The walls which once hedged the ambitions of men have been swept away.
— The Wanderer
I spent this morning reading Anthropic’s latest threat intelligence report — the one covering December 2025 through August 2026 — and I keep coming back to one line. Not the part about Russian espionage operators building self-healing malware loops, though that is grim enough. Not the part about a single consultant in Bamako building a population-scale surveillance platform for Mali that monitors twenty-five million SIM cards, though that one made me stop and read it twice. The line that stuck was this: sophistication has stopped being a reliable signal of who is behind an operation.
That is the whole ball game. Read it again. The thing that separated a nation-state intrusion from a criminal smash-and-grab — the tradecraft gap, the tooling gap, the labor gap — AI has collapsed all of it. A French-speaking operator sitting in front of stolen API keys can now run a campaign that, eighteen months ago, would have required a team of skilled operators and weeks of preparation. They did. ShinyHunters affiliates went from a stolen developer token to full administrative control of a cloud environment in roughly three hours. A hacktivist built a purpose-built doxxing platform with tens of millions of rows of data — by themselves. The report documents a Chinese undergraduate running parallel agent swarms that produced more than a dozen possible zero-day findings in a single month.
If you are a defender, this changes how you triage. If you are a CISO, this changes how you budget. If you are building security tooling, this changes what you build. Let me walk through what I think matters most.
The malware that heals itself
GTG-20006 is a Russian espionage actor linked to Midnight Blizzard. They used Claude at every stage of their operations: reconnaissance, phishing, credential harvesting, lateral movement, exfiltration. But the part that should keep you up at night is the self-healing loop. When their deployed malware was flagged by a security product, their AI monitoring agents would notice, autonomously modify the malware to evade the detection, rebuild it, and redeploy it. The agents were designed to keep iterating until the tool was undetected. The human operator mostly just refined the Claude Code skills that drove the workflows.
This inverts the economic model of defense. Traditionally, a defender could slow an attacker by publishing a new detection signature — it forced the adversary to spend time and skill rebuilding. Now, at least for capable adversaries, the rebuild is automated. The cost of evasion has dropped to nearly zero. Static detections alone are no longer a durable defense.
Supply chain, but not the kind you are thinking about
The ShinyHunters case studies read like a masterclass in opportunistic criminal operations, but the detail I want to draw your attention to is the AI supply chain. When these actors breached a target, they stole the target’s AI API keys first. Those keys became three things simultaneously: loot with resale value, free compute for their next attack, and cover — because the activity was attributed to the victim’s account. One hacktivist campaign ran for an entire month on stolen keys. A ShinyHunters affiliate stole keys from one victim and used them to attack other organizations for three weeks.
There is also a Russian and Ukrainian-speaking group (GTG-50021) running fraudulent AI reseller operations. Customers thought they were buying discounted Claude access. Their traffic was actually proxied to a different, cheaper model, while the reseller’s software installed a credential harvester that stole their Anthropic account credentials and sold them onward. The AI supply chain is now a deliberate criminal target. Treat your API keys with the same seriousness you treat production credentials — because attackers do.
The exploit foundry that never sleeps
GTG-10007 is a Chinese-speaking group — likely undergraduate students in Changsha — that ran what amounts to an autonomous zero-day research program. They loaded firmware images into decompilers through tool servers, had an assistant agent survey the binary and walk cross-reference chains, formed vulnerability hypotheses against a curated knowledge base, wrote exploit code, tested it against lab copies of the target product, and iterated until successful. More than a dozen possible zero-days in a single month. Thirteen standing collection agents ran on scheduled jobs, harvesting OSINT aligned with state intelligence priorities, complete with intelligence-report-styled summaries delivered to a distribution portal. They maintained persistent campaign memory across sessions. Target lists, harvested credentials, engagement state, and standing instructions all carried over.
This is not a human using a chatbot to ask “how do I exploit this?” This is an autonomous weapon testing and intelligence collection pipeline with a human in the loop only for targeting decisions and final review. The operator’s primary role was consuming the output and occasionally refining the prompts.
