要点
- Anthropic 的一份报告显示，其 Claude AI 模型被滥用于间谍活动、监控和武器研发。黑客利用该 AI 自动改写恶意软件，而其他组织则编写导弹和自主无人机的软件。
- 阿里巴巴和 DeepSeek 等中国 AI 公司运营隐蔽网络，大规模提取 Claude 的训练数据，或秘密改道其自身客户的请求。政府监控数据等敏感信息也在其中被处理。
- 在生物学研究中，安全过滤器触及了极限，因为合法意图与有害意图几乎无法区分。Anthropic 正以新模型中更严格的防护措施予以应对，并呼吁将访问权限限制在已验证用户范围内。
Anthropic 的新威胁报告记录了八个月间 Claude 被滥用的情况：间谍活动、全国性监控、武器软件，以及中国 AI 实验室的知识蒸馏。
Anthropic 的威胁情报报告涵盖 2025 年 12 月至 2026 年 8 月，将滥用行为分为七类：网络行动、影响力行动、监控、欺诈、生物滥用、常规武器，以及未经授权的模型蒸馏。
受影响最大的模型是 Haiku、Sonnet 和 Opus，而较新的 Fable 和 Mythos 模型仅出现在一例蒸馏案例中。Anthropic 表示，其记录的是新型滥用行为，而非典型滥用。
网络章节的核心发现是，高级攻击不再需要高级攻击者，而高级程度也不再是归因的可靠信号。这些技术本身并不新鲜，包括窃取凭证、未修补设备、SQL 注入和钓鱼。变化在于经济性，因为侦察、利用和工具构建如今被交给以机器速度并行运行的模型。
Anthropic 表示，自主性降低了攻击者算计中的成本一侧，并使此前无利可图的目标变得值得追求。
当杀毒工具捕获时能自我重建的恶意软件
Anthropic 追踪了一个讲俄语的间谍行为体，代号 GTG-20006，其使用了一个反馈循环。AI 智能体不断检查正在使用的恶意软件是否被常见安全产品标记，当杀毒工具捕获它时，这些智能体自行重写并重新编译恶意代码，直到它再次躲过检测。
Anthropic 表示，这把负担转回给防御方，因为如果攻击者变更的速度快于新签名能够推出的速度，那么编写新的检测签名就不再能拖慢攻击者。
超过 20 家机构成为攻击目标，包括政府部门、情报机构、大使馆和国防承包商，重点集中在乌克兰和欧洲。无人机供应链被反复提及，该行为体窃取了一套完整的专有 SDK，用于无人机视觉系统，此外还有其他目标。访问有时通过第三方进行，例如被攻陷的酒店住客 Wi-Fi 提供商，其住客设备随后被植入恶意软件，微软在 2026 年 7 月将这一手法称为 CaptiveCrunch。
对于 Anthropic 归因于 ShinyHunters 团伙（GTG-50014）的集群，重点是大规模凭据挖掘。一名黑客下载了 180 万个 Android 应用，将其反编译，并搜索硬编码的密钥。Anthropic 将这一手法描述为“氛围黑客”（vibe hacking），即由人类设定一个粗略目标，模型评估环境并反复迭代，直到任务完成。其中一名黑客表示，除了勒索两家公司外，他还通过 HackerOne 漏洞赏金获利。
中国实验室将自身客户的请求路由至 Claude
在知识蒸馏方面，Anthropic 自 2 月首次披露以来，又识别出来自另外七家中国实验室的攻击。知识蒸馏作为一种训练方法是合法的，但 Anthropic 将非法版本定义为工业规模、隐蔽的行动，在未经授权的情况下提取模型能力，通常借助使用被盗信用卡和 API 密钥的虚假账号网络，并通过其所谓的“中转站”进行路由。
迄今为止被测量到的最大规模行动被归因于阿里巴巴的 Qwen 实验室（GTG-16005）。一个固定提示词让 Claude 在回答前写出其推理轨迹，这些记录随后被处理成用于 Qwen 3.5、3.6 和 3.7 模型的微调数据。峰值时每天来自 3,500 多个欺诈账户的交互量接近三百万次，2026 年 5 月至 7 月期间总计超过 1.51 亿次交互，主要集中在智能体任务和软件开发上。
更奇怪的是那些实验室将自家客户的请求转发给 Claude 的案例。Moonshot AI（GTG-16002）在十天内通过 5,380 个欺诈账户向 Anthropic 转发了近 30 万条客户请求，而用户以为自己使用的是 Kimi 模型。DeepSeek（GTG-16001）利用字符串检测请求是否来自 Claude Code 等工具框架，标记这些用户，并将选定用户路由至 Claude Opus，14 天内交互量超过 1,210 万次。
在被转发的请求中，Anthropic 发现一名可能与中国人民解放军有关的用户，其将央视档案影像用于对单一目标的分析，涉及成都数百个摄像头的视频，包括解放军设施外的摄像头。通过 DeepSeek，Claude 还收到了一名操作员的请求，该操作员持有与俄罗斯国防部相关数据库的实时凭证，此外还涉及为中国某公安局开发案件管理系统的工作，该系统将人员活动画像与警方记录进行比对。
