🧭 Anthropic's September 2026 Threat Report: Industrial Distillation Campaigns, State-Sponsored Malware, and Nine Influence Operations

Published September 10, Anthropic's latest Threat Intelligence Report covers eight months of observed misuse from December 2025 through August 2026. The dominant story is industrial-scale model distillation — systematic attempts by Chinese AI labs to extract Claude's capabilities by generating vast quantities of training data through Claude's API using fraudulent accounts. The report identifies DeepSeek, Moonshot AI, and MiniMax (an Alibaba-affiliated lab) as the primary actors, continuing the pattern Anthropic first disclosed in February 2026. Beyond distillation, the report documents state-sponsored threat actors using Claude to automate malware development, and nine influence operations spanning six continents that used Claude to fabricate news outlet infrastructure at scale.

Model distillation at industrial scale

Distillation attacks work by systematically prompting a frontier model to produce high-quality outputs — reasoning chains, code, structured analysis — and feeding those outputs directly into a smaller model's training set. The goal is to achieve near-frontier capability at a fraction of the compute cost. Anthropic's detection approach combines usage-pattern analysis (account velocity, geographic clustering, prompt similarity), policy enforcement (API terms prohibit training on outputs), and account suspension. The three labs named in the report were identified through:

• Account clustering: Thousands of fraudulent accounts showing coordinated usage patterns, often registered through proxy services in neutral jurisdictions.
• Prompt fingerprinting: Systematic prompt structures designed to elicit detailed chain-of-thought reasoning — the output format most valuable for distillation training.
• Volume anomalies: Request rates and daily token consumption inconsistent with any legitimate use case, sustained over weeks.

State-sponsored and criminal misuse

The report documents a Russian advanced persistent threat group (identified as GTG-20006) using Claude to assist with credential-harvesting campaigns — specifically to generate convincing phishing content at volume and to automate the customisation of commodity malware for specific target environments. This is consistent with Anthropic's 2025 threat reports, which noted a shift from manual APT operations toward AI-augmented automation. Separately, nine influence operations across Africa, Asia, Latin America, and Europe used Claude to generate content for fabricated local news outlets — a pattern where plausible AI-generated text reduces the cost of standing up fake media infrastructure.

What Anthropic did in response

• Suspended the identified distillation-attack account clusters and shared indicators with US government partners.
• Notified the three named labs directly before publication (consistent with Anthropic's responsible disclosure policy for misuse findings).
• Updated rate-limiting and anomaly-detection heuristics to reduce the window between attack initiation and detection.
• Published a public technical annex with sanitised indicators of compromise for the GTG-20006 malware-automation campaigns.

🧭 Anthropic Opens Insights to External Researchers — Stanford, Oxford, and METR Publish First Independent Studies on Real Claude Usage

Published August 26, Anthropic's announcement of the Anthropic Insights external pilot represents a meaningful step toward third-party accountability in AI: for the first time, researchers outside an AI company have run independent public studies using that company's own real-world usage data. Three institutions — Stanford's SALT Lab, the Oxford Human Information Processing Lab, and the AI evaluation non-profit METR — each analysed approximately 250,000 Claude conversations from April–May 2026, with aggregate anonymised findings now publicly available on Hugging Face.

What Anthropic Insights is

Anthropic Insights (formerly known internally as Clio) is a privacy-preserving analysis layer that allows researchers to run queries against aggregated, anonymised Claude conversation data. Individual messages are never exposed; the system operates on statistical summaries and thematic clusters. The pilot extends access beyond Anthropic's own research team for the first time, under data-sharing agreements that restrict findings to aggregate publication only.

Key findings from the three studies

• Stanford SALT Lab (human-AI collaboration): More than half of Claude conversations involved delegating a consequential task — something with a real downstream outcome, not just information lookup. In roughly 75% of those conversations, humans remained in the directing role while Claude executed. Friction events (where Claude pushed back, asked for clarification, or returned an unexpected result) were associated with better final outcomes — users who experienced friction produced higher-quality work.
• Oxford Human Information Processing Lab (user experience): Users' emotional state at the start of a conversation correlated meaningfully with how they rated Claude's responses — suggesting that perceived quality is partly a function of user mood, not just response quality. Engagement patterns across a Claude conversation closely resembled those in everyday web browsing: short bursts of dense interaction, punctuated by pauses.
• METR (capability evaluation): Newer Claude model releases delivered statistically significant coding speedups versus prior versions when measured on real user tasks — not benchmarks. Claude's self-reported time estimates for coding tasks correlated reasonably well with actual time developers spent, suggesting the model has calibrated task-complexity awareness.

Access the published data

The aggregate findings from all three studies are available as a Hugging Face dataset. Researchers can apply for the next cohort of the Anthropic Insights pilot through the Anthropic research portal. Priority is given to teams with IRB approval and a focus on societal impact, safety, or human-AI interaction.