On September 10, Anthropic published its fourth threat intelligence report, "Detecting and countering misuse of AI: September 2026." It runs 154 pages and covers operations the company's Threat Intelligence team disrupted between December 2025 and August 2026 across seven harm areas. I read the whole thing the day it came out. Most of the coverage has gone to the biological and influence-operations sections, which are alarming and worth your time. But the part every security leader should sit with is the cyber operations chapter, because it documents, in production, against real victims, the exact shift my co-founder Lior and I have been describing for the past two years.
I want to walk through what the report actually says, quote it directly rather than paraphrase it, and then be honest about what it means for how we build defense. I will try not to editorialize past what the evidence supports. The evidence is strong enough that it does not need help.
The paragraph that should change how you think about detection
Anthropic tracks the actors it observes with internal designators it calls Generative Threat Groups. One of them, GTG-20006, is a state-nexus espionage actor whose tradecraft Anthropic assesses as consistent with public reporting on Midnight Blizzard. The actor ran operations against military intelligence targets in Ukrainian and European governments, diplomatic and defense organizations, and drone technology supply chains.
Here is the mechanism that matters, in the report's own words:
"The actor also used AI to monitor how well their tools evaded detections from known security defenses. If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections. The agents were designed to continue iterating on GTG-20006's toolkit until it was undetected."
This is a control loop. There is a sensor (are we detected?), a controller (modify and recompile), and an actuator (redeploy), running closed, with the human moved out of the inner loop. Anthropic notes that the human operator "engaged primarily to modify Claude Code skills that drove the workflows when they needed to be refined." The person tunes the harness. The harness runs the campaign.
The report states the consequence plainly, and it is the most important paragraph in the chapter:
"The result of the above is that AI has inverted the cost back onto defenders. Previously, defenders might have been able to slow an attacker's operational tempo via the deployment of a new detection. Now, at least in theory, capable adversaries can 'close the loop,' bypassing traditional security detections faster than defenders can develop and deploy them."
Signatures have been cheap and defeated for ages. Hashes and strings were always a recompile away from useless, and any competent operator has treated them that way for years. Modern detections, EDRs in this case, are looking for behavioral sequences and patterns: the order in which a tool stages, injects, persists, and calls home. Evading those has rested on an asymmetry in labor, because changing behavior means redesigning tradecraft, and that has been expensive, skilled, human work. A defender who shipped a behavioral detection bought real time. The innovation here is that now, with Claude, they change the behavior to evade the detection. That is the novelty and the unique element here.
That asymmetry is what the loop above erases. When the rebuild step costs an agent minutes instead of costing a human days, a new detection no longer buys you time. This is not a theoretical concern from a red-team exercise. It is a nation-state espionage campaign against defense targets, documented by the lab whose model was used to run it.
The attacks are old. The economics are new.
Here is what makes this report more useful than the average threat writeup, and the reason I trust its framing: it refuses to claim the sky is falling on the strength of some exotic new capability. Anthropic is explicit that none of the operations relied on techniques defenders have never seen:
"The attacks themselves are familiar, involving stolen credentials, unpatched edge devices, exposed services, SQL injection, and phishing. None of the operations in this report depended on some entirely novel technique that defenders have never seen. Instead, the economics of the attacks have changed."
That is the correct diagnosis, and it is more sobering than any zero-day headline. The kill chain of 2026 would be recognizable to any analyst from 2016. What changed is the unit cost of running it. The report continues:
"The kind of labor that previously set the well-resourced operations apart from everyone else, reconnaissance, exploitation, tool development, and data processing, are all now delegated to AI models, which run in harnesses at machine speed and in parallel."
And it puts numbers on the outcome.
Take the cloud takeover figure, because the speed is the point. From the ShinyHunters-affiliate cluster:
"Another compromise escalated from a single stolen developer token to full administrative control of a victim's cloud environment in roughly three hours."
Three hours, token to tenant admin. If your detection-and-response model assumes an analyst will pick the alert out of a queue during business hours, work it, escalate it, and coordinate a response, that model has already lost this race before it starts. The adversary finished before your first human looked at the ticket.
Anthropic frames the shift in the language of unit economics, which is exactly how I think about it:
"In economic terms, AI autonomy compresses the cost side of attacker ROI calculations, lowering the skill threshold and labor required per campaign, while leaving potential payoffs largely unchanged. This favorable shift in unit economics makes previously marginal targets viable and encourages higher-volume, lower-touch operations."