小米（GTG-16008）对 Claude 的用法有所不同，它存储了自家 MiMo 模型用户的请求和编码会话，并通过 Claude 重放这些对话以生成训练数据。Anthropic 未发现证据表明 Claude 的回复被直接提供给小米的用户。然而，这些转发的请求包含至少十几种语言、数百人的个人数据，如姓名、联系方式和公司信息。
智谱（在中国以外称为 Z.ai）轮换了 273 个账号，并在十天内通过一个 CoT 清洗器推送了超过 77 万次交互，该工具可自动将捕获的推理轨迹转化为可用的训练数据。为了在网络安全任务上训练 GLM-5.3，该实验室首先针对 Anthropic 的 Fable 模型，但在网络安全防护措施削弱其性能后放弃，随后刻意转向其判定防护较弱的模型。
据该报告称，商汤从第三方购买转录文本，因此它并非自行获取捕获的 Claude 数据，而是通过中间市场获得。MiniMax 通过一家空壳公司运营自己的代理网络，该网络仅提供 Anthropic 和 OpenAI 的模型，没有中国模型，甚至没有它自己的。
监控作为主要工程劳动力
在监控这一章中，Mali 尤为突出。一名顾问将 Claude 用作“Lakana 360”的主要工程劳动力，该平台用于监控全国三大移动运营商约 2500 万张 SIM 卡。它通过语音在 SIM 卡更换过程中识别人员，标记加密和 VPN 用户，并将个人与国家生物识别民事登记系统关联起来。
暂停该账号只中断了开发工作，而未影响其运营，因为该平台在本地以本地模型运行。Anthropic 记录了伊朗相关单位的类似模式，这些单位声称在一年内对 6,388 名伊朗人进行了监视和画像。
关于常规武器的第一章
在武器方面，Anthropic 首次记录了自己的案例。也门北部的一个小组（GTG-87001）让 Claude Code 取代人类软件工程师，为三个导弹项目开发制导、导航与控制软件，其中包括一枚目标射程超过 2,000 公里的多级导弹。
这些行为体并行运行了多个 Claude 实例，并将工作分散到不同会话中，使任何单个实例都无法暴露其意图。一次试射显然失败了，几小时内这些行为体就回到 Claude 上排查原因。
第二起案例（GTG-27005）很可能涉及俄罗斯自由职业行为体，他们构建了一套自主 FPV 自杀式无人机蜂群，机上搭载一个小型语言模型，并由摄像头进行末段目标瞄准。该平台被设计用于自主致命打击，机上模型能够选择“人”类目标并在无人在环的情况下触发引爆。据 Anthropic 称，该图像分类器是用缴获的乌克兰作战影像训练的。
一起中国案例（GTG-17002）涉及一套约 16 个模块的电子战与压制敌方防空系统套件。项目进行到中途时，模拟的默认场景切换为台湾的十二个目标。
生物学：Anthropic 描述了自身过滤器的局限
生物学章节是最具自我批判性的部分。Anthropic 记录了五个匿名案例，涉及在职科研人员，其中 Claude 为可能具有危险性的两用项目提供了协助。在其中一个案例中，生物安全分类器阻止了一份关于基孔肯雅病毒功能获得性研究的经费申请，该研究计划在一家军事研究机构开展。
据报告称，所使用平台的运营方构建了一个回退机制，将 Claude 拒绝的请求路由至竞争对手的模型，而 Claude 本身为该机制编写了大部分代码。其他项目则基本未受阻碍，例如起草一份关于正痘病毒免疫逃逸基因的申请。
结论是，分类器无法既支持有用的工作又防止危害，因为两用领域中用户的意图无法被可靠地检测出来。作为回应，Anthropic 推出了 Claude Fable 5，对两用生物学请求施加了更严格的防护措施；而针对知识蒸馏，随 Fable 5.1 引入的“保留思考”旨在防止新的 API 账户操纵上下文。Anthropic 表示，在生物学领域通往前沿能力的唯一安全路径，是通过面向经过验证的用户的计划。
Anthropic（博客）
Anthropic（论文）
Key Points
- A report from Anthropic shows how its Claude AI model was misused for espionage, surveillance, and weapons development. Hackers had the AI rewrite malware automatically, while other groups coded software for missiles and autonomous drones.