Influence as a service
The influence operations section reads like a catalog of the industrialization of propaganda. A France-based digital ad agency (GTG-54002) ran roughly seventy fabricated news websites with matching social media accounts across multiple countries, shifting their ideological stance based on who was paying. An Istanbul-based company (GTG-84005) sold a “military-grade, AI-driven, real-time political operations ecosystem” and used Claude Code to build custom dashboards for managing a thousand fake accounts micro-targeting Malaysian voters across all 222 constituencies on race, religion, and royalty fault lines. Russian state media outlets used Claude as an editorial desk for Sputnik and RT. A UAE-directed operation ghost-wrote testimony for the UN Human Rights Council.
AI did not just write the posts. It built the doctrine manuals, the persona systems, the target databases, the scoring rubrics, the HR processes for the fake outlets, and the evasion logic. The apparatus and the content, end to end.
Surveillance at population scale by a single person
I want to come back to the Mali case because I think it is underdiscussed. A single consultant in Bamako built a system called Lakana 360 that provides population-scale domestic surveillance. It monitors approximately twenty-five million SIM cards across all three of Mali’s national mobile operators. It does voice identification across SIM cards, flags encryption and VPN users, infers clandestine meetings from proximity data, supports geofenced watchlists, and matches against the national biometric registry. The warrant requirement was removed at the operator’s request — from a document that Claude itself generated. This was built by one person. Not a nation-state intelligence apparatus. Not a defense contractor with a classified budget. One consultant with AI.
Biological dual-use and the limits of classifiers
Five case studies in the biological misuse section, and the pattern that emerges is clear: classifiers work well for known dangerous domains like gain-of-function research on chikungunya virus or mammalian adaptation of H5N1, but an increasing range of dual-use content is valuable to both legitimate researchers and potential bad actors. Orthopoxvirus immune-evasion grant applications. Venom peptide atlases that optimize for both analgesic and paralytic targets. Computationally redesigned toxins where the researcher deliberately obscured the identities of the organisms involved. Anthropic’s own conclusion is that classifiers alone are insufficient and that trusted user programs are necessary for safe deployment of frontier biological capabilities. I think they are right.
Distillation at industrial scale
The distillation section is its own category of problem. Five major Chinese AI labs — Alibaba, DeepSeek, Moonshot, Zhipu, and Xiaomi — ran massive campaigns to extract Claude’s capabilities. Alibaba’s operation peaked at roughly three million exchanges per day from over 3,500 fraudulent accounts, totaling more than 151 million exchanges over three months. DeepSeek relayed user requests to Claude, tagged users of Claude Code, and selectively forwarded those to Opus — exposing PRC tech company strategic AI program specs and Russian defense agency database credentials in the process. Moonshot silently forwarded customer requests to Claude instead of processing them with their own model, saving the exchanges for distillation, and their traffic included PLA-affiliated surveillance data. These are not rogue actors operating from basements. These are major technology companies engaged in industrial-scale intellectual property theft, and they are exposing their own users’ sensitive data to do it.
What this means for you
The same things I wrote about in May still apply, and they apply with more urgency:
Inventory your AI. Not just the sanctioned tenant. The API keys your engineers have embedded in CI pipelines. The MCP server someone stood up against production last weekend. The agent framework running in a container nobody remembers deploying. Stolen API keys funded entire campaigns in this report. Find yours before someone else does.
Treat every key like a production credential. Because that is what it is now. Rotate them. Scope them. Monitor them. An AI API key is loot, compute, and cover all at once. Act accordingly.
Assume your detections are temporary. The self-healing malware loop means that static signatures buy you time, not durability. Invest in behavioral detection, anomaly monitoring, and response automation. The defender’s cost model has changed.
Watch your supply chain. Not just your software dependencies — your AI dependencies. The evaluation sandbox, the proxy, the reseller, the wrapper service running LiteLLM. GTG-50020 compromised an AI vendor’s evaluation sandbox to steal production API keys from multiple providers. The integration layer is part of the attack surface.
Prepare for autonomous operations. Not hypothetical future autonomous operations. Current ones. Agent swarms that decompose work and dispatch sub-agents in parallel. Self-healing toolchains. Persistent campaign memory across sessions. This is in the wild now, and it is being used by actors ranging from state services to lone individuals.
The tools have changed. The job has not — but the speed and scale at which you need to do it has. If you are trying to figure out where to start — inventorying your AI footprint, hardening your key management, or building detections for autonomous operations — that is the work we do at Sassafras AI. The capability gap is gone. The only question left is whether your defenses have caught up.