Anthropic threat intelligence report

Anthropic, the company behind the Claude model, has published its fourth threat intelligence report. It describes activity the company detected and stopped between December 2025 and August 2026.

Another record-breaking Microsoft Patch Tuesday landed this week, fixing a number of critical vulnerabilities. But something else caught my eye. Anthropic has published its fourth threat intelligence report. A report that describes, among other things, a Russian espionage group that deployed AI agents whose sole job was to check whether security products would detect their malware, and to keep refining it. Or an attacker who downloaded almost 2 million apps, analysed them and hunted for API keys. And much more.

Elsewhere in this Security Sunday we look at a vulnerability in MikroTik routers, at the record Patch Tuesday already mentioned, and at a GitLab vulnerability with a CVSS score of 10.0.

Anthropic, the company behind the Claude model, has published its fourth threat intelligence report. It describes activity the company detected and stopped between December 2025 and August 2026.

Defenders, in the best case, see an attack in a log, in NetFlow data, on a next-gen firewall or in a SIEM — in other words, at the moment it begins.

An LLM provider, on the other hand, sees the attacker while the operation is still being built. While they are picking targets, writing tools and tuning phishing infrastructure.

That is precisely what makes this report so interesting.

Before we go any further, one thing needs saying plainly. This document was written by the company about itself. It appears in it as both victim and investigator. None of the figures can be independently verified. So everything I mention today comes with an implicit “according to Anthropic”.

What has changed, according to the report? Across all the cases, three things.

First, a sophisticated attack no longer requires an elite attacker. That is bad news for defenders and investigators. For years we relied on a fairly dependable rule of thumb: this is too good for one person, so there must be an organised group behind it. That rule is now breaking down.

Second, there has been a shift in the role AI actually plays in an attack. Most of the operations described were not of the “I asked a chatbot how to do something” variety. They were ensembles of agents that carried out reconnaissance, exploitation and data exfiltration on their own. The human’s only job is choosing the targets.

And third, perhaps most importantly, these techniques are public. Yes, there are publicly available offensive agentic frameworks — the report names PentAGI, for example — from which anyone can download ready-made scaffolding for the entire attack chain.

So let’s look at the specific cases.

I will start with the one that concerns us most geographically. Anthropic tracks it as GTG 20006. A Russian-speaking actor, one of whose operators went by the handle JackPoterz. Anthropic also notes that its attribution is consistent with public reporting on Midnight Blizzard. The attacker ran operations against more than 20 targets — ministries, embassies and arms manufacturers across Europe.

One of the targets was a drone supply chain. The attacker exported the mailboxes of at least two component manufacturers and stole a complete development kit. Several agents then went to work on it and reverse-engineered the product architecture, the hardware bill of materials and further product details.

The next part is, in my view, the one with the greatest impact on an ordinary company.

Anthropic monitored several groups linked to the well-known ShinyHunters group. One operator built a pipeline across ten cloud instances that downloaded almost 2 million Android apps, decompiled them and searched them for hard-coded credentials. Verified hits went straight to the attacker’s Telegram, sorted into more than a hundred categories by key type. If any of you have a key hard-coded in a mobile app, it is most likely already in the attacker’s dataset.

And what did this effort yield? At one technology provider, over 1 TB of data, hundreds of thousands of national identifiers and millions of payment card records. At an airline, access to systems holding tens of millions of passenger records. And at an energy company, the attackers claimed they could remotely control the charging current of domestic EV chargers.

The pace of attacks has increased too. One intrusion into a software company took a matter of hours from initial access to mass data theft. In another case, the attackers went from a single stolen developer token to full administrative control of the cloud environment in roughly three hours.

While we are on the subject of API keys — a separate chapter of the report describes how the AI supply chain itself has become a target. When someone steals your API key for a language model, they gain three things at once:

The key can be resold — it has a market value.
The attacker’s workload runs on your account, so you are paying for their compute.
It can serve as a way into other connected services.

One hacktivist campaign ran for an entire month exclusively on other people’s stolen keys. Another group operated fake AI resellers offering cheap access to Claude. In reality, it was quietly routing traffic to a completely different model while installing a credential stealer on its customers’ machines.