If your organization was never worth a skilled operator's week, it may now be worth an agent's afternoon. That is the practical meaning of "previously marginal targets viable." The population of things worth attacking just grew, and it grew for everyone.
Sophistication is no longer the differentiator. Intent is.
The second finding is what the report calls diffusion, and it should reset a lot of threat models. Anthropic disrupted a state-nexus espionage operator, a financially motivated crew, and a lone hacktivist, and found that the methodology had converged:
"The main distinguishing feature between these classes of actors is no longer sophistication but intent. Previously, state-sponsored actors were able to leverage access to greater resources to deploy more advanced cyber capabilities. The advance of AI provides non-state actors access to the same capabilities previously only accessible to state actors."
The hacktivist case, GTG-50029, is the one I keep coming back to, because it is a single person operating at the tempo of an advanced persistent threat. One French-speaking actor targeted European political parties, media, and think tanks. They developed a novel exploit for an undocumented WordPress race condition, in-session, with Claude helping build and debug it, including a lab harness. Anthropic's description of the actor's custom doxxing platform is worth quoting in full, because it captures how much engineering one person now commands:
"This platform provided a compiled search engine, complete with ingestion pipelines, the ability to cross-reference individual breach dumps against exfiltrated data, normalization for national identity numbers and phone numbers, ranking logic, tests, and a containerized deployment."
And then the line that should stay with you:
"This is one of the clearest cases we have seen of AI-assisted software engineering applied directly to a mass attack on privacy, and the entire platform was created by just one person."
Across 42 tracked targets, that one person gained internal access to at least 14. The report's conclusion follows directly: if the capability floor has risen to where a motivated individual can do this, then the assumption that only well-funded adversaries sustain advanced campaigns is no longer safe. This is the same argument we made in The Cyber AI Parity Window: the technology arrived for everyone at the same moment, which is exactly why it does not respect the old tiers.
The iterative, goal-oriented work of an autonomous, relentless agent
Strip the case studies down to their architecture and the offensive operations in this report share one design: the iterative, goal-oriented work of an autonomous, relentless agent. The operator gives it a goal and it keeps working until it gets there.
The exploit-foundry group, GTG-10007, is the clearest example. Anthropic describes a chain that walked "decompilation and cross-reference chains (over thousands of decompile calls)," formed "vulnerability hypotheses against a knowledge base it curated over time," wrote exploit code, tested it "against lab copies of the target product," and iterated "until success, at which point the chain landed in the operator's private exploit portfolio." One such loop "yielded more than a dozen possible zero day findings in a single month."
Scale comes from telling the agent to iterate until success: a successful breach, evasion, attack, or compromise. A human campaign spends effort in proportion to the attention an operator can give it, and attention runs out. A relentless agent spends effort in proportion to how hard the goal is, and it keeps spending, overnight and in parallel, until it succeeds or the operator calls it off. Point that instruction at GTG-20006's malware and "undetected" becomes the exit condition. Point it at a firmware image and you get a zero-day portfolio.
The supporting engineering is well understood, and it is what makes relentless iteration practical at volume:
- Orchestration. A planner agent decomposes a goal and dispatches work to subagents.
- Parallelism. Subagents run concurrently, so throughput is bounded by compute, not by operator attention.
- Persistent memory. State survives across sessions, so a campaign accumulates context instead of restarting cold.
- Tool use. Agents drive real tools: decompilers, scanners, exploit frameworks, cloud APIs.
Each of these makes the loop wider and faster. The goal, and the instruction to iterate until it is met, is what makes the loop finish. The research runs while the operators sleep, because a scheduled agent keeps no office hours.
Their zero-day loop is the same pattern pointed at firmware. Anthropic describes it walking "decompilation and cross-reference chains (over thousands of decompile calls)," forming "vulnerability hypotheses against a knowledge base it curated over time," writing exploit code, testing it "against lab copies of the target product," and iterating "until success, at which point the chain landed in the operator's private exploit portfolio." One such loop "yielded more than a dozen possible zero day findings in a single month." The research runs while the operators sleep, because a scheduled agent does not keep office hours.
