukrainian group marketed discounted Claude access, then silently proxied traffic to alternative models while harvesting the Anthropic credentials customers thought they were using. The customers got access to a real product at a substantial discounted price. Little did they know, but the operators got their credentials of their things they were creating.
Any organization that has deployed AI tools, integrated AI APIs, or issued API keys to teams needs to understand this: those credentials are now primary attack targets. Not side effects of a breach. It’s actually the objective.
The four findings buried in the summary.
Anthropic lists four conclusions after all the operation-level detail. This is where we should focus.
1. Public offensive frameworks like PentAGI have already reproduced the scaffolding for automated cyber kill chains and made it available to any motivated actor. The techniques aren’t proprietary anymore.
2. The operational range now spans from conversational AI assistance to fully autonomous multi-agent frameworks running for hours without human supervision. There’s no longer a meaningful technical obstacles for entry.
3. AI reduces labor costs and skill thresholds enough that previously unprofitable attacks are now economically viable. High-volume operations against targets that would have previously been too expensive to pursue are now viable.
4. Bad actors built persistent infrastructure managing multiple campaigns with shared tooling and collective memory across sessions. This is a systematic approach to exploit this vulnerabilities.
Take Aways
The pros and cons of AI are not new. The same capabilities that let a small nonprofit punch way above its weight, that let a researcher compress years of literature review into days, that let a developer ship something meaningful as a one person team, also lower the barrier for bad actors with harmful intent.
This isn’t a reason to not do the good things or an indictment of the underlying technology. Actually, this is a characteristic of every powerful tool ever created. What matters is what we do with that reality.
Anthropic publishing this report is a meaningful step in the right direction. Documenting how your own systems are being misused, naming the operations, providing indicators of compromise, and making the findings public takes organizational courage. It reflects the kind of responsibility frontier labs should be modeling. I’d like to see more of it, not less.
The picture this report paints is sobering. The information environment is being manufactured at a scale and sophistication that individual human judgment isn’t designed to detect. The cyber threat landscape is operating at a tempo that legacy defenses weren’t designed to match. And the economics that used to limit unsophisticated actors no longer apply. Gone are the days of the Nigerian Prince schemes!
We’re not without an answer. Awareness is our first step. The report is available in full with IOCs, domain lists, and malware hashes for security teams. If you’re in a leadership role that touches technology, security, or communications, you should have already read the report.
AI is going to keep getting more capable. As it becomes more capable, so will the people who misuse it. And so, if we’re paying attention, will the rest of us.
Caution without action isn’t wisdom. It’s just slower failure.