Threat actors are increasingly using AI agents as active participants in cyber operations, not merely as tools for drafting phishing messages or answering technical questions. A new Anthropic threat-intelligence report describes state-sponsored groups, financially motivated criminals and individual hacktivists using Claude to automate reconnaissance, develop exploits and repeatedly modify malicious code to evade detection.

The activity covered incidents disrupted between December 2025 and August 2026. According to Cyber Security News, the report’s central finding is that advanced outcomes no longer require the same depth of human expertise at every stage. Agent frameworks can connect planning, tool use and feedback, allowing a relatively small operator to run workflows that previously demanded several specialists.

From assistant to operational agent

Traditional chatbot misuse often involves isolated requests: write a lure, explain a vulnerability or fix a piece of code. Agentic systems can go further by breaking a goal into steps, executing tools, interpreting results and choosing the next action. That loop makes them useful for repetitive reconnaissance and testing, where speed and persistence are valuable.

Anthropic observed misuse spanning broad attack chains. Operators enlisted models to identify targets, analyze software, develop or refine zero-day exploits and alter malware when defenses detected it. Publicly available offensive frameworks such as PentAGI can provide orchestration around a model, reducing the amount of custom infrastructure an attacker must build.

Lower barriers do not eliminate human direction

AI agents do not make every attacker equally capable. Successful operations still depend on access, judgment, reliable infrastructure and an understanding of the target. Models may produce errors or pursue unproductive paths. However, they can multiply an operator’s output by handling time-consuming subtasks and maintaining several lines of work at once.

That productivity change is strategically important. A lone actor can test more targets, generate more variants and adapt more frequently. A state-backed group can assign human experts to the hardest decisions while agents perform routine analysis. Even imperfect automation can overwhelm defenders if it increases the volume of plausible attempts.

Detection becomes a moving target

Dynamic malware modification complicates defenses based primarily on static signatures. If an agent can respond to a failed execution or antivirus alert by changing implementation details, defenders may see a stream of related but non-identical samples. The underlying objective and behavior can remain stable while hashes, strings and code structure change.

Security programs should therefore emphasize behavioral telemetry and correlation across identity, endpoint, network and cloud systems. An unusual process tree, credential access attempt or outbound connection remains meaningful even when the file responsible is new. Fast containment also matters because automated operators can move from one step to the next with little delay.

How defenders can adapt

• Prioritize internet-facing vulnerabilities and exposed credentials that automated systems can discover at scale.
• Build detections around attacker behavior and sequences, not only known indicators.
• Reduce response latency with tested isolation, credential-revocation and cloud-session controls.
• Apply rate limits and strong monitoring to sensitive developer and AI services.
• Exercise incident plans against campaigns that change tools or payloads during the intrusion.

AI providers also play a role through abuse monitoring, account controls and disruption of malicious activity. The report itself reflects visibility available to a model provider, though attackers can switch services, use stolen accounts or run open models. No single platform’s safeguards can substitute for defensive controls in the environments being targeted.

A shift in tempo more than a new objective

The attacker goals in these cases remain familiar: espionage, financial gain, disruption and unauthorized access. What changes is the tempo and economics of the work. Agents can make reconnaissance cheaper, iteration faster and specialist techniques more accessible, expanding the number of actors able to attempt ambitious campaigns.

Defenders should avoid both dismissing the trend as ordinary automation and treating AI as an unstoppable capability. The practical response is to remove easy attack paths, collect behavioral evidence and rehearse decisions at machine-assisted speed. Organizations that shorten the gap between detection and containment will be better positioned as offensive agents become more persistent and adaptive.