Sophisticated Attacks No Longer Require Sophisticated Attackers. Anthropic's September Threat Intelligence Report, and What I See in My Own Logs.
Published: September 21, 2026
Sophisticated attacks no longer require sophisticated attackers. That is Anthropic's own heading in their September threat intelligence report. And this is their conclusion at the end of it: "None of the operations in this report depended on some entirely novel technique that defenders have never seen. Instead, the economics of the attacks have changed."
A Russian espionage group left their AI rewriting their own malware until no security product could detect it. One operator downloaded 1.8 million phone apps to read the passwords developers had left inside them. A third group built a machine that reads a security product's code, guesses where the weakness is, writes an attack to test the guess and keeps looping until it works, and one of those loops produced more than a dozen possible new flaws in a single month.
The ways in are the ones we already know. Stolen credentials, unpatched gateways, exposed services, SQL injection, phishing. The difference is speed and scale. One break-in went from a single stolen developer login to full administrative control of a company's cloud in about three hours.
I have run my own tools for over two years and for most of it I only had backend logs. Everything moved behind Cloudflare in January and I could finally see what arrives at the edge. Frequency, scope, volume and sophistication have all gone up since, and AI keys are now asked for by name.
The deck below captures some of the key findings from the cyber section. The full report is here: Detecting and countering misuse of AI: September 2026
Hotel guest wifi, turned into a delivery system
A group in the report took over three vendors that run hotel guest wifi and changed their DNS records, so a guest who connected had their traffic sent to the attackers and was then served malware on Windows, Android or iOS. Microsoft reported the same method and called it CaptiveCrunch.
What I see in my own logs
On my own side, four things have changed. AI keys are now asked for by name. A probe arrives as a slash and a company name, checking whether my box holds that company's data. One request per address across thousands of addresses makes a per-address limit useless. And badges get forged, so a request claims to be a search engine from a network it never uses.
Watching a dashboard stopped being fast enough. I run an AI led watch now, round the clock, with graded breach protocols, and it pages my phone while things are still happening.
The checklist, and an earlier post
The checklist that came out of two years of this, 132 items, each with the risk, a plain-English fix and the working code: tigzig.com/security
An earlier post of mine, four warnings on AI and cyber security: Four Warnings on AI and Cyber Risk
The attacks that reach a bank are not the ones that reach me. A lot of the doors are the same ones.
Sophisticated attacks no longer require sophisticated attackers
Browse the slides or download the PDF
Full Deck Content (Text Format)
Text below was extracted from the source deck. Chart visuals stay in the PDF and as slide images above the post.
Slide 1
TIGZIG
Anthropic Threat Intelligence Report
September 2026 · The cyber section
"Sophisticated attacks no longer require sophisticated attackers"
Eight months of activity, disrupted. A state espionage unit, a criminal crew and one person working on their own all ran the kind of campaign that used to need a team, and some break-ins were finished in two to three hours.
Key findings
- What I am seeing in my own security logs
Source
Detecting and countering misuse of AI: September 2026
Anthropic Threat Intelligence. These pages cover the cyber operations section only.
Amar Harolikar · Decision Sciences & Applied AItigzig.com
Slide 2
1 · Who is attacking you
You can no longer tell a state operation from one person working alone
A Russian espionage group
More than 20 organisations targeted
Ministries, embassies, defence firms
Hundreds of gigabytes taken
A campaign running 130 days
One French-speaking operator
42 organisations tracked as targets
Inside at least 14 of them
Tens of millions of rows in a doxxing tool they built, so people in one political movement could be looked up by name
A campaign running 36 days
"For threat intelligence investigators, sophistication has stopped being a reliable signal of who is behind an operation."
Anthropic's point is that sophistication no longer tells the two apart, and that what still does is intent. Even just a year ago, they write, campaigns like this would have needed many skilled operators.
