Anthropic's new threat report: AI let a criminal group exfiltrate 2,100 corporate access tokens in 34 hours
The September threat intelligence report covers Claude misuse cases disrupted between December 2025 and August 2026, including a Russia-linked campaign against 20+ government and defense organizations and an influence operation that produced nearly 9,000 fake-news articles.
Anthropic published its latest threat intelligence report on September 10, 2026, detailing Claude misuse cases it detected and disrupted between December 2025 and August 2026 across seven harm categories. The most severe was a Russia-linked campaign (internally labeled GTG-20006) that hit more than 20 government and defense organizations, exfiltrating over 300,000 national identity records and more than 500,000 commercial registry records. A separate criminal group affiliated with ShinyHunters (GTG-50014) downloaded 1.8 million distinct Android APKs and dumped more than 2,100 Azure access-token sets across at least 40 corporate tenants in roughly 34 hours.
Speed and reach
Anthropic's summary: "everything connected to the internet is a potential target for exploitation." The report documents speed and reach more than new attack techniques. Compromising 40 corporate tenants' worth of credentials in 34 hours used to require a team with operational infrastructure. Now a single actor with a capable model can do it.
Influence operations too
A third case (GTG-54002) used AI to run an influence operation that published more than 8,900 articles across roughly 70 fabricated news sites in about 20 languages. With the intrusion cases, the report puts Anthropic's numbers on two threats security and risk teams already plan for, credential theft and disinformation, at the scale and speed AI enables. Shorten your token-rotation and anomaly-detection windows accordingly: a 34-hour campaign finishes before a weekly review.