42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups.

The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files. They built the count from the search engines that index open cloud storage and published it as the Ransomnews Cloud Exposure Index, written by Mantas Sasnauskas.

“No file was opened for this index. Every number below comes from bucket names, file extensions, file counts and last-modified timestamps. That is a deliberate limit. It keeps the research on the right side of the line, and it turns out to be enough to see where the sensitive material concentrates.” Ransomnews states. “We are calling it the Ransomnews Cloud Exposure Index, and we will rerun it quarterly so the numbers can be compared over time.”

The researchers used bucket names, file types, file counts and last-modified dates to collect their data. They did not open any files, allowing them to identify where sensitive information might be stored without accessing the content. They plan to repeat the research every three months to track changes over time.

Amazon S3 accounts for 72% of the exposed buckets, roughly in line with its share of the market. This does not mean S3 has weaker security than other providers. Azure Blob, however, appears 2.5 to 3.6 times more often than expected among buckets named for backups, data exports and payroll records. The researchers also found 321,058 files related to credentials and keys. Of the exposed .env files, 67% were last modified in 2026.

Below is the split by provider, from a snapshot taken on October 7:

A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives. So the index isn’t 484,142 breaches. It’s the pool where breaches hide, and the rest of the report narrows it down to the stores that should never have been listable.

“Azure, by a wide margin relative to its size. Azure Blob holds 14.2% of open buckets, but 37% of the 1,459 buckets with “backup” in the name, 42% of the 399 named for exports, and 51% of the 505 carrying HR or payroll terms.” continues the report. “Buckets named for logs, customers and databases sit at 35% to 36%, all around two and a half times Azure’s baseline.”

The skew only shows up for operational data. Buckets named “dev” sit at Azure’s baseline of 15 percent, and “test” and “staging” fall below it, at 9 and 7 percent. The authors suspect Azure storage accounts more often hold line-of-business data such as backups, exports and HR systems that enterprises run on Microsoft, while S3 and Google Cloud carry more application assets. They call it a hypothesis the counts suggest and don’t prove, and it’s the first thing they want to test next time.

By sector, retail and e-commerce names lead with 5,666 buckets, mostly storefront assets. The more worrying number is that names tied to regulated sectors (finance, healthcare, education, government, legal and HR) appear on 10,891 unique open buckets. Those are the places where a stray file most likely holds personal, health or financial records, and where regulators expect to hear about it.

Healthcare-related names appear in 2,709 buckets containing 47.9 million files. The researchers identified them using terms such as “hospital” (135 buckets), “patient” (135), “clinic” (277) and “dental” (331). HR and payroll is the smallest sector, with 505 buckets, 259 of which are hosted on Azure.

These figures are based on names, not proof of ownership. The search matches parts of words, so “store” can refer to object storage as well as shops. A single bucket can also appear in two sectors.

The exposed buckets also list about 4.7 million database and dump files, 15,130 mailbox archives, and tens of millions of spreadsheets and documents. Credential files are particularly concerning because they can turn a cloud misconfiguration into a real intrusion.

Each of these exists to grant access. A .env file is where developers keep database passwords and API keys. A .tfstate file is Terraform’s record of a whole cloud setup, often with secrets in plain text, and a .kdbx vault is encrypted but now open to anyone who wants to guess passwords offline. Some .pem files are public certificates and some files are test fixtures, so the counts are a ceiling on live secrets and not a measure of them. It’s still a big ceiling.

Database files make up most of the sensitive material by volume:

The exposed buckets contain thousands of virtual disk images, including VMware, Hyper-V and QEMU files. A single disk image can contain an entire server, including credentials.

Some exposures involve active systems. Of 80,495 .env files, 67% were last modified in 2026. Certificates and SQLite databases include both recent and older files. Backups appear older, with 89% of the 752,055 .bak files last modified before 2025. Almost all PuTTY key files date from 2024.

Recent leaks need urgent attention, while long-standing exposures point to poor security management. The problem is ongoing: at least 113.6 million files were added to publicly listable buckets in the seven days before September 9. Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.

Public .env files can expose database passwords that ransomware affiliates and initial access brokers look for. Similar credentials appear in stolen-data logs, but in this case, attackers do not need to infect a device. They only need to search for exposed files.

