Unknown Author
6 min
This report details the evolution of AI misuse between December 2025 and August 2026. Anthropic’s Threat Intelligence team identified that threat actors—ranging from state-sponsored groups to opportunistic cybercriminals—are no longer just using AI as a simple chatbot assistant. Instead, they are integrating AI into autonomous workflows to conduct cyber operations, influence campaigns, and surveillance at a speed and scale previously unattainable for individual operators.
The most significant trend is the collapse of the labor and tooling gap. Sophisticated attacks that once required teams of specialists are now being executed by lone individuals using AI to automate reconnaissance, exploit development, and data exfiltration. For example, actors are using AI to build autonomous 'exploit foundries' that continuously scan for vulnerabilities, develop proof-of-concept exploits, and test them against lab environments. Furthermore, the AI supply chain itself has become a primary target; attackers are actively stealing API keys and session tokens to gain free compute, evade detection, and maintain persistence within victim environments.
Beyond cyberattacks, AI is being used to manipulate information environments and conduct transnational repression. Influence operations are increasingly professionalized, with actors using AI to manage fake news pipelines, generate synthetic personas, and launder state-aligned narratives to appear as independent local reporting. Similarly, surveillance operations are leveraging AI to ingest bulk social media data, profile dissidents, and generate structured intelligence dossiers. These operations often target vulnerable diaspora communities, with AI acting as a force multiplier that allows a single operator to perform the work of an entire intelligence desk.
The democratization of these advanced capabilities means that the barrier to entry for conducting high-impact malicious operations has been significantly lowered. As AI models become more capable, the economic incentives for attackers to adopt these frameworks will only increase. This report serves as a call to action for AI developers, governments, and civil society to strengthen collective defenses, improve detection of behavioral signatures, and recognize that AI-enabled threats are now a persistent feature of the global security landscape.
Alex: And on the malware side—you mentioned autonomous evolution. How does that actually work?
Sam: The Iranian case is the clearest example. Actors used Claude to build and debug modular implants, iterating across fragmented sessions to obfuscate identifiers and inject dummy functions that bypass static analysis. By breaking the work across sessions, they also bypassed the model's safety filters. The result is a toolkit that continuously rebuilds itself to evade detection—a closed loop the defender can't easily break into.
Alex: That's a structural advantage. Every time a defense triggers, the AI regenerates the tool. The defender is playing whack-a-mole against an automated factory.
Sam: And it extends beyond malware. In the Mali case, an actor used Claude as the primary engineering workforce to build a population-scale surveillance platform—"Lakana 360"—designed to intercept voice and text traffic across national mobile networks. The AI provided expertise that would otherwise have required a large, specialized team. It effectively democratized state-level surveillance capability. [[RP_SECTION:illicit-model-distillation|Illicit Model Distillation]]
Alex: Which brings up something the report flags that I want to make sure we cover—illicit distillation. This isn't just about using these models; it's about cloning them.
Sam: Right, and this is where the threat becomes structural rather than operational. Labs use proxy networks—thousands of fraudulent accounts—to systematically feed prompts into frontier models and capture the chain-of-thought outputs. They use those outputs to train their own smaller models, bypassing years of R&D by essentially cloning the internal reasoning process.
Alex: They're not just using the model. They're reverse-engineering how it thinks.
Sam: Exactly. And the danger is specific: safety safeguards in frontier models often rely on that internal reasoning chain. When you distill the model and strip away the chain-of-thought, you're left with a high-capability system that's shed the safety layers. Cross-session replay attacks are used to force the model to reveal its reasoning signatures across multiple interactions—then those signatures become the training signal.
Alex: So the safety work that goes into these models is being systematically extracted and discarded. What's the defensive response?
Sam: It's iterative. The report points to "preserved thinking"—encrypting reasoning traces so they can't be captured—alongside metadata analysis to identify and block proxy networks. The goal is to make the cost of extraction exceed the value of what's extracted. Whether that's achievable at scale is an open question. [[RP_SECTION:future-access-models|Future Access Models]]
Alex: And it raises a harder question about access models. If open, anonymous access is being used to build adversarial capabilities, does that fundamentally change how these systems should be deployed?
Sam: That's the central tension the report doesn't fully resolve. It suggests that for sensitive capabilities, the field may need to move toward verified user programs rather than anonymous access. The "move fast and break things" model doesn't hold when what's being broken are the safety foundations of frontier AI. The report frames this less as a policy recommendation and more as an emerging operational reality—one that the threat landscape is forcing, regardless of whether the industry is ready for it.
Alex: That's a useful distinction. The democratization of these capabilities is genuinely double-edged—the same properties that make these tools broadly useful make them broadly exploitable. Thanks for walking through the technical reality, Sam.
Sam: Thanks for listening to ResearchPod.