Artificial intelligence is moving into a new and increasingly concerning phase of the global technology race.
Anthropic has reported that malicious actors are no longer using advanced AI models merely as chatbots or assistants for individual tasks. Instead, some groups are using AI to orchestrate and execute large portions of cyber operations, with human operators increasingly acting as supervisors rather than performing every step themselves.
In a new threat-intelligence report released this week, Anthropic said it had disrupted several malicious campaigns involving its Claude AI models during the past eight months. The company described activity linked to Chinese AI companies attempting to extract and replicate Claude’s capabilities, as well as a suspected Russia-linked cyber-espionage operation targeting Ukrainian government, military and diplomatic organizations.
The revelations come at a particularly sensitive moment for the technology industry.
The world’s leading AI companies are competing to build increasingly capable models while governments are simultaneously becoming concerned that the same capabilities could be used for cyberattacks, espionage, fraud, surveillance and other malicious activities.
Anthropic CEO Dario Amodei has now gone further, arguing that AI companies should actually slow the pace at which model capabilities are being advanced so that safety mechanisms can catch up.
AI is no longer being used simply as a chatbot
One of the most important findings in Anthropic’s report is the change in how AI is being used.
Traditional AI-assisted cyberattacks generally involved a human operator asking an AI model for help with a specific task.
For example, a hacker might ask an AI system to explain a piece of code, write a script or help analyze a vulnerability.
The new generation of attacks is different.
According to Anthropic, malicious operators are increasingly creating multi-agent systems in which AI models can divide a complicated operation into multiple tasks and execute them with relatively limited human intervention.
The company said that in the campaigns it investigated, humans were often acting as overseers while AI systems performed significant portions of the operational work.
Anthropic described this as a major shift from the traditional chatbot model.
Instead of asking an AI a question and receiving an answer, attackers can potentially give an AI system a broader objective and allow it to coordinate multiple activities required to achieve that objective.
A Russia-linked operation allegedly used AI throughout the attack
Anthropic said it identified a cyber operation whose techniques were consistent with the Russia-linked threat actor known as Midnight Blizzard.
The campaign allegedly targeted Ukrainian government, military and diplomatic organizations.
According to Anthropic, AI was used across multiple stages of the operation.
The company said the attackers used techniques including phishing, hotel Wi-Fi hijacking and WhatsApp account takeover attempts.
More significantly, Anthropic said AI was involved in developing and adapting the malware itself.
The company alleged that the attackers created a system capable of detecting when malware had been identified by security defenses and then automatically modifying the malicious code in an attempt to evade those defenses.
That is a significant development because it moves beyond AI simply generating malicious code.
The AI system would effectively become part of an iterative attack process.
If a defensive system detected one version of the malware, the attackers could potentially have the AI modify the code and try again.
Such automation could allow attackers to experiment much faster than a traditional human-only operation.
Anthropic also identified campaigns involving Chinese AI companies
The other major finding involved what Anthropic described as attempts by Chinese technology and AI companies to extract capabilities from Claude.
Anthropic said it had identified activity involving seven China-based labs.
Among the companies it named were Alibaba, Moonshot, DeepSeek and Xiaomi.
The companies did not all appear to be involved in the same type of activity, and Anthropic’s allegations concern different campaigns and techniques.
The most significant accusation involved what Anthropic described as an extensive AI model-distillation operation linked to Alibaba.
Anthropic said it observed more than 151 million exchanges that it attributed to Alibaba between May and July 2026.
The activity allegedly involved more than 3,500 accounts that Anthropic characterized as fraudulent, with activity reaching nearly three million exchanges per day at its peak.
What is AI model distillation?
Model distillation is an important concept in the modern AI industry.
Building a large frontier model can require enormous amounts of computing power, data and money.
A smaller AI company may therefore attempt to create a cheaper or smaller model by learning from the outputs produced by a more powerful model.
The smaller model can essentially be trained to reproduce some of the capabilities of the larger system.
There are legitimate uses of distillation.
AI companies can use teacher models to create smaller models that are cheaper to operate while preserving useful capabilities.
The controversy arises when a company allegedly uses another company’s commercial AI service at enormous scale to extract its capabilities without authorization.
Anthropic describes this type of activity as illicit distillation.