Add “AI integrations” to your risk register. Gateways, sandboxes, agents with access to internal systems. The report includes a case in which the attacker only needed to send a malicious instruction to a sandbox, and the sandbox handed over production keys on its own.

The next part could be described as a “zero-day factory”.

Two students in China built an automated pipeline for finding vulnerabilities in firmware. The firmware is downloaded, decrypted, unpacked and loaded into a decompiler. An agent goes through the code, works out where a bug might be, writes an exploit for it, tests it against a copy running in a lab, and iterates until the exploit works.

The lesson is one I have been repeating for a long time. Whatever we have on the perimeter is, in effect, subject to continuous machine-driven reverse engineering. There is no point telling ourselves we will patch faster — most companies are already doing that at the limit of what is possible. What does make sense is having fewer things exposed and, above all, knowing what is facing the internet.

The rest of the report covers further activity. Among the cases that caught my attention is one in which a single consultant built a platform for Mali’s intelligence service that blanket-monitors roughly 25 million SIM cards across all three of the country’s operators. Interception of calls and SMS, and identification of a person by voice even after they swap SIM cards. The platform runs locally, on its own models. The development was done using Claude.

What to say in conclusion? The attacks themselves are not new. Stolen passwords, unpatched devices on the perimeter, exposed services, phishing, zero-day hunting. None of the operations described relied on a technique we did not already know. What has changed is speed — and what used to take teams of people can now be done by a handful of individuals. So keep an eye on what you have exposed to the internet and on forgotten keys in your apps, and test both your systems and your people regularly.

Attackers are taking over MikroTik routers exposed to the internet

Poland’s national CERT, CERT Polska, has confirmed that attackers are actively exploiting a chain of two newly disclosed vulnerabilities in MikroTik RouterOS to gain full administrative control of routers whose SSH service is reachable from the internet. CERT Polska, which discovered and coordinated the disclosure of six RouterOS flaws in total, has named the exploited combination “MikroTrick”. Its advisory of 5 September 2026 states that successful attacks have been observed since at least 2 September and that the fixed RouterOS versions MikroTik released on 3 September stop the observed attacks. MikroTik’s own bulletin confirms that fixes are available in all release channels, and according to CERT Polska the vendor has, for the first time, sent a push notification to users of its mobile app urging them to update.

CVSS 10.0 GitLab vulnerability allows file reads

On 10 September, GitLab released emergency patch versions 19.3.2, 19.2.6 and 19.1.8 for both Community Edition (CE) and Enterprise Edition (EE), addressing eighteen security flaws in total. The most severe is CVE-2026–85706, a path traversal vulnerability in the repository commits API that GitLab has rated with the maximum CVSS score of 10.0. According to GitLab’s security bulletin, the flaw stems from insufficient path restriction combined with missing authentication enforcement, and under certain conditions it allows an unauthenticated attacker to read arbitrary files from the GitLab server. All versions from 18.7 prior to 19.1.8, from 19.2 prior to 19.2.6 and from 19.3 prior to 19.3.2 are affected. GitLab.com was already running the patched code at the time of disclosure, and GitLab Dedicated customers do not need to take any action. The vulnerability was reported through GitLab’s bug bounty programme on HackerOne by a researcher going by the handle s3ntago.

September Patch Tuesday: two actively exploited zero-days and over 100 critical vulnerabilities

September’s Patch Tuesday, released by Microsoft on 8 September, is being described across the industry as the largest security update in the company’s history. CrowdStrike’s Falcon Exposure Management team counted 972 CVEs, 113 of which are rated critical; Microsoft itself lists 974 in its release notes, and other trackers range between 964 and 966 depending on whether they count fixes for cloud-only services and out-of-band updates. Whichever figure you use, the volume is more than double that of August. Elevation-of-privilege flaws dominate (437 patches, roughly 45%), followed by remote code execution (258, roughly 26%) and information disclosure (171, roughly 18%). Windows accounts for the most fixes, followed by the Extended Security Updates programme and Microsoft Office.