Anthropic says it disrupted Russia-linked espionage and Chinese extraction attempts against Claude models

Topic: technologyRegion: EuropeUpdated: i3 outletsSources: 6Spectrum: Mostly Center⏱ 3 min read📡 Wire pickup: 2

📰 Scored from 3 outletsacross 1 Left 2 Center How we score bias →

Story Summary

SITUATION

Anthropic said it disrupted several allegedly malicious uses of its Claude models over the past eight months, including a suspected Russia-linked cyber espionage campaign and attempts by Chinese artificial intelligence firms to extract and replicate Claude’s capabilities. Anthropic's Threat Intelligence report says cybercriminals and state-backed hackers increasingly used AI — often via multi-agent frameworks with human overseers — to orchestrate and execute large portions of attacks.

Coveragetap to expand ▾

Spectrum: Mostly Center🌍Asia: 2 · Other: 1

Political Spectrum

Position is inferred from coverage mix.

i3 outlets · Center

Left

Center

Right

Left: 1

Center: 2

Right: 0

Geography Coverage

Distribution of where coverage is coming from.

i3 unique outlets · Dominant: Asia

All3 Asia2 · 67%Global1 · 33%

KEY FACTS

One disrupted operation was a suspected Russia-linked cyber espionage campaign.
Anthropic accused Chinese artificial intelligence firms of efforts to extract and replicate Claude’s capabilities.
Anthropic said humans in these campaigns often acted as overseers rather than hands-on operators.
The report states cybercriminals and state-backed hackers are using AI to orchestrate and execute large portions of cyberattacks.

HISTORICAL CONTEXT

The immediate backdrop is the ongoing U.S.–Israel military campaign against Iran that began with coordinated strikes on Iranian infrastructure on March 13, 2026, which Washington and Jerusalem said were carried out in response to escalating Iranian attacks and proxy operations across the region.

Structurally, that campaign sits atop long-standing nuclear diplomacy and sanctions regimes: the Joint Comprehensive Plan of Action (JCPOA) signed July 14, 2015, and the United States’ formal withdrawal from the deal on May 8, 2018, which reshaped sanctions and regional security calculations.

Brief

Anthropic published a 154-page report on September 10, 2026 that lays out specific cases in which its Claude family of large language models were misused in scams, cyber operations and instances the company labels as biological misuse.

The company says these incidents were detected and disrupted and occurred between December 2025 and August 2026; Anthropic frames the report as both a disclosure of those disruptions and a warning about rising risk as models gain capability (per thehindu.com).

The document groups the cases into seven areas of misuse and provides detail on episodes the company saw and intervened on, emphasizing defensive detection and mitigation actions rather than alleging wider sector-wide culpability (per thehindu.com).

Anthropic’s account foregrounds company detection and disruption capacity: the report repeatedly describes actions the firm took after identifying misuse, and it frames publication as a tool to illustrate threats and improve defenses across stakeholders (per thehindu.com).

Outside the report itself, the company’s framing stresses that more capable models increase the scale and sophistication of potential abuses; the report therefore reads both as an incident log and a policy-oriented warning about emergent risks (per thehindu.com).

The report does not, in the text excerpt provided, attribute these abuses to named external actors beyond categorizing the kinds of misuse or quantify broader downstream harms to specific populations; instead it focuses on the incidents the firm detected and the disruptions it mounted (per thehindu.com).

Policymakers, defenders and researchers will likely use the report as an empirical catalog of misuse cases and mitigations, but the single-source coverage here offers Anthropic’s perspective without independent corroboration of every case; readers should treat the report as a company disclosure of detected and disrupted incidents rather than a comprehensive, independently verified inventory (per thehindu.com).

Sources

6 of 6 linked articles