A threat report from inside the model
Anthropic released a threat intelligence report in early September, covering nine months of documented cases of its own model being used inside actual attacks — seven harm areas, dozens of case studies, real breaches at real organizations. It is not a report you would expect to lead with this sentence:
"The attacks themselves are familiar, involving stolen credentials, unpatched edge devices, exposed services, SQL injection, and phishing. None of the operations in this report depended on some entirely novel technique that defenders have never seen. Instead, the economics of the attacks have changed."
The story is the price, not the capability
Most conversations about AI and security right now are conversations about a new capability — models writing malware, agents planning attacks, deepfakes on a Teams call. Anthropic's finding, from inside its own casework, is that the novelty is not where the money is being made. What moved is that a familiar attack now costs little enough to run that it can be pointed at organizations that used to be too small to bother with. One operator now does the work that used to require a team. That is the change — the same attack, at a price it was not affordable at against a company your size before.
The workplace implication, in one sentence
The report writes its own recommendation in a line worth carrying without changing it:
"Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials — because attackers treat them with the same level of seriousness, too."
The API key committed to a code repository. The session token pasted into a helper script. The agent someone wired into an app because it was faster than filing a ticket. The report describes a documented "criminal AI supply chain" whose entire purpose is to collect these at scale — and until a rotation policy applies to them, they are collected.
A discipline you already have, applied where you did not
This makes the workplace fix cheaper than the frontier framing suggests. It does not need a board briefing on model risk or a new capability in the security stack. It needs the rules the security team already runs against database passwords, service accounts and payment tokens — rotation windows, checked-in secret scanning, audit trails, an owner per credential — extended to a class of secret that has been sitting in an experimentation folder while the definition of experimentation quietly widened.
The prompt to move now is not that AI has developed a new capability. It is that a familiar attack has become cheap enough to run against organizations that were previously the wrong size to target.
The two labels have collapsed into one
The line between an experiment and a production system used to be a real one, and organizations set their security posture off it. In 2026 that line runs through an agent someone left running against a live database over a weekend. The organizations that will not be reading about this in their own incident report are the ones whose AI keys already fell inside the same policy fence as everything else the security team owns.
Same fence, same rotation, same audit: Move your AI credentials inside the same fence as your production ones →
Keep reading: Nobody checks what AI hands back · The reviewer that agrees with you
This is the thinking behind a Trusted AI Culture.
Sources: Anthropic, "Countering misuse of AI: September 2026" (3 September 2026). Findings describe misuse of Anthropic's own model, documented December 2025 through August 2026 across seven harm areas. Other providers' equivalent picture is not covered by this report.
Written with AI in the loop: my idea, AI drafted and sharpened, my judgment on the way out. Every word is mine to stand behind. — Darren