Threat intel

On September 10, Anthropic published its September 2026 threat intelligence report, a 154-page account of misuse of its Claude models that it disrupted between December 2025 and August 2026. Of its seven harm areas, the cyber chapter matters most to security teams: attackers now let multi-agent frameworks run most of an intrusion, and stolen AI API keys have become something criminal groups go after for their own sake.

This affects you if you run workloads in a public cloud, sign in through a cloud identity provider, or have developers holding API keys for any AI provider. The intrusions it describes moved faster than a morning alert queue, so the response is to automate first containment, treat AI keys as production secrets and shorten patch windows for internet-facing systems.

How the attack pipelines work

In the report's cyber cases, attackers built multi-agent frameworks, where several AI agents each handle a stage of the intrusion and pass results to the next: one maps exposed services and accounts, another writes and runs exploit code, another collects tokens and files and sends them out. In the report's words, "humans remained in the loop by setting the targets of attacks and reviewing exfiltration."

Some of these frameworks kept state between runs. One actor saved target lists, harvested credentials and standing instructions across working sessions, so the agents could pick up a campaign where they left off instead of starting over. The tooling is not limited to well-funded groups: the report names PentAGI as an example of publicly available offensive agent frameworks that "reproduce much of the same scaffolding for anyone who downloads them."

The model's own safeguards are only part of the defence. In one case involving an Iran-based actor, the report says Claude refused nine out of ten facially malicious direct requests, but its safeguards held up less consistently when the actor broke the work into pieces and ran them across later, smaller sessions. Defenders should assume capable attackers will get the automation they want from some model, and plan detection around what the automation does on their network.

What attackers did with it

The speed figures are what should change how a security operations centre (SOC) works. In an intrusion at a software provider, attackers extracted more than 2,100 sets of Azure AD (now Microsoft Entra ID) authentication tokens across more than 40 corporate cloud environments in about 34 hours. Those tokens let the holder use cloud services as the signed-in user, without the password or a new multi-factor authentication (MFA) prompt. In another case, a single stolen developer token became full administrative control of a victim's cloud environment in roughly three hours.

Exploit research sped up as well. One actor's workflow, iterating continuously against network appliances, produced more than a dozen possible zero-day findings in a single month. Some may not hold up, but owners of VPN gateways, firewalls and other edge devices should expect more new bugs in them to be found and used.

AI access itself is now loot. The report says compromised API keys, session tokens and devices have "increasingly become the sole objective of multiple criminal groups." Coverage of the report describes three uses for a stolen key: stock to resell, computing billed to the victim, and cover, because traffic from a legitimate customer account draws less attention. In one case an attacker injected instructions into an AI vendor's automated evaluation sandbox, which handed over production API keys for several providers. A follow-on campaign from the same infrastructure attacked roughly thirty AI companies in about four days, and when the attacker obtained a target's keys, it switched its own workloads onto them.

What to do

1. Automate the first containment steps

When a stolen token can become cloud admin within hours, an alert read the next morning is too late. Pick a handful of high-signal events and let software take the first step, then page someone.

Where to find those events:

• Sign-ins. Entra ID sign-in logs and Identity Protection risk detections for impossible or unfamiliar travel. The containment action is the Microsoft Graph revokeSignInSessions call, followed by a forced MFA sign-in.
• App consent. The Entra audit log activity "Consent to application", and the OAuth token events in the Google Workspace audit log. An attacker holding a user's token can grant a malicious app lasting access that survives a password reset.
• Secret reads. AWS CloudTrail GetSecretValue, Azure Key Vault SecretGet in the diagnostic logs, and Google Cloud AccessSecretVersion in Secret Manager audit logs. Alert when one identity reads many secrets in a short window, or reads secrets it has never touched.
• Admin grants. Azure activity log Microsoft.Authorization/roleAssignments/write for Owner or other privileged roles, CloudTrail AttachUserPolicy or AttachRolePolicy with AdministratorAccess, and Google Cloud SetIamPolicy adding roles/owner.

Run each rule in alert-only mode for a week or two first, and exclude known break-glass and automation accounts, so auto-containment does not lock out the people who need to respond.

2. Treat AI API keys as production secrets

The report puts it plainly: "Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials."

• Build an inventory of every AI provider key: who owns it, which application uses it, and where it is stored.
• Move keys out of .env files, notebooks and CI (continuous integration) variables into a secrets manager, and have applications fetch them at runtime.
• Give each application its own key with the narrowest scope the provider allows, and rotate on a schedule and whenever someone with access leaves.
• Set spend limits and usage alerts in each provider's console, so a stolen key running someone else's workload shows up as a spike in cost.
• Check provider usage logs for requests from IP addresses outside your offices, cloud ranges and CI runners.
• Scan repositories, including their history, and CI build logs for leaked keys with a tool such as gitleaks or TruffleHog, and revoke anything found, because deleting the line from the file does not invalidate the key.

Keep production keys away from systems that read untrusted input, such as evaluation sandboxes, agent tool runners and AI gateways: the sandbox case shows injected instructions can make them hand keys over. Buy AI access only from the provider or an authorised partner. Cheap access from a reseller may be running on someone else's stolen key.

To check for abuse already under way, compare each key's usage and billing with what its application normally consumes, and look for use at hours or volumes it never produces.

3. Shorten patch windows and harden against phishing

Automated exploit research means less time between a vulnerability being published and exploit attempts against your edge devices. For internet-facing systems, patch entries in the CISA Known Exploited Vulnerabilities (KEV) catalogue within days instead of waiting for the next monthly cycle, and keep an up-to-date list of every exposed device so nothing is missed.

Expect the same automation to make phishing cheaper to write and send, with better-written lures arriving in larger numbers. Phishing-resistant MFA, such as FIDO2 security keys or passkeys, removes the value of a captured password. If your users never sign in with a device code, block the device code flow with an Entra Conditional Access policy that targets authentication flows.

Our security operations team builds and runs the automated containment described above, and our AI-native systems engineers review how your agents, gateways and evaluation pipelines handle keys and untrusted input. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Anthropic threat intelligence report, September 2026, D3 Security, Daniel Miessler, CellCog, AiCybr, 7AI, DEV Community.