Anthropic just outed the criminals abusing its own AI. Here is what your business needs to hear.
On September 10, Anthropic published something most tech companies would rather bury. It is a full report on how criminals and state-linked hackers tried to weaponize Claude, its own AI model. The report names the actors. It also names the techniques. It even publishes the digital fingerprints, called indicators of compromise, so other companies can check their own systems. That is rare. Instead, most AI vendors stay quiet about attacks on their platform. Anthropic did the opposite, and that choice tells you something about where AI security is heading. Right?
What actually happened
The report is called “Detecting and countering misuse of AI: September 2026.” It covers nine months of activity. That stretch runs from December 2025 through August 2026. Anthropic sorted what it found into seven harm areas. Those are cyber operations, influence operations, surveillance, scams and fraud, biological misuse, weapons development, and something called illicit distillation. That last term basically means copying a model’s skills without permission, like cloning it through the back door.
Three cases that stand out
First, a group consistent with the Russian espionage actor publicly known as Midnight Blizzard used Claude to help scan systems. Their targets spanned more than two dozen Ukrainian government organizations. Then, they stole a complete software kit for a drone vision system. They also broke into a North African government technology authority. From there, they pulled more than 300,000 national identity records. They also took commercial registry data on over half a million companies.
Second, operators tied to the ShinyHunters criminal collective ran an even bigger operation. In one stretch, they captured session tokens from more than forty corporate tenants. As a result, that took about thirty four hours, start to finish. For example, at one technology provider, they exfiltrated more than a terabyte of data. That haul included hundreds of thousands of national ID numbers. Then, at an airline, they reached tens of millions of passenger records. Anthropic was direct about the cause: “In every instance, the API keys involved were stolen from Anthropic customers’ environments. Anthropic’s own systems were not compromised by this actor.”
Third, a cluster of Chinese-speaking operators, some of them university students, targeted roughly fifty organizations. Then, their targets spanned education, retail, energy, and government. So they pointed an automated research loop at a major security product. It surfaced several previously unknown flaws, also known as zero-days, on its own.
Then, Anthropic banned every account tied to these operations. It also shared what it learned with law enforcement and industry partners. That is similar to a bank flagging a fraud ring to other banks.
The detail most coverage will skip
Here is the insight buried under all those numbers, and it matters more than the scary headlines. In case after case, the AI itself was not hacked. Instead, the break-in point was a stolen credential sitting in someone else’s environment.
An API key works like a password. So it lets one piece of software talk to another. Once a criminal had one, the AI simply did what AI does well. It worked fast, and it worked at scale. Instead, the real danger here is not a machine turning against us. It is an ordinary mistake, like a leaked key or a sloppy integration, becoming far more costly because AI can act on it instantly.
As a result, that distinction changes what you should actually worry about. In other words, this was not an AI safety failure in the way most people picture one. It was a plain old credential-management failure, amplified.
Why this matters to your organization
You do not need to be a government target for this to apply to you. Every business that connects an AI tool to email, a CRM, or a support desk is creating something new. Each of those connections is a credential worth protecting. Therefore, the real question is not whether you use AI. Most of you already do, in some form. Instead, the question is whether you treat those AI credentials with the same seriousness as your production passwords.
Therefore, this is exactly the gap that UnDesto’s Security pillar exists to close. Strategy and Infrastructure usually get the spotlight during an AI rollout. Security, meanwhile, tends to get bolted on afterward. Often, that only happens once someone already has an incident to explain to the board.
What to do about it this week
So, what should you actually do with this? Here is a short list, and none of it requires a security degree to execute.
- First, inventory every API key and AI integration your business currently has active. If you cannot list them, that gap is the first thing to fix.
- Rotate any AI credential that has existed for more than ninety days. Then, put a recurring reminder on the calendar so it keeps happening.
- Buy AI access only through your vendor’s official channel. A discounted reseller offering cheap Claude or GPT credits is, more often than not, a stolen-key operation wearing a friendly logo.
- Also, require multi-factor authentication on every account that can generate or manage API keys, not just on your email logins.
- Ask your AI vendors, in writing, what they do to detect misuse on their own platform. After all, Anthropic just showed the industry what a strong answer looks like.
None of this is glamorous work. Still, that is the difference between two very different Mondays. One where you read a report like this out of curiosity, and one where you read it because your company’s name showed up in it.
Let’s talk about it
If your team is scaling AI faster than your credential hygiene can keep up, you are not alone. That is a normal place to land. It is also fixable. It just gets easier once someone maps the actual exposure instead of guessing at it. So, reach out to UnDesto AI, and let’s find out where yours sits before someone else finds it for you.
Cuídense mucho, mi gente. La inteligencia artificial no es el enemigo, pero una llave robada sí lo es.
Sources
Featured photo by FlyD on Unsplash. In-body photo by Winston Chen on Unsplash.