I am dwelling on the mechanics for a reason. These are the same primitives behind every serious agentic system being built today, including the one that matters most: give an agent a clear objective, a way to check its own work, and permission to keep going until it succeeds. There is nothing here a defender cannot also build. The attackers pointed a well-understood kind of computation at offense, and they pointed it at a goal.
There is one more detail in the report that I think is the most important line for defenders, and it is easy to miss because it reads like a caveat:
"Humans have retained the decisions that matter most to them: for example, they're still heavily involved in target selection, monetization of findings, and review of results."
Autonomy multiplied the attackers' speed and scale, but the people stayed on the loop for judgment. Target selection, what to do with what was found, whether a result is real: those stayed human. The most effective offensive operating model in this report is AI executing the machine work while people lead the decisions that require a person. That is not a coincidence, and it is not only how good offense works. It is how good defense has to work too.
Defense has to run the same loop
If an adversary's agents can watch your detections and rebuild their tooling in the time it takes an analyst to refill their coffee, then a defense built on humans manually triaging alerts, manually investigating, and manually tuning detections is not slightly behind. It is racing a fundamentally faster iteration cycle with a slower one. You do not close that gap with another dashboard or another five analysts. You close it by making the defensive loop run at the speed of the offensive loop.
Concretely, that means four things, and they map one-to-one onto the attacker primitives above.
Investigation starts when the signal lands, not when a human reaches it. An adversary going from stolen token to tenant admin in three hours will not wait for your queue. Every alert has to be worked end to end, with full context, the moment it arrives. This is the entry point, and it is where our customers start: AI agents investigating alerts while people stay on the loop. On our largest deployment, that produced a 95 to 99% reduction in the tickets a human has to look at, which is not a headcount story, it is a "your people are now working the 1 to 5% that actually needs them" story.
Response executes at machine speed where the evidence is unambiguous. Detection without action is just a faster way to observe your own breach. The loop has to close on the defensive side too, which means agents that can act on evidence-backed conclusions, with humans on the loop for the calls that require judgment.
The loop compounds. The attacker's loop gets better every iteration because it learns what evades. The defensive loop has to compound the same way: every closed investigation should improve the next detection, so false positives teach benign context and true positives teach which supporting signals mattered. If your detection library is static while the adversary's evasion is adaptive, you are bringing a fixed rule set to a learning fight. The asset is no longer the rule library. It is the rate at which the loop improves itself.
People lead, agents execute. The report showed attackers keeping humans on target selection, monetization, and review. Defense keeps humans exactly where they belong: on the loop, directing strategy, making the judgment calls, running toward the hard problems, while agents handle the machine-speed work no human team can sustain. This is what we mean by People-Led, AI-Driven, and it is why we build the platform so that every investigation and every action records its full reasoning. When an agent reaches a verdict, an analyst can inspect exactly what it checked, what it found, and why. No black box. In a world where the adversary's agents are opaque by design, the defender's agents have to be the opposite.
This is the whole reason we built 7AI as a foundational layer for security operations rather than another point tool: detect, investigate, respond, and hunt as one continuous system, grounded in your own environment, with humans on the loop. Not because it makes a good diagram, but because the report you just read describes an adversary that runs exactly this kind of loop, and the only thing that keeps pace with a loop is another loop.
The honest close
I said I would not editorialize past the evidence, so let me end where the evidence leaves us.
Anthropic disrupted every operation in this report, strengthened its safeguards, and shared intelligence with industry and government partners. That work matters, and the report closes on the right note, that these findings should "strengthen collective defenses." But the adversaries it describes iterate faster than human-speed intelligence sharing can counter on its own. Sharing a signature is only as useful as the speed at which defenders can act on it, and the attackers in this report rebuild past signatures in minutes.
So the interesting question for every security leader is no longer whether attackers closed the loop. This report settles that. The question is how long a human-speed defense can reasonably be expected to hold against a machine-speed offense, and what it looks like to run the loop back at the same speed, with your people on it where judgment lives.
The attackers did not win because AI gave them a weapon we do not have. They moved first because they had no trust threshold to clear, no oversight to satisfy, no obligation to be right. Defenders have all three, and should. But the underlying capability, the loop itself, is available to both sides at the same moment. That is the opportunity in the report, hiding inside the warning. We have the same primitives. The question is whether we use them at the same speed.
