Expand menu

Anthropic published its September threat intelligence report yesterday, covering the cases it disrupted between December 2025 and August 2026. I read the whole thing. The easy headline would be “criminals are using AI now,” which is true and also the least interesting part of the document.

What stopped me was something else. A financially motivated group, which Anthropic tracks as GTG-50020, spent four days attacking roughly thirty AI companies, one after another. Its stated goal was not a customer database or financial records. It was access to a Claude model that had not shipped yet. Anthropic says every path failed and that its own systems were never compromised.

There is a second case, smaller and more revealing. A Russian- and Ukrainian-speaking group ran a reseller business offering cheap Claude access. The access was neither cheap nor Claude. They routed the traffic to a different model and, along the way, installed credential harvesters on their own customers’ machines so they could resell those accounts to other proxy operators.

The rest of the report is full of large numbers. ShinyHunters affiliates analyzing 1.8 million distinct Android APKs, stealing more than 2,100 sets of Azure AD tokens across more than forty organizations, pulling more than 300,000 national identity records. Two undergraduate students in Hunan producing more than a dozen possible zero-day findings in a single month. But it is those two small stories that describe the shift.

Why it matters

For twenty years corporate security was organized around one idea: the attacker wants your data. So we encrypted the database, segmented the network, and audited who queried which table.

That model assumes value sits still. An agent in production does not store value — it exercises value. It holds an API key, an open session, and a set of tools it can invoke. Read files. Write to a database. Call a payments service. Send email. Whoever steals that credential does not walk away with a file. They inherit a capability.

That is a difference in kind, not in degree. A stolen human password gives an attacker what that person could see. A stolen agent credential gives them what that agent could do, at the speed the agent does it, inside an automated flow where nobody is watching each individual action.

This is why model providers became the target: they concentrate the keys. And it is why the fake resellers work so well — the developer shopping for cheaper access installs the tooling with their own hands.

What this means if you run a technology company

Let me be specific, because at Indrox these questions reach us from clients who already have agents running.

One: count your credentials. Not the ones in the secrets manager. The ones in a dot-env file on somebody’s laptop, in a pipeline variable nobody reviews, in a private repository with eleven collaborators. Most companies we talk to cannot answer how many live model keys they have, and that inability is itself the answer.

Two: put a ceiling on the agent, not just on the person. If your agent can call the payments API, the question is not whether the developer has permission. It is how much the agent can move per hour before something stops on its own. Spend limits, rate limits, per-environment allowlists of tools. An agent without a ceiling is an unlimited credit card handed to a process.

Three: log the action, not just the prompt. Plenty of teams record what was asked of the model and not what the model ended up executing. When something goes wrong, the prompt log tells you nothing. The tool-call log does.

Four: rotate. A model key should expire the same way a password does. If rotating your keys takes a week and knocks over three services, that is already the finding.

Five, and least technical: if you buy model access through any channel that is not the provider, you are buying two things and only one of them is on the invoice.

My read

One thing is worth saying plainly about the source. This is an Anthropic report about the misuse of Anthropic. It is not an independent auditor. The figures come from its own telemetry, and the document inevitably has an interest in showing that it detected and disrupted. I mention it because I once published a figure I took from a news outlet without checking it and had to delete the piece. I learned to say where every number comes from.

That said, the signal looks solid to me, because it does not require trusting anyone. It is the geometry of criminal business: attackers go where value is concentrated and supervision is weakest. Model credentials are concentrated and badly supervised, because we handed them out with the urgency of a prototype and never went back to look at them.

The industry spent two years asking whether AI would replace work. Meanwhile, without discussing it, we handed automated processes permissions we would not give a new employee on their first day. Anthropic’s report is not a story about hackers. It is the bill for that distraction, and it still arrived cheap.

Sources: Anthropic’s September threat intelligence report is the primary source for every figure in this article; Unite.AI’s coverage served as a second reading. For policy context, the joint CISA, NSA and FBI advisory of September 8.