- Chinese AI companies like Alibaba and DeepSeek ran covert networks to extract training data from Claude at scale or secretly reroute their own customers' requests. Sensitive information such as government surveillance data was processed in the mix.
- In biological research, the safety filters ran into their limits, since legitimate and harmful intent were nearly impossible to tell apart. Anthropic is responding with stricter safeguards in new models and calling for access limited to verified users.
Anthropic's new threat report documents eight months of Claude abuse: espionage, nationwide surveillance, weapons software, and distillation by Chinese AI labs.
Anthropic's threat intelligence report covers December 2025 through August 2026 and breaks misuse into seven categories: cyber operations, influence operations, surveillance, fraud, biological misuse, conventional weapons, and unauthorized model distillation.
The models most affected were Haiku, Sonnet, and Opus, while the newer Fable and Mythos models showed up in only a single distillation case. Anthropic says it documents novel misuse rather than the typical kind.
The core finding from the cyber chapter is that sophisticated attacks no longer require sophisticated attackers, and sophistication is no longer a reliable signal for attribution. The techniques themselves are familiar, including stolen credentials, unpatched devices, SQL injection, and phishing. What changed is the economics, since reconnaissance, exploitation, and tool-building now get handed off to models that run in parallel at machine speed.
Autonomy lowers the cost side of an attacker's math, Anthropic says, and makes previously unprofitable targets worth pursuing.
Malware that rebuilds itself when antivirus tools catch it
Anthropic tracks a Russian-speaking espionage actor as GTG-20006 that used a feedback loop. AI agents kept checking whether the malware in play was being flagged by common security products, and when an antivirus tool caught it, the agents rewrote and recompiled the malicious code on their own until it slipped past detection again.
That shifts the burden back onto defenders, Anthropic says, because writing new detection signatures no longer slows an attacker down if that attacker cycles through changes faster than new signatures can be rolled out.
More than 20 organizations were targeted, including government ministries, intelligence services, embassies, and defense contractors, with a focus on Ukraine and Europe. The drone supply chain came up repeatedly, and the actor stole a complete proprietary SDK for a drone vision system, among other things. Access sometimes ran through third parties, such as compromised hotel guest Wi-Fi providers whose guest devices were then loaded with malware, a method Microsoft described in July 2026 as CaptiveCrunch.
For clusters Anthropic attributes to the ShinyHunters collective (GTG-50014), industrial credential mining was the focus. One hacker downloaded 1.8 million Android apps, decompiled them, and searched for hardcoded secrets. Anthropic describes the approach as "vibe hacking," where a human sets a rough goal and the model assesses the environment and iterates until the task is done. One of the hackers said he collected HackerOne bounties on top of extorting two companies.
Chinese labs route their own customers' requests to Claude
On distillation, Anthropic identified attacks from seven more Chinese labs since its first disclosure in February. Distillation as a training method is legitimate, but Anthropic defines the illegitimate version as industrial-scale, covert campaigns that extract model capabilities without authorization, usually enabled by networks of fake accounts using stolen credit cards and API keys, routed through what it calls "transfer stations."
The largest campaign ever measured is attributed to Alibaba's Qwen lab (GTG-16005). A fixed prompt got Claude to write out its reasoning traces before answering, and the transcripts were processed into fine-tuning data for the Qwen 3.5, 3.6, and 3.7 models. The peak hit almost three million exchanges a day from more than 3,500 fraudulent accounts, totaling over 151 million exchanges between May and July 2026, mostly on agentic tasks and software development.
