Anthropic threat report: Russian spies automated malware evasion, and Chinese labs ran 200 million distillation exchanges

Anthropic published a threat intelligence report on Thursday covering misuse of Claude it says it identified and disrupted between December 2025 and August 2026. The report spans cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. Claude Haiku, Sonnet, and Opus models were involved; no case used Fable or Mythos-class models except one distillation case. The headline cyber case matches the Russian state-linked group Midnight Blizzard, which used Claude to check whether its malware evaded security products and had agents automatically rewrite, rebuild, and redeploy tools until they went undetected. The group targeted more than 20 organizations, including Ukrainian and European ministries, defense and intelligence bodies, embassies, and think tanks. CyberScoop says the report also describes an exploit foundry run by Chinese undergraduates and breaches tied to ShinyHunters, and concludes that AI has erased the skill gap between state hackers and lone criminals. SecurityWeek notes criminal groups increasingly targeted AI vendors' own infrastructure, including an attempt to steal a pre-release Claude model. The Register highlights attempts to build kamikaze drone swarms and a more dangerous mosquito-borne virus. On distillation, Anthropic observed nearly 200 million exchanges across five campaigns that tricked Claude into revealing its hidden chain of thought to train smaller models. Those findings follow this week's US advisory accusing six Chinese firms of industrial-scale distillation. A companion Frontier Red Team paper introduces evaluations for intelligence targeting and weapons development and describes new classifiers to block such use.