Cloud providers already offer settings to prevent public access. Organizations should enable S3 Block Public Access, disable anonymous access to Azure Blob storage, and enable public access prevention in Google Cloud. These controls should apply at account or organization level to prevent new storage buckets from becoming public.

Organizations should also scan their storage for sensitive files such as .env, .sql, .bak, .pem, .ppk, .tfstate and .kdbx. Terraform state files and virtual disk images should be treated as secrets, stored privately, encrypted and monitored. Backups should never be publicly accessible, and recovery procedures must be tested.

One exposed bucket may be a mistake, but many often indicate a wider process failure. Organizations need to fix the underlying security controls, not just individual buckets.

The research has some limitations. The team queried search engines on October 25, while the bucket list was current to October 7 and the newest indexed file dated September 9. File-level data may therefore be about a month old. Counts are also capped at one million per query, so researchers split larger categories into date ranges and added the results.

Some limits apply. The team queried the search engines on October 25. The bucket list was current to October 7 and the newest indexed file was dated September 9, so file-level figures lag by about a month. The index caps any single count at one million, so larger types were split into date windows and summed.

A last-modified date shows when a file was written, not when it was exposed, and a listed file isn’t proof that its contents can be read. No bucket is named in the report. Exposures with a known owner in regulated sectors are going through responsible disclosure, with national CERTs copied where the owner is public sector or doesn’t respond.

“Rotate any secret that has ever sat in a public bucket. Closing the bucket does not un-leak the key. Assume anything that was listable was copied.” conlcudes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cloud Buckets)

SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying.

CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most active operations currently running. The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.

“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.” reads the joint advisory, “The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.”

SafePay appeared in mid-2024 as an independent ransomware group that operates without affiliates. This is unusual because many major ransomware groups work like franchises, allowing other criminals to use their tools and services. SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued. The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026.

SafePay’s preferred entry points are exposed credentials, brute force password attacks, and VPN access.

“The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access.” states the advisory. “SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products”

Security teams should watch for unusual login attempts coming from Mullvad VPN IP addresses. SafePay also uses stolen account credentials and automated scripts to exploit known vulnerabilities in internet-facing devices. These include Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue.

Once inside a network, the attackers rely on common tools rather than specialized malware. They use PsExec, WinRM, RDP, and PowerShell to move between systems. A PowerShell script called ShareFinder.ps1 helps them find shared folders and identify valuable data. Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access. To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive.

Encryption uses a ChaCha20 stream cipher combined with RSA for key exchange, with methods customized based on file type and size. Files get the .SafePay extension appended.

“Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software.” states the advisory. “SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. “

Paying the ransom remains the only path to decryption for encrypted files, and even that isn’t guaranteed to work.

The group runs a double-extortion model: steal first, encrypt second, threaten to post the stolen data publicly if the victim doesn’t pay. After encryption, SafePay sends victims to a Tor-based chat portal for negotiations. A representative also makes phone calls to apply pressure. If no payment comes, everything goes on the leak site. The group also deletes Volume Shadow Copies and resets network-attached backup devices to factory settings, which is the operational equivalent of cutting off every exit before the fire starts.

The advisory recommends several basic security measures. Keep internet-facing devices, especially VPNs and firewalls, up to date. Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Enable multi-factor authentication (MFA) for VPNs, webmail, and accounts that access critical systems.

Limit the number of accounts allowed to use administrative tools. SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect. Organizations should also keep backups offline, encrypted, and immutable so attackers cannot access, change, or delete them.

CISA also recommends reviewing all accounts with admin privileges, setting time-limited access where possible, and disabling command-line tools for any account that doesn’t need them.

The advisory includes IOC files in STIX XML and JSON format, full MITRE ATT&CK mapping, and complete file and IP indicators.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

Frontier AI is compressing the attack lifecycle from vulnerability discovery to exploitation, forcing defenders to detect, patch and respond at machine speed.

Cybersecurity has always been a race between attackers and defenders. ENISA’s latest assessment suggests that frontier AI is changing the speed of that race, and the gap between discovering a vulnerability and exploiting it could soon become measured in minutes rather than months.

In its July 2026 paper, ENISA’s view on Cybersecurity in the Frontier AI Era, the EU cybersecurity agency argues that advanced AI is compressing parts of the attack chain, from reconnaissance and vulnerability discovery to exploitation, lateral movement and data theft. The problem isn’t simply that AI can find more bugs. It’s that it can connect individual findings into a working attack.