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 2 / 13
Slide 3
2 · What the AI now does on its own
They left their AI rewriting their own malware until nothing could detect it
Step 1
The malware goes out
Windows, Android and iOS tools, delivered through fake software updates and hijacked hotel wifi.
Step 2
Agents watch for a detection
AI agents monitor whether any security product has flagged any part of the toolkit.
Step 3
It rewrites itself
When something is caught, the agents modify and rebuild it on their own, with no operator involved.
Step 4
It repeats until it is clean
The loop keeps going until the security products stop seeing it, and only then is the tool used again.
Anthropic's reading is that this turns the cost around. A new detection might once have slowed an attacker down. Their own wording is that "at least in theory" it no longer will.
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 3 / 13
Slide 4
3 · The bug-finding machine
They built a machine to find new flaws, then went after government networks
The machine
Reads a security product's own code
Guesses where a weakness might be
Writes an attack to test the guess
Tries it in a private lab and loops until it works
Then attempts on those same products inside real organisations
Why it does not stop
Target lists, stolen passwords and progress saved between sessions
A new session picks up mid-campaign knowing all of it
One lead agent splits the work across many others at once
Thirteen agents collecting open-source intelligence on a timer, nobody watching
One of those loops produced more than a dozen possible new flaws in a single month.
This was an espionage operation. The same operators targeted about fifty organisations and took student records, citizen records and access to a retailer's live systems. Two of them were undergraduates at a Chinese university.
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 4 / 13
Slide 5
4 · Where they get in
One operator downloaded 1.8 million phone apps to read what was left inside them
Collect
1.8 million Android apps, pulled from several app stores
Run on a small fleet of rented cloud machines.
Open
Every app taken apart and scanned for passwords
Looking for keys a developer compiled in and forgot about.
Sort
Working keys arrive in a chat group in real time
Filed automatically into more than a hundred categories. A second pipeline did the same with stolen developer tokens.
This operator also left their own staging address and bot tokens exposed. That is part of how they were found.
Those two pipelines supplied most of that operator's break-ins. Anthropic's line: "everything connected to the internet is a potential target for exploitation."
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 5 / 13
Slide 6
5 · From one key to the whole company
The same six steps, run again and again, and each one is something you can check
1A key ships inside an app
One of hundreds of thousands of passwords compiled into ordinary mobile software.
2It gets found and tested
Machine decompilation at volume, and the key is checked live to see what it opens.
3The cloud account opens
A key that works gives access to the company's wider cloud estate.
4The build system is taken
Software pipelines backdoored, and every other stored password harvested.
5Control sits inside production
The attacker's own software now runs on the company's live infrastructure.
6Sale, drain and extortion
Keys sold on, payment flows intercepted, and the data used to demand a ransom.
Anthropic describe an operator who very often may not directly understand the target company, and is "deferring the specifics to the AI".
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 6 / 13
Slide 7
6 · How fast it now goes
Speed and scale are what changed
3 hrs
From one stolen developer login to full administrative control of a company's cloud
34 hrs
To take over 2,100 sets of login tokens spanning more than 40 corporate accounts
200
Customer organisations reached through the break-in at a single software supplier
"AI agents performed nearly all of the work."
The report describes breaches finished in as little as two to three hours, and single operators handling dozens of victims at the same time.
Anthropic add two caveats. Humans still choose the targets and review what comes out, and several of the worst compromises in the report were directed by a person at every step.
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 7 / 13
Slide 8
7 · The target people miss
Your AI keys are now worth stealing on their own
1Loot
Stolen keys and accounts have a resale value in markets that already exist.
2Compute
The attacker's own work then runs at somebody else's expense.
3Cover
The activity is attributed to the person who legitimately owns the credential.
4The discount that is not one
A group sold discounted Claude access. The traffic went to a different model and their software took the buyer's details.
One actor attacked about thirty AI companies in four days, chasing an unreleased Claude model, and Anthropic say every path failed. In every instance the stolen keys came from customer environments, and their own systems were not compromised.
