Anthropic's September 2026 threat report documents misuse of Claude across cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development and model distillation. The report covers activity Anthropic says it disrupted between December 2025 and August 2026. Its most useful lesson for AI teams is that account enforcement alone cannot always remove the downstream risk when generated software is deployed elsewhere.
What Anthropic actually investigated
Anthropic says Claude Haiku, Sonnet and Opus were used in the cases it describes. It says none of the misuse cases involved Claude Fable or Mythos-class models except one illicit distillation case. This matters because the report is about observed misuse of specific public model families, not a general claim that every model behaves identically.
Why the on-premises example is important
One case involved a surveillance platform that ran fully on-premises using local models. Anthropic says the actor used Claude for software design and engineering support. The company banned the account and added detections, but those actions did not remove the already-deployed platform.
That is a different security problem from ordinary chatbot misuse. When an AI assistant helps build software that is later deployed outside the provider's environment, provider-side account controls can stop future assistance but cannot automatically uninstall or disable the resulting system.
How fragmented requests affected safeguards
Anthropic describes an Iran-nexus campaign in which the actor used Claude to build an automated open-source intelligence profiling system and malware-related tooling. The company says Claude refused nine out of ten direct requests that were facially malicious, but safeguards were less consistent when the actor split the work into smaller requests across later sessions.
This is a concrete example of why evaluating only single prompts can miss system-level misuse. A sequence of individually less suspicious tasks can still contribute to one harmful project when the user controls the overall plan.
What the report says about credential theft tooling
Anthropic describes work involving Microsoft 365 mailbox compromise tooling, including extraction and replay of authentication material. The report says the actor used Claude to engineer and test the tooling rather than conduct live operations. That distinction matters: the evidence described is about AI-assisted development activity, not proof that Claude itself carried out the compromise.
Distillation creates a different control problem
Anthropic also reports unauthorized distillation campaigns targeting its Opus-class models since February 2026. The company says some model interactions from third-party routing services contained sensitive user or company information and were used by other labs in attempts to reproduce capabilities.
This makes data handling part of model-security work. A company can lose sensitive information through the surrounding model ecosystem even when its own employees did not intentionally publish it.
What AI teams should take from the report
The report points to three control layers: model-provider safeguards, user and account monitoring, and controls around software or data after generation. A team that only blocks dangerous prompts still has a gap if an agent can create files, credentials or deployable code that leaves the controlled environment.
What remains unknown
Anthropic's report describes selected notable cases rather than a complete measurement of all misuse. It does not establish that the reported techniques represent the total volume of abuse or that the same safeguards will fail in every environment. Those limits matter when turning threat reporting into security policy.
The practical security lesson
AI security reviews should follow the full lifecycle: request, model response, tool call, generated artifact, credential access, deployment and downstream effect. Anthropic's own examples show why the final stages can remain risky even after a provider blocks an account.