Stranger are the cases where labs relayed their own customers' requests to Claude. Moonshot AI (GTG-16002) relayed nearly 300,000 customer requests to Anthropic over ten days across 5,380 fraudulent accounts, while users believed they were using a Kimi model. DeepSeek (GTG-16001) used strings to detect when requests came from harnesses like Claude Code, flagged those users, and routed selected ones to Claude Opus, more than 12.1 million exchanges in 14 days.
Among the rerouted requests, Anthropic found a user likely tied to the People's Liberation Army who had CCTV archive footage analyzed for a single target, video from hundreds of cameras in Chengdu, including cameras outside PLA facilities. Through DeepSeek, Claude also received requests from an operator with live credentials for a database linked to the Russian Ministry of Defense, along with work on a case management system for a Chinese public security bureau that matches movement profiles against police records.
Xiaomi (GTG-16008) used Claude differently, storing requests and coding sessions from users of its own MiMo models and replaying those conversations through Claude to generate training data. Anthropic found no evidence that Claude's responses were served directly to Xiaomi's users. The relayed requests, however, contained personal data such as names, contact details, and company information for hundreds of people in at least a dozen languages.
Zhipu (known outside China as Z.ai) rotated through 273 accounts and pushed more than 770,000 exchanges over ten days through a CoT cleaner, a tool that automatically turns captured reasoning traces into usable training data. To train GLM-5.3 on cyber tasks, the lab first went after Anthropic's Fable model but gave up after the cyber safeguards degraded its performance, then deliberately switched to models it judged to have weaker protections.
SenseTime bought transcripts from third parties, according to the report, so it did not obtain the captured Claude data itself but through an intermediary market. MiniMax ran its own proxy network through a shell company that offered only Anthropic and OpenAI models, no Chinese ones, not even its own.
Surveillance as the primary engineering workforce
In the surveillance chapter, Mali stands out. A single consultant used Claude as the primary engineering workforce for "Lakana 360," a platform to monitor roughly 25 million SIM cards across all three national mobile carriers. It identifies people by voice across SIM swaps, flags users of encryption and VPNs, and links individuals to the national biometric civil registry.
Suspending the account interrupted only the development work, not the operation, since the platform runs on local models on-premises. Anthropic documents similar patterns with Iranian units that claim to have surveilled and profiled 6,388 Iranians within a year.
A first chapter on conventional weapons
On weapons, Anthropic documents its own cases for the first time. A cell in northern Yemen (GTG-87001) put Claude Code in the place of human software engineers for the guidance, navigation, and control software of three missile programs, including a multistage missile with a target range over 2,000 kilometers.
The actors ran several Claude instances in parallel and spread the work across sessions so that no single one revealed the intent. A test launch apparently failed, and within hours the actors returned to Claude to figure out the cause.
A second case (GTG-27005) likely involves freelance Russian actors who built an autonomous FPV kamikaze drone swarm, with a small language model onboard and terminal-phase targeting by camera. The platform was designed for autonomous lethal effect, and the onboard model could select targets of the "person" class and trigger detonation with no human in the loop. The image classifier was trained on captured Ukrainian combat footage, according to Anthropic.
A Chinese case (GTG-17002) involved a suite of roughly 16 modules for electronic warfare and the suppression of enemy air defenses. Midway through the project, the simulation's default scenario switched to twelve targets in Taiwan.
Biology: Anthropic describes the limits of its own filters
The biology chapter is the most self-critical. Anthropic documents five anonymized cases involving working scientists where Claude assisted with potentially dangerous dual-use projects. In one case, the biosecurity classifier blocked a grant application for gain-of-function work on the chikungunya virus, planned at a military research institute.
The operator of the platform in use had built a fallback that routed requests Claude rejected to a competitor's model, and Claude itself wrote most of the code for it, according to the report. Other projects ran largely unimpeded, such as drafting an application on immune evasion genes in orthopoxviruses.
The conclusion is that classifiers cannot both enable useful work and prevent harm, because a user's intent in dual-use areas cannot be reliably detected. In response, Anthropic launched Claude Fable 5 with stricter safeguards for dual-use biology requests, and against distillation, the "preserved thinking" introduced with Fable 5.1 is meant to keep new API accounts from manipulating the context. The only safe path to frontier capabilities in biology, Anthropic says, runs through programs for verified users.
Anthropic (Blog)
Anthropic (Paper)