On September 10, Anthropic published Detecting and countering misuse of AI: September 2026 — its fourth threat intelligence report, covering operations disrupted between December 2025 and August 2026. At roughly 36,000 words across seven harm categories, it is the most detailed public accounting yet of how frontier models are being weaponized in the wild.

For developers shipping on Claude, MCP, and the open agent ecosystem, three findings stand out.

Attacks run on agent frameworks

The report's cyber operations section makes a point that should reshape how you think about MCP server security: the majority of operations described were enabled by AI via direct execution or orchestration. Attackers are not writing custom tooling from scratch. They are composing existing agent frameworks — the same primitives you use to build legitimate agents — into attack chains that run autonomously.

This is not theoretical. The report documents a hacktivist campaign that used stolen API keys to sustain multi-victim operations across months. The operator built agentic workflows that handled reconnaissance, exploitation, and data exfiltration with minimal human oversight. The framework did the coordination; the human provided intent and credentials.

If you are exposing MCP servers to the internet — or building agents that accept untrusted tool calls — you are deploying the same attack surface the report describes.

API keys are the primary loot

Across multiple case studies, the initial compromise vector was not a model vulnerability or a prompt injection. It was a leaked API key.

One financially motivated actor used keys scraped from public repositories to run cryptomining and proxy services at Anthropic's expense. A state-aligned espionage operator used compromised credentials to run reconnaissance against Ukrainian and European government targets. In both cases, the model was not the target — the API key was the key.

The report notes that Anthropic detected and disrupted activity spanning more than 20 organizations in the state actor's planning and live operations. The scale is possible because once you have a valid key, the agent framework handles the rest: tool orchestration, context management, parallel execution.

This reinforces what the FakeGit campaign demonstrated: attackers publish convincing MCP servers and agent skills, wait for developers to add them, then harvest the credentials those agents use. The supply chain and the credential chain are the same problem.

Distillation at scale: 151 million exchanges

The report's illicit distillation chapter documents a single operation that extracted 151 million prompt–completion pairs from Claude models. The actor used a distributed network of accounts, automated request patterns, and careful rate-limit evasion to build a training dataset rivaling public corpora.

This matters for two reasons. First, it confirms that model distillation is an industrial-scale operation, not a hobbyist curiosity. Second, the defenses that worked — anomaly detection on request patterns, behavioral clustering of accounts, the safeguards on Fable and Mythos models — are the same defenses you need on any production agent deployment.

Notably, the report states that no malicious activity was found on Claude Fable or Mythos, which have "a series of safeguards in place that greatly reduce their ability to perform harmful cyber tasks." The models with fewer guardrails (Haiku, Sonnet, Opus) bore the brunt of misuse.

What this means for your stack

The report does not mention MCP by name. It doesn't need to. The attack patterns it describes — agentic orchestration, credential theft, supply-chain poisoning, distillation via API abuse — map directly to the risks in the MCP ecosystem.

  • Rotate keys aggressively. Treat every API key as a time-limited credential. Automate rotation. Audit what keys exist in your CI, your team's machines, your deployed agents.
  • Scope keys to the minimum viable permission. An agent that only needs filesystem access should not hold a key with web search or code execution privileges.
  • Monitor for anomalous agent behavior. Sudden spikes in tool calls, novel tool combinations, or requests from new IP ranges should trigger alerts — not just billing warnings.
  • Verify MCP servers before adding them. The FakeGit campaign proved attackers publish functional-but-malicious servers. Check the repository history, the maintainer's identity, and whether the server has been independently audited.
  • Use the safeguarded models for untrusted workloads. If you are running agents on user-provided prompts or unvetted tool calls, prefer models with stronger built-in guardrails (Fable, Mythos) over raw Opus or Sonnet access.

The uncomfortable takeaway

Anthropic's report is honest about a reality the agent ecosystem has been slow to accept: the same primitives that make agents powerful — autonomous tool use, persistent context, composable skills — make them dangerous when credentials leak.

The report's conclusion is measured: "AI has erased conventional thinking about the resources required for sophisticated operations." A single operator with a stolen key and an agent framework can now sustain campaigns that previously required a team.

For builders, this is not a reason to stop building. It is a reason to treat credential hygiene, supply-chain verification, and runtime monitoring as first-class engineering concerns — not afterthoughts.

If this was useful, you can support my open-source work on Ko-fi or check out my services.