Their recommendation: treat AI keys and agent integrations with the same level of seriousness as production credentials, because attackers already do.
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 8 / 13
Slide 9
8 · What actually got them in
The ways in are the same ones as before
How they got in
Stolen credentials
Unpatched edge devices
Exposed services
SQL injection
Phishing
What is different
The labour is handed to AI
It runs at machine speed
It runs in parallel
Dozens of victims at once
In one case the AI found new bugs itself
"None of the operations in this report depended on some entirely novel technique that defenders have never seen. Instead, the economics of the attacks have changed."
The research, the breaking in, the tool building and the data processing all used to separate a well-funded operation from everybody else. All of it is now delegated to AI.
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 9 / 13
Slide 10
9 · What to go and check
Six questions, each one tied to something that happened in the report
1Your own mobile apps
Is there a key or token inside anything you ship? That is where the biggest harvest started.
2Your AI keys
Who holds them, where do they sit, and would you notice one being used from somewhere else?
3What your suppliers can reach
One supplier's access reached 200 of its customers. Ask what yours can reach in your systems.
4Your edge devices
VPN gateways, firewalls and mail portals were the way in more than once. Check the versions.
5Your code and build systems
Passwords in old commits and build pipelines were harvested repeatedly, and are easy to find.
6Your first few hours
Some break-ins were finished in two to three hours. Ask how long you take to notice and act.
Anthropic's framing: "The capabilities described in this report should be assumed to be available to any actors who are motivated to use them."
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 10 / 13
Slide 11
From my own logs
My own logs are moving the same way, and AI keys are hunted by name
I have run these tools for over two years, and for most of it I only had my own backend logs. Everything moved behind Cloudflare in January, and I could finally see what arrives at the edge. Frequency, scope, volume and sophistication have all gone up since.
What changed
A probe arrives as a slash and a company name, checking whether my box holds their data
One request per address across thousands of addresses, so a per-address limit does nothing
Badges get forged, so a request claims to be a search engine from a network it never uses
What I do now
An AI led watch, round the clock
Some sessions on watch duty, others on standby to investigate, connected to each other
It can isolate an app inside the mandate it has
It pages my phone while things are still happening
A technique gets refused and a different one arrives within minutes .. Two years of hardening, written up as a checklist on the next page.
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 11 / 13
Slide 12
Two years of hardening my own tools, written up as a checklist
What is in it
132 items across 14 categories, each with the risk, a plain-English fix and the working code. It began as a few notes when I ran a handful of tools, and it grew every time something went wrong on a live service. tigzig.com/security
Four warnings on AI and cyber security
From an earlier post of mine. Warnings from Google's threat intelligence group, five US agencies including the NSA and the FBI, the chair of the Financial Stability Board, and a researcher who had just left a frontier lab. tigzig.com/post/four-warnings-ai-cyber-risk-sep2026
The attacks that reach a bank are not the ones that reach me, and the sophistication is not comparable. A lot of the doors are the same ones. A key left in an app, an old commit, an unpatched gateway. I came to this as a data scientist rather than a security engineer, so I learned every one of these on a live service, the hard way, and I am still learning ..
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 12 / 13
Slide 13
The rest of the report
Cyber is one of seven areas, and these pages cover only that one
The full report runs to 154 pages and covers activity from December 2025 to August 2026. The other six areas in it are:
Influence operations
Surveillance
Conventional weapons
Biological misuse
Scams and fraud
Illicit distillation
In each case Anthropic say they disrupted the activity, banned the accounts and shared what they found with authorities and industry partners. They found no malicious activity on Claude Fable or Mythos.
Source
Detecting and countering misuse of AI: September 2026
Anthropic Threat Intelligence, published 10 September 2026. Every quotation on these pages is from that report, and every number is theirs.
Amar Harolikar · Decision Sciences & Applied AItigzig.com · 13 / 13
Working on something similar? How I work covers the rates, the availability and what I take on.