The concern is that a company could potentially bypass years of expensive research and development by repeatedly querying a stronger model and using the resulting answers as training material for another system.
The scale of the alleged Alibaba operation is significant
Anthropic’s figures demonstrate why the company considers the activity serious.
More than 151 million exchanges were allegedly attributed to Alibaba during a period of only a few months.
Anthropic said the activity involved thousands of accounts.
The company believes the objective was to extract capabilities from Claude and use those outputs to improve Alibaba’s own Qwen models.
If accurate, such activity would illustrate how the economics of AI development are changing.
The competitive advantage of a frontier model does not necessarily remain confined to the company that created it.
If another organization can systematically query the model at massive scale and use those responses as training data, some of that capability can potentially be transferred into another model.
That creates a new form of competition between AI companies.
The battle is no longer only about who has the largest data center or the most advanced chips.
It can also involve protecting the intelligence contained within the model itself.
Other Chinese companies were accused of different methods
Anthropic also alleged that Moonshot and DeepSeek used Claude in another way.
According to the company’s report, some customer conversations were allegedly routed through Claude and potentially used as training material.
Anthropic said these activities could sometimes involve sensitive information.
The allegation highlights another risk associated with AI systems.
AI models can become extremely valuable sources of training data because their responses may contain information that another model can learn from.
The more sophisticated the model, the more valuable its outputs potentially become.
This creates an unusual situation in which an AI company’s public-facing product can itself become a source of competitive intelligence for another AI developer.
The AI race is becoming an intelligence race
The developments described by Anthropic demonstrate how quickly the competitive landscape is changing.
In the early days of generative AI, the primary competition focused on who could produce the most impressive chatbot.
Companies competed over benchmarks, reasoning ability, image generation, coding and general knowledge.
Today, the competition is increasingly about AI agents.
An agent can potentially use tools, browse information, write and execute code, communicate with other systems and perform multi-step tasks.
That capability can be enormously useful.
But the same features that make agents valuable for businesses can make them attractive to attackers.
A human hacker might need hours or days to perform a complicated sequence of operations.
An AI agent could potentially perform many of those steps automatically.
That is the fundamental security challenge now facing the AI industry.
Humans could increasingly become supervisors
Anthropic’s report repeatedly highlights the growing role of human oversight rather than direct human execution.
This is one of the most important concepts in the report.
Imagine a traditional cyber operation involving ten different steps.
A human attacker might have to perform each step manually.
With an AI-enabled system, the human could potentially define the objective while the AI handles a large portion of the intermediate work.
That doesn’t mean humans disappear from the process.
Instead, their role changes.
They become supervisors.
They determine objectives, monitor progress and intervene when necessary.
This could dramatically increase the scale of operations that a small number of people can conduct.
Why cybersecurity experts are paying attention
Cybersecurity has always been affected by automation.
Attackers already use automated scanners, botnets and scripts.
What changes with advanced AI is the flexibility of that automation.
Traditional automation generally follows predetermined rules.
AI systems can potentially interpret new information and adapt their actions.
That means an AI-driven attack could potentially respond to unexpected obstacles without requiring a human to rewrite the entire operation.
Anthropic’s description of malware that allegedly modifies itself when defenses detect it illustrates this concern.
A defensive system could therefore face an opponent capable of continuously changing its behavior.
This could make traditional detection techniques less effective.
AI could also make cyberattacks cheaper
Another major concern is cost.
Sophisticated cyber operations historically required specialized personnel.
An organization needed people who understood programming, network security, malware development, social engineering and infrastructure.
AI could potentially lower the expertise barrier.
A smaller group could gain access to capabilities that previously required a much larger team.
That doesn’t mean AI automatically turns inexperienced individuals into elite hackers.
Cyber operations remain technically difficult.
But AI can reduce the amount of time humans spend on repetitive work and allow skilled operators to focus on higher-level decisions.
The result could be more attacks being conducted with fewer people.
Anthropic CEO now wants AI development slowed
The threat-intelligence findings have also led to a much broader debate within the AI industry.
Anthropic CEO Dario Amodei published an essay calling for AI companies to slow the pace of capability development.
He stressed that he was not calling for an end to AI research.
