Anthropic published its September 2026 threat intelligence report this week. It runs 154 pages and documents activity disrupted between December 2025 and August 2026 across seven harm areas, from state espionage to weapons development to a network of fake dating apps.
Two findings in it should change what a SOC does this quarter. Attackers now steal AI API keys on purpose. And the safeguards that refuse a malicious request in one session hold up poorly when the same work is fragmented across smaller ones.
The gap between a lone operator and a state actor has closed
One French-speaking individual went after European political parties, media and think tanks. They exploited a previously undocumented WordPress re-installation race condition that created a rogue administrator account without valid credentials, developing and debugging the exploit in a single session. They built a doxxing platform holding tens of millions of rows and ran the campaign for a month on stolen API keys. Across 42 tracked target entities they gained internal access to at least 14.
Separately, operators in Hunan province ran an automated exploit foundry against appliance firmware. Two of them were undergraduates. One workflow against network appliances produced more than a dozen possible zero-day findings in a single month, and a fleet of thirteen collection agents ran on a scheduled job with no operator present.
In the report’s own words:
“None of the operations in this report depended on some entirely novel technique that defenders have never seen. Instead, the economics of the attacks have changed.”
The labour that used to separate well-resourced operations from everyone else now runs automated and in parallel. The report is equally direct about what that means for the rest of us. The capabilities it describes should be assumed to be available to any actor motivated to use them.
Your AI credentials are a target, not a side effect
This is the finding you can act on today.
The report devotes a section to the AI supply chain as target, loot and attack compute. It sets out what an operator gains from stolen AI credentials, and it is three things at once. Resale value in established markets. Compute, so their workloads run at your expense. And cover, because the activity is attributed to the credential’s legitimate owner.
Attackers act on all three. Suspected ShinyHunters affiliates, on obtaining a victim’s AI keys during an intrusion, switched their own attack workloads onto those keys. Another group compromised an AI vendor’s automated evaluation sandbox through prompt injection, took the production keys it held, then used them to continue attacking that vendor and unrelated targets at the same time. A follow-on campaign hit roughly thirty AI companies in about four days.
In every case the keys came from customer environments. Anthropic’s own systems were not compromised.
The report names the pattern in language every practitioner already knows:
“Security practitioners use the phrase ‘living off the land’ to describe attacks that use tools that are already present in the victim’s environment. The opportunistic hackers described in this section have applied the same principles to AI. The operators treated the AI supply chain itself as both a target and a resource.”
Four things follow, and none of them require new tooling:
- Inventory every AI API key and session token your organisation holds, including those embedded in applications, containers, mobile builds and public repositories. One operator in the report downloaded 1.8 million Android apps and scanned them for precisely this.
- Treat those keys with the same seriousness as production database credentials, because attackers already do.
- Put egress monitoring on your AI calls. Unexpected volume against a model endpoint is now a compromise signal.
- Buy AI access only through authorised channels. One group ran a fraudulent reseller offering discounted access, quietly routed customers to a different model, and harvested their real credentials to sell onward.
Where the safeguards failed
Anthropic documents where its own safeguards failed, which is the most useful part of the report for anyone deploying AI internally.
The pattern is consistent and simple. From the phishing tooling case:
“Claude refused nine out of ten direct requests that were facially malicious. But our safeguards performed less consistently when the user fragmented the work and directed the model to carry out tasks across later, smaller sessions.”
A Yemen-based weapons cell applied the same method deliberately, splitting work across many sessions so no single session revealed the full programme. A China-based actor was refused a “stability maintenance” report, re-prompted, and obtained functional suppression guidance naming ten private citizens.
None of that required a jailbreak. It required repeated attempts.
If your organisation runs AI agents internally, this is your threat model too. Controls that evaluate a single request in isolation will not catch an objective assembled across a series of them. Session-level review and campaign-level review are different problems.
What the report leaves out
Seven harm areas, 154 pages, and almost all of it is offense. That is a fair choice for a threat report. It also means the defensive use of the same capability goes unexamined.
The report is explicit about where this leads:
“AI has inverted the cost back onto defenders. Previously, defenders might have been able to slow an attacker’s operational tempo via the deployment of a new detection. Now, at least in theory, capable adversaries can ‘close the loop,’ bypassing traditional security detections faster than defenders can develop and deploy them.”
The reason that inversion holds right now is simple. Attackers adopted agentic workflows first. The report shows breaches completed in two to three hours and dozens of victims handled in parallel by individual operators. Most SOCs still investigate alerts one at a time, at human pace, in a queue that never empties.
The attacker’s loop closes in hours. The defender’s loop still closes in days. That gap is the finding.
The analyst stays. What has to change is the speed and depth of the investigation around them. Morpheus, D3’s accountable agentic SOC platform, triages up to 95% of alerts in under two minutes. When Morpheus is uncertain, it defers to a human.
That deferral is deliberate. Speed without accountability produces confident errors.
Immediate actions
Pull your AI key inventory. Add egress monitoring on model endpoints. Check whether any AI access in your environment was bought outside an authorised channel. Then ask how long your own investigation loop actually takes, measured from alert to decision.
Check the verdict before you act on it
Speed only helps if you can trust what comes back. That is the harder problem, and it is what we cover live next week.
How to Catch an AI SOC Analyst Bluffing
Wednesday, September 16, 10:00 to 11:00 AM PDT
Amy Tom, Community Manager, and Phil Beck, Director of Sales Engineering
The session walks through how to check an AI-generated finding before you act on it. Separating confirmed facts from inferences. Following a claim back to the evidence that produced it. Questioning a recommendation in plain language.
Register for the September 16 session
Sources
- Anthropic, Countering misuse of AI: September 2026