That distinction is important. Traditional security operations could often rely on the time required for a human attacker to research a target, understand a vulnerability, develop an exploit and deploy it. ENISA says that “grace period” is disappearing as automated systems take over more of the work.

The agency describes a particularly worrying possibility: what it calls “negative time-to-exploit”. In practice, attackers could gain access to usable exploit information before defenders have even received or deployed a fix. ENISA says vulnerability weaponisation may now occur within 15 minutes of disclosure, while research cited in its report puts the median time from initial access to data exfiltration at 72 minutes.

That puts traditional patch management under pressure. A company can receive a vulnerability advisory, send it through a change process, test the update, obtain approval and schedule deployment. An attacker does not have to follow any of those steps.

ENISA calls this an “Authority Gap”: organisations may simply take longer to approve a defensive action than an AI-assisted attacker needs to exploit the weakness. The uncomfortable question is whether some environments will eventually need autonomous or near-autonomous patching because waiting for human approval could become the greater risk.

That doesn’t mean companies should blindly automate every security update. Automated patching can break systems, disrupt critical services or introduce new bugs, and ENISA explicitly identifies verification of AI-generated patches as a new bottleneck. The challenge is therefore not automation versus humans, but deciding which decisions can safely happen at machine speed and which still require human approval.

The scale of vulnerability discovery could create another problem. ENISA reports that one organisation went from roughly 80 CVEs in the first quarter of 2025 to almost 500 in the first quarter of 2026, then saw the volume rise to about 500 reports per day when frontier-AI tools were used.

At that point, finding vulnerabilities is no longer the main bottleneck. Verification and remediation become the problem.

Security teams already know what happens when too many alerts arrive at once. The difference is that AI could produce them at a scale humans cannot review manually. ENISA therefore recommends shifting resources from discovery alone toward faster triage, prioritisation and remediation, using approaches such as EPSS and VEX to focus scarce resources on vulnerabilities that are most likely to matter.

There’s another issue that deserves more attention: low-severity vulnerabilities may become more dangerous when AI can chain them together. ENISA notes that frontier models can reason about application logic, credentials, configurations and API access rather than simply identify isolated coding flaws. That can turn several individually modest weaknesses into a practical attack path.

This changes how defenders should think about risk. A vulnerability that looks harmless in isolation may become useful when combined with a weak credential, an exposed API or a poorly configured service.

The same pressure is already affecting the disclosure process. ENISA says AI-generated vulnerability reports have begun to overwhelm parts of the open-source reporting pipeline, with platforms and maintainers struggling to separate useful findings from repetitive or poorly validated submissions. At the same time, the agency notes that the quality of AI-generated reports has improved, meaning the problem could become both more serious and harder to filter.

There is a similar shift on the defensive side. ENISA recommends integrating AI into the software development lifecycle, using continuous threat modelling and automated testing rather than treating security as a review performed at the end of development. It also argues for AI-assisted incident response that can validate telemetry, prioritise events and contain the blast radius while keeping human oversight in place.

That last condition matters. The answer to machine-speed attacks cannot simply be giving machines unlimited authority to fight back. Defensive AI needs its own controls, permissions and audit trails, especially when it can make changes to production systems.

ENISA also recommends an “assume-breached” approach. Organisations should expect that some attacker will eventually get inside and design segmentation, monitoring and access controls so that one compromised component doesn’t automatically become a route into everything else.

The agency sees this as a structural change rather than another temporary threat trend. It recommends machine-speed defence under the broader concept of “Cybersecurity as Code”, covering areas such as vulnerability management, incident response, security architecture and secure software development.

Europe also has a policy problem to solve. NIS2, the Cyber Resilience Act and the AI Act already provide parts of the framework, but ENISA argues that Europe should develop common benchmarks for testing advanced AI models in cyber ranges, measuring exploitability and simulating chained attacks.

The agency also sees value in European cybersecurity data. Incident reports, malware samples, vulnerability disclosures and threat intelligence could support trusted defensive AI models, provided organisations apply strong safeguards, anonymisation and access controls.

For companies, however, the message is much simpler than the policy language suggests. Review your asset inventory, understand which systems are exposed, identify unsupported components and measure whether your detection and response can keep up with an attack that moves in minutes rather than hours. ENISA explicitly recommends near-real-time security operations, with single-digit-minute targets for mean time to detect and respond.

