From assistant to orchestrator: reading Anthropic's September 2026 threat report

Anthropic's Threat Intelligence team published its quarterly misuse report on Thursday, covering December 2025 through August 2026. The 120,000-character document is the fourth in a series that began in March 2025, and it reads less like a population study of AI misuse than a vendor-curated pattern catalog, organized around seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation, the practice of extracting a model's capabilities into a smaller, cheaper copy.

Anthropic's load-bearing claim is that, over the past six months, threat actors using Claude have moved from "assistant" to "orchestrator" inside cyber operations: chaining attack steps into a single automated workflow rather than relying on the model only to write code on demand. That shift is the spine of the report, and the rest of the cases illustrate variations on it.

The cyber case Anthropic highlights involves a network of actors who used Claude across the stages of an attack campaign. Anthropic calls the network "disrupted" but does not say how, or how many attempts it observed. The orchestration pattern recurs in a surveillance case where Claude was used to build systems that identify and monitor dissidents, and in a fraud case involving a network of fake dating apps designed to extract money from users across multiple languages.

Anthropic alleges that Moonshot AI, the Beijing-based lab behind the Kimi model family, silently forwarded customer requests to Claude and returned Claude's responses to users, effectively a free capability drain. The allegation is Anthropic's, and the Hacker News thread on the report carries it the same way. Moonshot's reply is not part of the published report. Anthropic also names one illicit distillation case involving a model it labels "Fable or Mythos-class," which are Anthropic's internal tier names, not industry-standard classifications.

The report identifies actors in northern Yemen, China, and likely freelance Russia-based operators as having used Claude in conventional weapons development. A separate cluster of cases involves working scientists at unnamed research institutions attempting to use Claude for biological misuse; Anthropic is withholding institution names, country specifics, and the biological agents or techniques involved. Both clusters sit inside Anthropic's "notable and novel" framing, and the report's value as a public artifact is the pattern it draws, not the population it claims to represent.

Anthropic does not publish detection rates, false-positive counts, or a baseline of lawful Claude use by the same actor categories (state militaries, commercial security firms, election operators). The seven harm categories are Anthropic's taxonomy, not an industry consensus. A report about misuse of one's own products also gets to choose what counts as a case, which actors get named, and which harms get a category at all.

A short checklist for reading the next AI-lab threat report: which harm areas are listed and which are not; which actors are named and which stay aggregated; what "disrupted" means in operational terms; what is left out (detection rates, false positives, lawful-use baseline); and where dual-use gaps sit (lawful Claude use by the same actor categories). The next Anthropic report is due in November.