Hackers, governments, scammers, and spyware firms are misusing Claude — what Anthropic’s September 2026 report actually says

Anthropic just published a 154-page report on threat actors misusing Claude: hackers, governments, scammers, commercial spyware operations, and weapons developers. The headlines are loud. The useful part is quieter: AI is not only answering questions anymore. It is running loops.

We read the report so we could separate what is verified from what is being repeated badly. Two things worth knowing up front: the Ukraine/drone espionage case in the report is GTG-20006, and we could not verify the CVE-2024-40711 / Veeam Backup claim inside the PDF, so that should be treated as unconfirmed unless another source is cited.

The case that should get your attention first: GTG-20006

Anthropic links GTG-20006 to tradecraft consistent with Midnight Blizzard. The actor targeted more than 20 organizations: government ministries, defense and intelligence bodies, embassies, think tanks, and defense-industrial companies, mostly in Ukraine and Europe.

The primary access technique was not a Hollywood zero-day. It was device code phishing against Microsoft 365, run through an “Embassy Kit” framework, which yielded mail records from at least eight organizations. Around that sat the usual modern intrusion surface: phishing, ClickFix-style lures, DNS hijacking, and compromised hotel guest WiFi used to stage malware for Windows, Android, and iOS.

The theft that matters for technology companies: the actor bulk-exported mailboxes from at least two drone component manufacturers, targeted a military drone maker, and stole a complete proprietary software development kit for a drone vision system. It then spent several days reverse-engineering that system — recovering product architecture, hardware bill of materials, supplier dependencies, and details of an unannounced product.

That is the uncomfortable part. A stolen SDK is no longer just stolen IP. It is a prompt.

The malware now rebuilds itself

GTG-20006 also used AI-driven workflows to watch whether security products detected its tools. If a deployed implant was detected, agents modified and rebuilt it until it was undetected. Humans still chose targets and reviewed exfiltration, but the evasion loop became continuous.

This is why static detections alone are getting weaker. The cost of “we have a signature for that” is dropping.

GTG-10007: the skill gap collapsed in public

GTG-10007 is bigger than an exploit foundry. It was a fuller espionage program with parallel reconnaissance, malware development, and a standing collection fleet scraping US government and military sites on a schedule with no human in the loop.

One workflow loaded appliance firmware into a decompiler, walked cross-reference chains, formed vulnerability hypotheses, wrote exploit code, tested it against lab copies, and iterated until success. Anthropic says one continuously iterating workflow produced more than a dozen possible zero-day findings in a single month. The report also notes two of the operators were undergraduates in Hunan.

That is the cleanest evidence in the report that the bottleneck has moved. The question is no longer only “who can write the exploit.” It is “who can supervise the loop.”

The AI supply chain is already criminal

GTG-50021 ran a fraudulent “cheap Claude” reseller. Anthropic says the product was “neither cheap nor actually Claude”: traffic was proxied to other models, and the credential harvester was disguised as a Claude Code installer. It stole Anthropic account credentials.

This should change how you buy AI. API keys and session tokens are production credentials. Buy access only through official channels, and treat any discounted “Claude” intermediary as hostile until proven otherwise.

Conventional weapons work is not theoretical

The report covers six conventional-weapons cases: three in China, two in Russia, and one in Yemen. The list includes GTG-87001 in Yemen using Claude Code for guidance, navigation, and control software; GTG-27005 in Russia using Claude Code for a simulated FPV drone swarm codenamed DronDoc/Serafim; GTG-17001 and GTG-17002 in China for anti-torpedo fire control and electronic-warfare targeting software; plus sanctions-evading procurement case GTG-27006 and intelligence-gathering case GTG-17003.

One nuance matters: Anthropic assessed GTG-27005 as likely freelance, not a confirmed state actor. That strengthens the point. You do not need a state budget to run a meaningful weapons-adjacent engineering loop anymore.

Anthropic says safeguards blocked many requests, but not all. Actors split work across sessions and hid goals to evade controls.

What this means for sovereign and local AI

The easy answer is “use local models and you are safe.” The report says that is wrong. The risk is not only which model you use. It is whether your agents, tools, keys, and egress paths can be turned into a fast loop.

The boundary that holds:

1. Identity — every agent, tool, MCP server, and key has an owner and a scope.
2. Policy — tool-call authorization is argument-aware, not just “agent can call tool.”
3. Egress — network egress is allowlisted and inspected; stolen code cannot simply leave.
4. Evidence — signed audit trails from prompt → tool call → process/file/network effect → response → cost.

For No Monkey Business, the design rule is simple: the gateway enforces, the harness informs. Model routing is not a security boundary.

Platform checklist

• Treat AI keys and session tokens like production credentials. Rotate exposed keys.
• Audit OAuth and device-code grants, not just passwords. Refresh tokens survive password resets; block device code flow in Conditional Access where you can.
• Allowlist egress for agent runtimes and MCP/tool servers.
• Alert on decompiler/exploit-loop patterns, not only known malware signatures.
• Protect proprietary SDKs and vision/source code as if an AI can reverse them in days.
• Require human approval for irreversible agent actions.
• Keep signed evidence for prompt, tool call, file/network effect, response, and cost.

No Monkey Business installs and operates sovereign/local AI infrastructure. If this problem sounds familiar, book a 30-minute assessment.