The defenders who adapt fastest won’t necessarily be those with the most advanced AI model. They’ll be the ones that have already removed the basic obstacles: fragmented logging, excessive privileges, slow approvals, unknown assets and systems nobody wants to patch because nobody is quite sure what will break.

AI is making attacks faster. It doesn’t change the basic rules of cybersecurity.

It just makes the cost of ignoring them arrive much sooner.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Frontier AI)

AI is becoming an operational force for cybercrime, surveillance, propaganda, fraud and weapons development, lowering the cost and scale of attacks.

Artificial intelligence (AI) is becoming more than a tool for people who want to do something malicious. It is increasingly becoming part of the operational machinery itself.

That is the main message emerging from Anthropic ‘s latest Threat Intelligence report, which examines malicious activity identified and disrupted between December 2025 and August 2026. The cases cover cyber operations, influence campaigns, surveillance, fraud, biological research, conventional weapons and attempts to extract the capabilities of frontier AI models.

The actors involved are equally diverse. Anthropic describes suspected state-sponsored groups, financially motivated criminals, commercial surveillance operators and politically motivated individuals. What connects many of these cases is not a new attack technique, but the way AI changes the economics, speed and scale of operations.

AI is becoming an operational layer

The report makes an important distinction from the usual discussion about AI-powered hacking.

The biggest change may not be that AI can discover a new vulnerability or write malware. It is that models can now contribute across almost the entire attack chain, from reconnaissance and tool development to exploitation, credential theft, data processing and exfiltration.

Anthropic observed operations in which AI systems executed commands against victim networks, harvested credentials and exfiltrated information. At the more autonomous end of the spectrum, multi-agent frameworks conducted reconnaissance, exploitation and data theft against several victims in parallel, sometimes for hours or days with limited human intervention.

This has an important consequence for defenders. Sophisticated attacks no longer necessarily require sophisticated attackers.

According to Anthropic, AI is reducing the gap that once separated well-funded state operations from smaller criminal groups. Reconnaissance, exploitation, coding and data analysis that previously required several specialists can increasingly be delegated to AI systems running at machine speed.

The underlying attacks are often familiar. Stolen credentials, exposed services, vulnerable edge devices, phishing and SQL injection still play a central role. What has changed is the cost of putting them together at scale.

Cybercrime becomes a production line

One of the clearest examples involves a financially motivated operation that harvested credentials from software and online services.

The attackers downloaded and analyzed 1.8 million Android application packages, searching for hardcoded secrets, while running a parallel process to collect GitHub-related credentials. The important point is not the number of apps. It is the automated pipeline connecting discovery, credential collection, validation and subsequent intrusion activity.

“One French-speaking operator going by the aliases of (MeowSHA | frkoo | blazespider) ran a distributed credential-harvesting pipeline across a fleet of 10 AWS EC2 workers. This pipeline mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned for hardcoded secrets with Detecting and countering misuse of AI: September 2026 12 TruffleHog.” reads the report. “Verified findings were routed in real time to a Telegram group organized into over 100 source types. A parallel GitHub organization email harvester fed a second stream of stolen GitHub Personal Access Tokens. These two credential pipelines supplied the initial-access credentials for the bulk of the confirmed breaches associated with frkoo.”

The same model appears elsewhere in the report. Attackers used AI to develop malware and phishing tools, analyze compromised environments, process stolen information and maintain access to victims.

In one campaign, stolen tokens could be replayed against Microsoft services to access mailbox contents, including deleted messages. The attackers used techniques designed to make their traffic resemble legitimate Microsoft clients. Anthropic says Claude was used to engineer and test the tooling.

This is what makes the development significant. AI does not need to invent a completely new attack for the threat level to increase. If it can automate enough of the existing process, a small team can attempt operations that previously required a much larger workforce.

Surveillance at machine speed

The report becomes even more striking when it moves beyond cybercrime.

Anthropic identified nation-state actors and commercial surveillance operators using Claude to build systems for monitoring populations, profiling individuals and analyzing social media activity. The cases involve actors linked to China, Iran and West Africa, as well as the commercial surveillance-for-hire market.

