Anthropic's Threat Report: Attacks Run on Agent Frameworks, and the API Key Is the Loot

§ 01The two trends Anthropic leads with#

The cyber section opens with two claims and then spends its case studies proving them. The first is about who can attack: “AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators”, so that “sophistication has stopped being a reliable signal of who is behind an operation”. The second is about how: “A majority of the operations described in this report were enabled by AI via direct execution or orchestration”, meaning multi-agent frameworks running reconnaissance, exploitation and exfiltration while humans picked targets and reviewed what came back.

Anthropic’s own conclusion from this: “The capabilities described in this report should be assumed to be available to any actors who are motivated to use them.”

§ 02The cyber cases#

§ 03The AI supply chain is now the target#

This is the section we would put in front of anyone who runs agents with real credentials. Anthropic’s sentence: “Access to AI in the form of compromised API keys, session tokens, and devices has increasingly become the sole objective of multiple criminal groups.” The stolen access flows to brokers, then to fraudulent reseller networks that rotate through keys until each one is exhausted, and back to attackers who run their operations on other people’s quotas.

The GTG-50020 case is the sharpest. “By injecting malicious instructions into an AI vendor’s automated evaluation sandbox, the actor caused the sandbox to hand over the credentials it held”, including production API keys from several providers. With those keys in hand the actor “automatically switched to using the victim’s keys instead of their own”, then ran a follow-on campaign that “attacked roughly thirty AI companies in about four days with similar techniques”, one working attack path repeated against all thirty. Anthropic calls it “the clearest demonstration to date that the AI supply chain has become a deliberate criminal target”, and is precise about the boundary: “The actor never compromised Anthropic’s own systems”, and the goal of reaching a pre-release model was never realized.

01The sandbox as bait: injected instructions, keys handed over, 30 firms hit in 4 days

02The reseller economy: stolen keys to brokers, rotated by resellers, rented by attackers

03The spoofed client: a fake Claude Code installer harvesting every token on the machine

04The layers that stop it: server-held keys, scoped per agent, every command classified

1 / 4

←→

§ 04Distillation: seven labs, one at 151 million exchanges#

Anthropic defines the term before naming names: “We define illicit distillation as an industrial-scale, covert campaign to extract a model’s capabilities and replicate them in another model without authorization”, enabled by fake accounts, stolen cards and proxy networks that route around geographic restrictions. It then attributes campaigns to seven China-based labs, all against generally available models; none targeted Mythos 5 or Mythos Preview.

The relay cases are the ones that will surprise users of those products. Moonshot “silently forwarded customer requests to Claude, instead of processing them using Kimi”, almost 300,000 of them in one ten-day window, most routed to Opus. DeepSeek checked inbound requests for strings that mark coding harnesses and relayed tagged users to Claude Opus; Anthropic’s examples include an employee analyzing internal documentation and an engineer building a case-management system for a municipal Public Security Bureau. The countermeasures Anthropic lists: “Claude now summarizes its internal reasoning before responding, which makes stolen transcripts less useful for training another model”, Fable 5.1’s preserved thinking stops new API accounts from editing the context that precedes a reasoning block, and accounts operating from unsupported countries or reselling access can be required to verify their identity.

§ 05The other five harm areas#

§ 06Which models, and what Anthropic changed#

The report is careful about model generations. In the summary: “None of the misuse cases involved the use of Claude Fable or Mythos-class models, with the exception of one illicit distillation case.” In the cyber section: no malicious activity was found on Fable or Mythos, which carry safeguards that Anthropic says greatly reduce their ability to perform harmful cyber tasks. Every case in the report ran on Haiku, Sonnet or Opus.

What changed on Anthropic’s side, per the report: distillation classifiers strengthened with the Fable 5 launch, summarized reasoning in responses, preserved thinking in Fable 5.1, identity verification for accounts that look like resale or unsupported-region access, and in every case the accounts banned, the safeguards updated, and intelligence shared with authorities and industry partners.

§ 07Anthropic’s threat reports so far#

§ 08What this means if you run agents on real systems#

Our conflict, declared: we build CellCog, an AI employee platform, and our employees run on Claude. Agent, Agent Creative and Agent Team route to Claude Fable 5.1 at the Core and Max tiers, with Gemini 3.8 Flash at Flash, and we publish which model runs where. Anthropic reports no misuse on Fable-class models except the one distillation case, and the cases in this report ran on older generations. That is the reassuring half.

The half that applies to every agent platform, ours included, is the supply chain. Read the four pathways again: a sandbox that held live production keys and could be talked into handing them over; wrapper services whose containers carried the keys an injected prompt could exfiltrate; installers that harvested every token on a developer’s machine; keys left in apps and repositories. None of those is a model failure. Each is a place where a credential sat within reach of something that could be manipulated.

That is the shape we built against. Every CellCog employee runs in its own isolated workspace. Credentials are scoped per employee and enforced on the server, so a prompt that reaches an agent does not reach a key. Every command that reaches your world, a terminal on your machine, your real browser, a connected tool, is classified by the agent before it runs, the platform rejects any command that arrives unclassified, and the consequential ones wait for your approval. The alignment assessment showed why the boundary has to be a separate layer from the model’s judgment; this report shows why it also has to be a separate layer from the model’s credentials.

§ 09What we are watching for#

• The report PDF. Anthropic links a PDF edition from the page; if it carries indicators or figures beyond the web version, we fold them in here.
• Responses from the named labs. Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax have not, as of publication, responded on the record in anything we could read from a primary source.
• The sandbox vendor. Anthropic does not name the AI vendor whose evaluation sandbox was injected; a disclosure from that company would be the first outside account of the case.
• Whether the next report names a Fable-class misuse case. The one-case exception is the number to watch across generations.

§ 10Sources#

Anthropic, Detecting and countering misuse of AI: September 2026, September 10, 2026 (read in full the day of publication; every quotation above is from this page, and the PDF edition is linked from it). Anthropic’s Threat Intelligence index lists the earlier reports, including Detecting and preventing distillation attacks (February 2026). Our routing statements reflect CellCog’s configuration as of September 10, 2026.