Anthropic's AI misuse report: agents do the steps, humans still choose the targets

Context

Anthropic published a long report on misuse of Claude that it had detected. The commentary this piece draws on is dated 25 September 2026 and places the report “earlier this month”, so it appears to have been published in September 2026; the source gives no title, publication date, or reporting window for the report itself [1]. A writer named in the source as Daniel Meissler is credited with condensing it into 117 findings, and Bruce Schneier picked out the highlights [1]. The name may be a misspelling in the source of a similarly named practitioner, so treat the attribution as unconfirmed.

One caveat before anything else: the only source for this piece is a summary of a summary. We do not have the original Anthropic report in hand, so we cannot check its methodology, the period it covers, how incidents were counted, or how confident Anthropic was in each attribution. Treat the specifics below as reported second-hand, and the structural pattern — not any individual number — as the takeaway.

That pattern is worth sitting with, because it is more mundane and more useful than most of what gets written about AI and offensive security.

The mechanism: division of labour, not autonomy

The recurring shape in the findings is a split between machine execution and human intent. As the summary describes it, agents took on the repeatable work — reconnaissance, exploitation, pulling data out, producing propaganda, running surveillance pipelines, background research — while people stayed in the loop to choose who got hit, define what success meant, and check the results that carried weight [1].

That is not an autonomous attacker. It is a labour model. The expensive, judgement-heavy parts of an operation stayed with humans. The repetitive parts moved to agents.

On the intrusion side, the report is described as covering the industrialisation of credential theft, cloud compromise, phishing, vulnerability research, and extraction of sensitive data from downstream organisations [1]. Note the last item: the value of a compromise is not confined to the victim. Access to one organisation becomes a harvesting position over everyone connected to it, and agents make working through that inventory cheap.

Influence operations show a similar industrialisation, with a sharper lesson attached. Reported ingredients include agent memory that persists across sessions, stood-up news sites, invented journalists, sock-puppet personas, profiling along political lines, and content generated at scale in multiple languages — and the summary notes that all that volume often produced little real engagement [1]. Output scaled. Impact did not follow automatically. Distribution and audience remain the hard part, and no amount of generated text solves them.

The surveillance and repression cases are the most operationally interesting. They reportedly included automated dossier building, biometric and communications analysis, transnational targeting, and coercive recruitment [1]. Crucially, some of these systems kept running locally after model access was revoked [1]. That is the detail defenders should carry away. Provider-side enforcement cuts off the tap, not the plumbing. Once a workflow has been built, tested and wired into local tooling, removing the account that shaped it does not remove the capability.

On biological and weapons cases, the summary is careful. AI reportedly supported advanced scientific and military work, but the report generally does not establish completed biological weapons or operational battlefield deployment [1]. Dual-use risk observed; catastrophic outcome not demonstrated. The distinction matters and is routinely collapsed in coverage.

Why it matters

Nothing here describes a new class of attack. Credential theft, cloud compromise, phishing and vulnerability research are the existing menu. What changes is unit cost and tempo — the number of targets a small team can work in parallel, and how quickly reconnaissance turns into an attempt.

That has a straightforward implication for defence. Controls that depend on attacker effort being scarce degrade first: obscurity, low-value-target reasoning, manual triage queues sized for human-paced attack volume, phishing awareness built around clumsy writing. Controls that do not care how the work got done — phishing-resistant authentication, least privilege, short-lived credentials, egress control, detection on identity and data-access behaviour — degrade much more slowly.

It also suggests where to spend attention on the governance side. Model-provider bans are a real friction, but the locally-persistent surveillance systems show that enforcement upstream is not a containment strategy for anyone downstream [1].

What to do

• Read the primary Anthropic report before acting on any specific claim here; this analysis rests on secondary coverage [1] and cannot vouch for counts or methodology.
• Assume reconnaissance against your external surface is continuous and cheap. Prioritise reducing exposed surface over detecting scanning.
• Close the credential-theft path first: phishing-resistant MFA on all identity providers and admin paths, no shared long-lived secrets, short credential lifetimes.
• Treat cloud identity as the primary blast radius. Audit role assumption chains, cross-account trust and service principals for standing privilege.
• Map your downstream exposure — the customers, partners and tenants whose data sits inside your systems — and assume an intruder will inventory it faster than you can.
• Re-tune phishing defence away from linguistic tells and toward structural signals: sender authenticity, domain age, unusual approval and payment flows.
• Size detection and triage for volume, not novelty. Automate the response steps you already know are correct.
• Do not treat a provider’s account suspension as remediation for a tool built with that provider’s help [1].