"정교한 공격에 정교한 공격자가 필요하지 않다"…앤트로픽 위협 보고서 일곱 갈래"Sophisticated attacks no longer require sophisticated attackers" - Anthropic's seven harm areas

Anthropic published a threat intelligence report on September 10 collecting cases in which its Claude models were misused.

It is titled "Countering misuse of AI: September 2026" and is the fourth such report, following ones in March, August and November 2025. It covers activity disrupted between December 2025 and August 2026; Korean coverage puts its length at 154 pages.

The report divides the activity into seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. Claude Haiku, Sonnet and Opus were the models used; Fable and Mythos-class models appear in no case except one illicit distillation case.

■ Korean coverage clustered on weapons and hacking

Did Korean coverage carry all seven areas evenly?

I matched four Korean articles against the report's table of contents. Three mentioned conventional weapons more than once, and three mentioned cyber. Influence operations appeared in one, model distillation in one, and scams in none.

That would not matter if the missing parts were side notes. But influence operations is the report's longest chapter, and its nine cases are the most of any section.

So this piece goes in the order of what is missing, rather than repeating the missile and hacking details Korean outlets already covered closely.

■ Nine influence operations, aimed at elections

Anthropic defines influence operations as efforts to manipulate the information environment - political, civic and public discourse - with intent to deceive or distort, while concealing the activity's origin and sponsorship.

The nine cases originated in Russia, Iran, Turkey and across the Gulf, South Asia, Africa and Europe, and targeted audiences on six continents. Behind them were governments, state media and propaganda institutions, private firms selling influence to paying clients, domestic political operators, and in one case an opposition movement in exile.

Several were timed to elections. Russian state media produced fabricated claims about Moldova's president before the September 2025 vote, and a pro-government operator in Kenya prepared fake grassroots social posts ahead of Kenya's 2027 general election.

The most interesting passage is where Anthropic explains its own vantage point. A social media site usually sees an operation once the content is already circulating. An AI company may see it while the operation is still being built, because the planning, target selection and drafting happen inside the model.

Surveillance sits in the same chapter. China-based cases included surveillance and recruitment targeting Uyghurs in Syria, religious-affairs intelligence covering Catholic, Tibetan Buddhist and Falun Gong communities, transnational tracking under "stability maintenance," and public opinion monitoring. A mass interception platform for Mali's state intelligence service and two Iran-nexus actors building surveillance systems and a malicious Firefox extension also appear.

■ Distillation: five companies, 190 million exchanges

The chapter Korean coverage almost skipped is model distillation. Distillation itself is a legitimate training method - a larger teacher model's responses are used to train a smaller student model at lower cost.

What the report targets is illicit distillation: an industrial-scale, covert campaign to extract a model's capabilities and replicate them elsewhere without authorization, enabled by thousands of accounts built on false identities, stolen cards and stolen API keys.

The per-company figures are in the report but absent from the Korean articles. Alibaba accounted for over 151 million exchanges between May and July 2026, and Moonshot over 23 million in the same window. DeepSeek accounted for over 12.1 million across 14 days in July, Zhipu over 3.4 million across 17 days in June and July, and Xiaomi over 400,000 across 20 days in March and April. Anthropic has disrupted attacks from seven labs based in China since its first disclosure in February 2026.

Does any of this reach someone who never uses Claude?

One method matters directly to readers here. Moonshot silently forwarded customer requests to Claude instead of processing them with Kimi, then displayed Claude's responses. Users believed they were using Kimi. Over a ten-day period almost 300,000 requests were relayed, the vast majority routed to Opus.

DeepSeek did the same, and additionally tagged requests arriving through coding harnesses such as Claude Code and the Claude Agent SDK, then relayed those users' requests to Opus. DeepSeek's customers likely did not know their requests were going to Anthropic.

So the report frames this as a user-data question as much as an intellectual property one. DeepSeek, Xiaomi and Moonshot fed conversations between their own models and their users into Claude, and some of those exchanges contained sensitive information from individual users and major multinational companies.

■ Where the six weapons cases came from

This is the chapter Korean outlets covered most. The six cases break down as three in China, two in Russia and one in Yemen.

Four involved building software for the weapons themselves. A cell in northern Yemen ran three programs, including a guided rocket using a commodity phone-class flight computer and a multi-stage ballistic missile with a stated range goal above 2,000km. The two China-based cases covered a fire control specification for a torpedo interception system and targeting software for electronic warfare and air-defence suppression; the Russian case was an autonomous military drone swarm.

The other two were procurement and intelligence: sourcing dual-use goods for Russian defense customers, and collecting public information on a directed-energy weapon and its suppliers.

So what did these actors actually gain from AI?

What they share is method. These actors already had expertise in and access to the hardware, and they split their work across many sessions to conceal the full nature of their programs. Anthropic says it has launched new classifiers to detect traffic related to high-yield explosives and weapons development.

■ What the report is actually saying

One sentence in the cyber chapter comes close to summarizing the whole document: sophisticated attacks no longer require sophisticated attackers.

Anthropic argues AI has collapsed the labor and tooling gap that separated well-resourced state operations from individual operators. A hacktivist using stolen API keys, scattered financially motivated individuals, and a state espionage operator each sustained multi-victim campaigns that a year ago would have required many skilled operators and specialist knowledge.

For threat investigators, that changes something concrete: sophistication has stopped being a reliable signal of who is behind an operation. It is also why the report measures capability gain along three axes - speed, scale and depth.

Defensive changes are listed too. Claude now summarizes its internal reasoning before responding, which makes stolen transcripts less useful for training another model. Fable 5.1 introduced preserved thinking, which stops new API accounts from altering the system prompt, tools or messages preceding Claude's reasoning. On the biology side, Fable 5 shipped with stronger safeguards restricting access to dual-use biological research queries.

The GTG labels throughout the report stand for Generative Threat Groups, Anthropic's internal designators for actors observed abusing AI. In each case it banned the accounts, folded the findings into its safeguards, and shared intelligence with authorities and other AI companies.