Skip to main contentSkip to footer
Try Claude

Threat Intelligence

The Threat Intelligence team investigates real-world cases of misuse of Claude, and works with the broader Safeguards team to improve our defenses. To improve the safety and security of frontier AI models, we publish regular reports detailing the methods malicious actors use to exploit them.

Detecting and countering misuse of AI: September 2026

Detecting and countering misuse of AI: September 2026

Over the past eight months, our Threat Intelligence team identified and disrupted operations in which threat actors tried to use Claude for malicious activity. In this report, we share case studies from those operations and describe how malicious use of Claude has evolved since our previous threat reports in 2025.

Announcements

What we learned mapping a year’s worth of AI-enabled cyber threats

As AI changes how cyberattacks happen, how well do the security community's frameworks hold up? A new report maps attacks onto MITRE ATT&CK.

Announcements

Detecting and preventing distillation attacks

We have identified industrial-scale campaigns by three AI laboratories—DeepSeek, Moonshot, and MiniMax—to illicitly extract Claude’s capabilities to improve their own models.

Announcements

Disrupting the first reported AI-orchestrated cyber espionage campaign

In September 2025, we detected and disrupted a highly sophisticated cyber espionage campaign. We’re sharing this case publicly to help others strengthen their own defenses.

Announcements

Detecting and countering misuse of AI: August 2025

We’ve developed safeguards to prevent the misuse of our models, but malicious actors are actively attempting to find ways around them. Today, we’re releasing a report that details how.

Announcements

Detecting and countering malicious uses of Claude: March 2025

This report outlines several case studies on how actors have misused our models, as well as the steps we have taken to detect and counter such misuse.