“These cases include threat actors from China, Iran, and West Africa, as well as the commercial “surveillance-for-hire” market, and range from operations carried out by a single individual to entire teams.” continues the report. “Anthropic’s Usage Policy prohibits using Claude to conduct non-consensual surveillance and profiling, and to use our services to violate individuals’ civil liberties and human rights. In every case we describe below, the threat actors violated our Usage Policy and attempted to circumvent controls designed to detect such misuse.”

In one case, a consultant working for Malian national security authorities used Claude to engineer a mass-interception platform capable of monitoring communications across the country’s mobile operators and producing dossiers on targets.

In another, Iranian actors used Claude to develop a malicious Firefox extension designed to harvest information about social-media users. Chinese operators used AI to analyze large volumes of social-media content, identify potential targets and generate intelligence reports.

One particularly revealing operation targeted Uyghur communities in Syria. An actor without Arabic-language skills used Claude to draft messages in the appropriate dialect, translate replies in real time, role-play as an expert to evaluate the operation and prepare the resulting information for a suspected human case officer.

This shows another important shift. AI is not merely analyzing surveillance data after it has been collected. It can become part of the system that decides whom to watch, how to approach them and how to turn raw information into intelligence.

Propaganda can also be industrialized

The same automation is appearing in influence operations.

Anthropic describes an operation linked with high confidence to UAE government officials in which AI supported a network of roughly 300 inauthentic social-media accounts. The operation also created a front NGO using the identity of a real organization, produced apparently independent human-rights material and ghost-wrote testimony intended for presentation to the UN Human Rights Council.

The actors also profiled 18 members of the European Parliament and journalists and prepared dossiers on UN Special Rapporteurs who had criticized UAE conduct in Sudan.

The significance is not simply that AI can generate propaganda. Political actors have been producing propaganda for centuries. The difference is that AI can make the process much cheaper and more scalable while allowing operators to generate different narratives, personas and documents for different audiences.

The line between genuine grassroots activity and centrally coordinated influence therefore becomes harder to see.

Fraud gets a human face without the human

The report also provides a remarkably concrete example of AI-powered consumer fraud.

A China-based app studio built more than 20 dating applications and used AI personas to communicate with users while advertising the services as fully human. During a two-week period, Anthropic identified more than 4,700 AI personas that interacted with at least 25,000 people.

“A China-based app studio used Claude to both build a network of over 20 dating apps and power the AI personas used to converse with users–despite advertising their service as fully human.” states Anthropic. “Over a two-week window in April 2026, we discovered more than 4,700 distinct AI personas that engaged in conversations with at least 25,000 unique individuals.”

The operation combined AI and human workers. The bots handled large volumes of conversations, while real people performed activities such as video calls and social-media interactions designed to convince victims that they were dealing with genuine users.

The reported ratio was roughly three AI personas for every real person. Claude generated around 2.36 million messages during the period examined.

This is an important preview of how AI could change online fraud. The attacker no longer needs thousands of people to maintain thousands of conversations. A small human operation can supervise a much larger artificial workforce.

The terrorism risk deserves attention

The report does not identify a confirmed terrorist attack conducted with Claude. It does, however, document activity that illustrates why AI-assisted weapons development deserves attention from counterterrorism and national-security agencies.

Anthropic identified six cases involving weapons development, procurement or intelligence gathering in China, Russia and Yemen. The cases include guided rockets, ballistic-missile simulations, anti-torpedo systems, autonomous drone swarms, electronic-warfare targeting and directed-energy weapons.

“We identified a cell of threat actors based in northern Yemen running three weapons development programs: a guided rocket that used a commodity phone-class flight computer with final-phase homing guidance; a multi-stage ballistic missile with a stated range goal above 2,000 km; and a multi-variant missile (referred to as the “R2000” set) that included a hypersonic glide vehicle variant.” continues the report.

The Yemen case is particularly significant from a terrorism perspective, even though Anthropic does not establish that the actors were a terrorist organization. A weapons-development cell used Claude Code to work on guidance, navigation and control software for a guided rocket. Multiple AI instances were assigned different roles, including coding, research and code review. The group also carried out a real-world test of a guided rocket and returned to the model afterward to analyze the failure.

That distinction matters. AI is not necessarily giving a terrorist group the ability to build an advanced weapons system from nothing. What it can do is reduce the amount of specialized engineering expertise required to modify, integrate and troubleshoot technologies that the group already possesses.

For counterterrorism agencies, this creates a potential new problem: the proliferation of technical capability may no longer depend entirely on recruiting highly specialized engineers.

