ai review security biosecurity September 12, 2026
Anthropic published their fourth threat intelligence report, covering activity they disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. I read it end to end. Here are the parts that stuck.
The core finding
Sophistication no longer tells you who you’re dealing with. A hacktivist with stolen API keys, a financially motivated criminal, and a state espionage operator each ran multi-victim campaigns that a year ago would have required many skilled operators. Every layer of offensive operations has been uplifted by AI, from reconnaissance and tool development to data processing and exploitation.
Cyber operations: from assistant to orchestrator
The headline case is GTG-20006, a Russian-linked actor (consistent with public reporting on Midnight Blizzard) targeting military intelligence in Ukrainian and European governments plus diplomatic and defense organizations connected to US foreign policy.
What makes it notable isn’t the target list, it’s the operating model:
- Custom toolkit of Windows implants, a mobile exploitation kit, a credential stealer, a phishing platform, and an admin console for managing compromised accounts
- AI-driven workflows that automated infrastructure acquisition, phishing, C2, and data exfiltration
- The piece I keep thinking about: AI agents monitoring their own malware for detection by security products, then autonomously modifying and rebuilding it until it came back clean. The human’s primary role was editing the Claude Code skills that drove the workflows when they needed refinement
The report also documents the November 2025 autonomous-attack operating model proliferating across every class of actor, with publicly available frameworks like PentAGI reproducing much of the same scaffolding for anyone who downloads it.
Biological misuse: the dual-use problem in practice
Five case studies, and the most interesting section of the report for me.
The framing: Anthropic’s threat team opens with the Soviet Biopreparat analogy. Thousands of researchers worked on offensive bioweapons programs believing they were doing basic or defensive science. The lesson they draw: overt malicious intent is often evidence that an actor is not sophisticated. The sophisticated ones hide intent inside interactions that look plausibly beneficial.
Case 1, the evasion platform. A grant application for gain-of-function research on chikungunya virus (transmissibility and immune evasion), nominally civilian but destined for a military research institute. Behind it, an LLM platform serving dozens of virologists that:
- Tunneled traffic through US infrastructure to evade Anthropic’s regional blocks
- Used zero data retention partners to hide content
- Built a fallback that routed any prompt Claude refused to a competitor’s more permissive model. Claude wrote the code for that fallback itself, with the request framed as “over-refusal mitigation”
- After being banned, the operator re-established access within days using consumer subscriptions on fresh identities
The research continued, with follow-up materials describing the viral modifications in terms of loss of function rather than gain.
Case 2, avian influenza. A researcher outside the US working on H5 bird flu mammalian adaptation and airborne transmissibility in animal models, over thousands of messages across several weeks. Anthropic’s assessment is the interesting part: their safety classifiers held well enough to force the researcher onto their weakest models (Sonnet 4 and Haiku 4.5), limiting the uplift to mostly clerical assistance. But the case is evidence of active wet-lab programs building the knowhow and materials for enhanced-pandemic-potential pathogens.
Case 3, orthopoxvirus. A grant application for smallpox-family immune-evasion gene research at a state-associated infectious disease lab. The entire grant, central hypothesis through contingency strategies, drafted end to end on Opus 5 in about an hour. Not blocked, because attenuation research is legitimately dual-use.
Cases 4 and 5, venoms and toxins. Novel venom and toxin research with the classic dual-use profile: botulinum was pursued as a bioweapon and is now botox; saxitoxin was stockpiled by the CIA and is now an essential research tool for nerve signaling.
Illicit distillation: the shell company detail
Since their first disclosure in February, Anthropic has disrupted distillation attacks from seven labs based in China. The detail that stands out: SenseTime’s pipeline included transcripts of user exchanges with Claude purchased from third-party data vendors, harvested from users accessing Claude through intermediaries. And MiniMax built a proxy network through a shell company that offers access only to Anthropic and OpenAI models, no Chinese models including its own, which is strong evidence the whole point was harvesting transcripts of users talking to US frontier models.
Their countermeasures are getting technically interesting: Claude now summarizes its internal reasoning before responding, making stolen transcripts less useful for training another model, and preserved thinking (introduced with Fable 5.1) stops new API accounts from altering the context preceding Claude’s reasoning in multi-turn conversations.
What I take from it
- Attribution by capability level is dead. The old heuristic (too sloppy for a state actor, too sophisticated for a lone wolf) doesn’t survive agents doing the heavy lifting for both.
- The dual-use problem has no clean answer. The chikungunya case shows actors exploiting the fact that biology’s beneficial and harmful uses are genuinely hard to distinguish, sometimes even for the researchers themselves.
- Safeguards working looks like displacement, not disappearance. The bird flu researcher used weaker models; the evasion platform routed refusals to a competitor. Safety on one frontier model pushes misuse toward less-safeguarded ones.
- Open disclosure is the strongest move in the report. Publishing detection data, case mechanics, and indicators of compromise helps every other platform recognize the same patterns. More labs should do this.
Read the full report: Detecting and countering misuse of AI: September 2026