Anthropic, the company behind Claude, published its Threat Intelligence Report for September 2026 last week, and parts of it read like a spy novel. Except everything is real: state-sponsored hacking groups from Russia and China, criminal collectives that can empty entire companies in hours, and election manipulation with AI-driven bot armies. What makes this report stand out is not that AI is being misused for attacks (nobody is surprised by that anymore), but how far the automation has actually gone.
Russian espionage with AI agents
The best documented campaign in the report involves Midnight Blizzard, a well-known Russian hacking group attributed to the SVR. Between December 2025 and August 2026 they targeted over 20 organisations: Ukrainian and European governments, defense contractors, drone manufacturers. The numbers are impressive; over 300000 national identity records stolen, over 500000 company registry records exfiltrated, at least 8 organisations accessed through stolen tokens.
What makes the report genuinely interesting: the attackers did not just use AI for phishing emails (that would be boring), but for the entire operation. AI agents conducted automated reconnaissance, set up phishing infrastructure, monitored and modified malware, and orchestrated data exfiltration. When security products detected their malware, the AI agent autonomously redeployed it. That is a new quality: not a person asking ChatGPT for exploit code, but autonomous systems running entire attack chains on their own.
The malware arsenal reads like a catalog: PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc for Windows; GiftDrop for Android; DarkSword for iOS. Techniques include device code phishing, DNS hijacking, WhatsApp account takeover, and even tapping into camera streams.
ShinyHunters: millions of APKs in hours
The second major campaign comes from affiliates of the ShinyHunters collective, a financially motivated criminal group. The speed is what stands out here: complete breaches in hours, not weeks. 1.8 million Android APKs were decompiled and searched for embedded secrets (e.g API keys that developers accidentally left in the code), over a terabyte of data stolen from a technology provider, and in just 34 hours over 2100 Azure AD token sets were harvested, leading to access to roughly 200 downstream customer organisations.
Some of the tools are publicly available: TruffleHog for secret scanning, the Soraki platform for distribution, Telegram bots for delivery. Monetisation runs through resale, extortion and (somewhat ironically) bug bounty programs where the attackers report vulnerabilities they already exploited, collecting the reward on top of the stolen data.
Chinese students finding zero-days
The perhaps most disturbing case in the report involves a group of computer science students at a Chinese university in Changsha. One had an internship at Sangfor (a Chinese security company), another was interviewing at QiAnXin. Together they attacked around 50 organisations across all sectors: education, retail, energy, tech, healthcare, finance, manufacturing, government.
The really worrying part: using AI agent swarms (multiple AI agents working on different tasks in parallel, with shared campaign memory) they found over a dozen possible zero-day vulnerabilities in major endpoint security products in a single month. Students. Not a state hacking unit with a million dollar budget, but students with access to AI tools. Anthropic writes that “sophisticated attacks no longer require sophisticated attackers.”
That is the point where you should pause for a moment, because it affects the entire security industry; if students with AI support can find zero-days in security products, then the assumptions about the threat landscape that most organisations operate on are no longer valid..
Influence operations
The report documents four major influence operations, and the range is remarkable.
In the Central African Republic, Russia operates Radio Lengo Songo (98.9 FM), a daily propaganda broadcaster coordinated with the Wagner Group and Russian state media like RT and Sputnik. AI was used not only for content but also for the stations HR processes: AI generated employment contracts that encode political loyalty, scoring rubrics, dismissal processes. That is AI-driven influence all the way down to the administrative level.
A French company called LKM operated about 70 fabricated news websites with over 70 linked Twitter accounts and more than 250 inauthentic commenting accounts. Over 8900 articles in roughly 20 languages, distributed across 6 continents, with focus on the US, Brazil, France and Congo. Particularly insidious: the same story was rewritten in opposite political directions depending on the target market.
And in Malaysia, a Turkish company (BBS Bilisim Teknolojileri from Istanbul) built what they called a “military-grade, AI-driven, real-time political operations ecosystem”: around 1000 fake Twitter accounts, one million artificial views requested for the sitting Prime Minister, voter targeting by race, religion and loyalty to the monarchy, broken down across all 222 parliamentary constituencies.
Russian state media outlets (Sputnik Moldova, RIA Novosti, Sputnik en Español, RT) are also using AI to produce content at a volume that matches the output of entire editorial teams.
AI as a target
One aspect that often gets overlooked: AI infrastructure itself is becoming a target. The report documents a Russian criminal who attacked 30 AI companies in 4 days after compromising an AI vendors evaluation sandbox and stealing production API keys. His goal was among other things access to an unreleased Claude model (which did not succeed).
Another actor using the alias “kl1zy” ran a fraudulent AI reselling service: he proxied traffic to a different AI model while simultaneously installing credential harvesters on customers systems. So if you buy AI access through unofficial channels, you might not only get an inferior model but also get spied on.
Trends
Anthropic identifies five main trends, and the most important one is the closing of the “sophistication gap”: the difference between what a state intelligence agency and what a single individual can accomplish is shrinking. Publicly available frameworks like PentAGI make it possible for practically anyone to use AI-powered attack tools. The progression goes from chatbot assistance (level 1: “write me a phishing email”) through directed execution with human targeting decisions (level 2) to multi-agent frameworks that run entire attack chains autonomously (level 3-4).
What does this mean for Swiss SMEs? First of all, the threat is not decreasing, quite the opposite. If a few Chinese students with AI tools can find zero-days, then the question is not whether you will be attacked but when. API keys need to be treated like production credentials (not in code, not in container images, not in mobile apps). Only buy AI access through official channels. And perhaps most importantly: understand that “we are too small and uninteresting” has definitively expired as a security strategy…
The full report from Anthropic is worth reading and more detailed than any summary can be: Anthropic Threat Intelligence Report September 2026
If you want to know how well your organisation is prepared for these kinds of threats: get in touch for a no-obligation assessment.