Weapons development is not limited to missiles

The report provides several other examples.

One China-based actor used Claude to develop documentation and software for an anti-torpedo system, including a technical proposal of more than 200 pages and comparative analysis of US naval systems. The actor repeatedly asked the model to act as a hostile expert and criticize its own work, effectively creating an automated review process.

A Russia-based operation worked on an autonomous FPV drone swarm using Claude Code and simulation infrastructure. Other cases involved electronic warfare, air-defense suppression and intelligence gathering related to directed-energy weapons.

The pattern is consistent: AI can compress research, engineering, documentation and testing cycles.

That does not mean the model independently created these weapons. In several cases, the actors already had expertise, hardware or access to the necessary infrastructure. The AI accelerated the work around them.

Biology is an even harder problem

Biological misuse presents a different challenge because intent is much harder to establish.

Anthropic says today’s models are capable of assisting with increasingly complex scientific research, making it harder to guarantee that they cannot meaningfully support dangerous biological work.

The report describes five cases involving potentially sensitive research. They include gain-of-function work involving chikungunya, planning related to mammalian adaptation of avian influenza, an orthopoxvirus immune-evasion research proposal, optimization of venom peptides and computational redesign of toxins.

Anthropic is careful about what these cases prove. It does not claim that the researchers intended to develop biological weapons, nor that Claude enabled a biological weapon. The cases demonstrate something more subtle: dangerous research can look very similar to legitimate scientific research when viewed one request at a time.

That makes traditional content filtering much harder.

A sophisticated actor does not necessarily have to ask an AI model, “How do I build a biological weapon?” They can divide the work into apparently legitimate scientific tasks and combine the answers elsewhere.

AI is also becoming the target

Perhaps the most strategic part of the report concerns illicit distillation.

Anthropic says several Chinese AI companies attempted to extract capabilities from Claude by creating large numbers of fraudulent accounts, routing enormous numbers of queries through proxy networks and collecting model outputs for training.

Alibaba’s operation reached almost three million exchanges per day from more than 3,500 fraudulent accounts, with more than 151 million exchanges observed between May and July. The activity targeted agentic tasks, software engineering, kernel development and long-horizon reasoning.

Zhipu used hundreds of fraudulent accounts to extract and process reasoning traces. Moonshot, meanwhile, allegedly forwarded customer requests to Claude while presenting Claude’s responses as if they came from its own Kimi models.

The privacy implications are serious as well. Anthropic says some rerouted requests contained sensitive corporate information, live credentials and surveillance data. In one case, DeepSeek allegedly relayed requests containing internal AI-program specifications; another exposed credentials associated with a Russian government database.

This creates a new category of AI supply-chain risk: an organization may think it is using one AI service while its data and workloads are actually being processed by another.

The common thread is scale

The cases in the report look very different, but they point in the same direction.

AI is becoming a force multiplier for cybercriminals, intelligence services, propagandists, fraudsters, surveillance operators and potentially armed groups. It can automate the boring parts of an operation, accelerate the difficult parts and allow a small number of people to coordinate activity at a scale that would previously have required a much larger organization.

This is why the most important finding is not that AI can hack systems or generate malicious code.

The bigger issue is that AI is changing the economics of malicious activity.

A criminal group can process millions of files. A surveillance unit can turn huge volumes of social-media posts into target profiles. A propaganda operation can maintain hundreds of artificial identities. A fraud operation can hold thousands of conversations simultaneously. A weapons program can use AI to accelerate software development and technical analysis.

And in the most advanced cyber cases, AI systems can perform several of these tasks with little human intervention. Anthropic reports that humans still tend to retain the decisions that matter most, such as selecting targets and deciding how to monetize results. But the operational workload between those decisions can increasingly be delegated to machines.

That may be the real security threshold we are crossing.

The question is no longer simply whether AI can be abused. It clearly can.

The more important question is how much of a malicious operation can now be delegated to AI before a human has to step in.

Anthropic’s report suggests that the answer is already: quite a lot.

“Sophisticated and persistent threat actors continuously test our safeguards and try to circumvent the technical measures we use to detect and prevent misuse.” concludes the report. “We’ll continue to evolve our safeguards and coordinate with our partners to improve our ability to detect, disrupt, and prevent future misuse.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Anthropic)