Anthropic published case studies on threat actors it disrupted between December 2025 and August 2026. The cases span seven harm areas, including cyber attacks, surveillance, influence operations and biological misuse. Anthropic says it blocked each operation, tightened safeguards and shared intelligence with authorities. One group, linked to Russian state espionage, automated phishing, malware rebuilding and data theft. That group targeted Ukrainian government bodies, embassies, think tanks and drone makers. It also compromised hotel WiFi vendors to reach travellers. Criminal affiliates of the ShinyHunters collective used Claude to speed up mass credential theft and extortion. Anthropic argues sophisticated attacks no longer require sophisticated attackers. The misuse involved Claude Haiku, Sonnet and Opus, not the Fable or Mythos models. Indicators of compromise are listed for defenders.

• 7 harm areas covered
• over 20 organizations targeted by GTG-20006
• 300,000 national identity records stolen
• 1.8 million Android apps scanned for secrets