Anthropic's September 2026 Threat Report: 154 Pages, 7 Harm Categories, Every Case Disrupted
Anthropic released a 154-page threat intelligence report Thursday cataloguing disrupted misuse of its Claude models across seven harm categories. The company says it detected and blocked each case before it resulted in harm, and that the full set of incidents spans Haiku, Sonnet, and Opus model tiers.
The seven categories are: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation — the last referring to attempts to use Claude outputs to train or improve other models without authorisation.
What the Report Says About Each Area
The biological research section is the most closely watched. Anthropic previously acknowledged that frontier models can lower the barrier to dangerous biological research; this report documents specific cases involving Claude and research with potential dual-use applications. The company describes what it observed, what classifiers flagged it, and how it responded — including investigation protocols and blocks applied.
Cyber operations and influence operations are covered in the most case studies. Both are standard categories for large-model safety disclosures, but Anthropic’s report goes deeper than comparable disclosures from OpenAI and Google DeepMind, which have typically published shorter threat summaries. The 154-page length reflects an intent to give researchers and policymakers enough specificity to evaluate the claims independently.
Conventional weapons development is the newest category relative to prior Anthropic disclosures, and it lands in context: on the same day, Anthropic’s Frontier Red Team published a separate research paper measuring AI capability on military targeting and drone guidance tasks. The threat intel report documents actual disrupted misuse; the research paper documents what current models can do in a controlled setting.
The Distillation Category
Including model distillation as a harm category is an editorial choice that sets this report apart. Other labs have documented distillation-via-API as a terms-of-service violation, but framing it as a harm category in a safety context shifts its classification. Anthropic does not elaborate on what specific distillation attempts were detected in this release, but the categorisation signals it treats unauthorised capability transfer as a safety issue, not just a commercial one.
Coverage and Context
The report covers Haiku, Sonnet, and Opus — the full commercial model stack. It does not name Mythos, Anthropic’s restricted frontier model available only to Glasswing security partners. Whether Mythos is outside the report’s scope because it has a different access model or because no misuse was detected is not specified.
Anthropic has now published four major threat intelligence disclosures since 2025. The pattern: reports are becoming longer, more technically specific, and more willing to name harm categories that earlier versions treated as background context. The September 2026 version is the first to enumerate all seven categories with case-level detail in a single document.