Abstract

AI threat intelligence is revealing a meaningful change in how malicious actors operate. Anthropic’s September 2026 findings describe selected cases in which AI moved beyond providing technical advice and became an operating layer for reconnaissance, tool development, intrusion, data processing, evasion, and persistence. The reported activity spans seven harm areas, from cyber operations and surveillance to fraud and weapons development. These cases do not show how common AI-enabled attacks are, but they demonstrate what is already possible. Leaders should respond by protecting enterprise AI assets, shortening defensive response times, and extending governance across agents, identities, suppliers, and connected platforms.

---

---

Executive Summary

• AI is lowering operational barriers. Individual operators can access capabilities that previously required deeper expertise, larger teams, and specialized tooling.
• The threat is becoming agentic. Multi-agent workflows can map environments, build tools, execute commands, process stolen information, evade detection, and continue under human direction.
• Defense must move at machine speed. Leaders should secure the AI control plane, automate containment, and govern identities, SaaS platforms, suppliers, and downstream customers.

Expanded Insights

AI Threat Intelligence Shows a Shift Toward Orchestration

The central AI threat intelligence finding in Anthropic’s September 2026 report is the changing operational role of AI. Earlier misuse often involved someone asking a model for code, research, or tactical advice. The newer cases describe agents participating across much more of the workflow. They performed reconnaissance, authored and executed scripts, processed stolen data, monitored whether malware was detected, and helped rebuild tools to evade defenses.

Humans still selected targets and reviewed outputs, but agents handled many intermediate decisions and repeated the process. This turns isolated tasks into a persistent operating loop.

Five Findings Leaders Should Understand

First, skill barriers are weakening. Anthropic observed individuals and small groups using AI to perform work that previously demanded several experienced operators. Sophistication is therefore becoming a less reliable indicator of who is behind an attack.

Second, AI threat intelligence shows that misuse is broad. Anthropic documented activity across cyber operations, surveillance, influence operations, weapons, biological misuse, fraud, and illicit model distillation. Across these areas, AI helps actors interpret information, build assets, and sustain complex assignments.

Third, operations can move quickly. One reported compromise progressed from a stolen developer token to full cloud administrative control in roughly three hours. Another extracted more than 2,100 Azure AD token sets across more than 40 corporate tenants in about 34 hours.

Fourth, AI supports scale. One credential-harvesting pipeline scanned 1.8 million Android applications for hardcoded secrets. Fifth, AI enables adaptation. Anthropic described agents modifying and rebuilding malware when security products detected it, reducing the lasting value of static signatures.

These figures come from selected notable cases. They are not prevalence estimates or universal measures of attacker performance.

The AI-Enabled Attack Loop

AI threat intelligence reveals an emerging model with six stages: reconnaissance, building, exploitation, exfiltration, adaptation, and repetition. Agents identify systems and access paths, generate scripts and infrastructure, execute commands, organize stolen information, adjust when an approach fails, and continue operating.

These stages have always existed. AI reduces the work required to connect them, preserve context, and navigate unfamiliar environments. This reflects the shift described in DevNavigator’s analysis of the Agents API and autonomous work: AI is progressing from assisting with tasks toward coordinating tools and workflows.

Protect the AI Control Plane

AI threat intelligence must also account for enterprise AI infrastructure becoming a target. Attackers have pursued API keys, model access, cloud resources, source code, agent credentials, and proprietary data. A compromised AI credential can give an attacker both capability and a trusted route into connected systems.

Leaders should treat these assets as a dedicated security boundary. Controls should include scoped permissions, short-lived credentials, secrets management, environment separation, usage limits, and telemetry showing who initiated an action, which agent acted, what it accessed, and what changed.

Defend at Machine Speed

Google Threat Intelligence has separately reported a similar movement from prompting toward autonomous adversarial workflows. The overlap reinforces a practical conclusion: AI security and conventional cybersecurity can no longer operate as separate disciplines.

Defenders need an adaptive loop of their own. Automation can correlate signals, validate suspicious behavior, revoke credentials, isolate resources, and preserve evidence before an attack spreads. Human approval should remain where actions are difficult to reverse or could disrupt critical operations.

Many attacks still begin with stolen credentials, excessive permissions, exposed services, and weak supplier controls. AI helps more actors find, exploit, and revisit those weaknesses. Effective AI threat intelligence should guide leaders to protect the AI control plane, test agentic attack scenarios, govern suppliers, and ensure defenses can learn as quickly as the attack.