Instead, he argued that companies need to create enough time for safety measures and independent evaluation to keep pace with increasingly powerful models.
Amodei proposed a three-part framework.
The first element would involve independent evaluators being embedded within major AI companies.
The second would involve greater cooperation between frontier AI laboratories to establish common safety standards.
The third would involve international cooperation to manage risks associated with increasingly powerful AI systems.
Independent evaluators could gain greater access
One of Amodei’s proposals is particularly notable.
He suggested that independent safety evaluators should have access to the internal processes of leading AI companies.
The objective would be to allow outside experts to assess whether companies are adequately managing risks.
This would represent a significant change from the current system, where AI companies largely control their own safety evaluations.
Independent testing could potentially make it more difficult for dangerous capabilities or security failures to remain hidden.
However, it would also raise questions about intellectual property, corporate confidentiality and national security.
OpenAI’s Sam Altman supports the idea
The debate is not limited to Anthropic.
According to Reuters, OpenAI CEO Sam Altman also expressed support for the concept of independent evaluators with significant access to frontier AI companies.
That is important because Anthropic and OpenAI are among the companies competing most aggressively to develop increasingly capable AI systems.
If competitors begin agreeing that some aspects of AI safety should be coordinated, it could eventually lead to industry-wide standards.
However, cooperation also creates another difficult question.
How much information should competing companies share with one another?
AI development is now a major commercial and geopolitical competition.
Companies are spending enormous amounts on chips, data centers, researchers and training.
A voluntary slowdown could therefore put one company at a disadvantage if another continues developing faster.
The China factor complicates everything
Amodei’s proposal also has a geopolitical dimension.
He argued that any slowdown among democratic countries must take into account the possibility that China could continue advancing rapidly.
The concern is that if U.S. companies significantly slow their development while Chinese companies continue moving quickly, the balance of AI capabilities could change.
This is why AI safety is increasingly connected to national security.
Advanced AI is not simply a consumer technology.
It could influence cybersecurity, intelligence gathering, military planning, scientific research, manufacturing and economic productivity.
The countries that lead in advanced AI could gain significant strategic advantages.
AI and cyberwarfare are becoming increasingly connected
The Anthropic report also demonstrates why governments are treating AI as a national-security technology.
AI systems can assist with defensive cybersecurity.
They can analyze enormous amounts of network data, identify suspicious behavior and help security teams respond to attacks.
But the same systems can potentially be used offensively.
This creates a technology arms race.
Defenders want AI that can detect attacks faster.
Attackers want AI that can automate attacks faster.
The result could be an escalating competition between AI-powered defense and AI-powered offense.
The implications extend beyond Anthropic
The concerns described by Anthropic are not unique to Claude.
Every major frontier model faces similar challenges.
If AI agents become capable of performing increasingly autonomous tasks, attackers will attempt to exploit them.
That means AI companies will need to secure not only their models but also the tools and permissions those models can access.
A highly capable AI system with no external access may be relatively limited.
Give the same model access to email, cloud infrastructure, code repositories, financial systems or computer terminals and the potential consequences become much greater.
This is why modern AI safety increasingly involves controlling what models are allowed to do, not just what they are capable of saying.
The industry is entering a new phase
For years, the central question in AI was:
How intelligent can these models become?
The question is now changing.
The industry increasingly has to ask:
What happens when these models can act on their own?
That distinction is enormous.
A model that produces an answer is one thing.
A model that can plan, use tools, coordinate multiple agents, write code, test that code, adapt to failure and continue working is something fundamentally different.
Anthropic’s latest report suggests that this transition is already affecting real-world cyber operations.
What happens next?
The AI industry is unlikely to stop advancing.
There is too much economic and strategic incentive to continue.
But the latest developments could accelerate calls for stronger safeguards.
Governments may demand more transparency from frontier AI companies.
Companies could introduce stricter controls on agent capabilities.
Independent testing could become more common.
AI providers could also increase monitoring for suspicious usage patterns designed to extract model capabilities at scale.
At the same time, attackers are likely to continue looking for ways around those restrictions.
Final verdict
Anthropic’s latest report is important because it shows that the AI security debate is no longer hypothetical.
Advanced AI is increasingly being used in real-world cyber operations, according to the company.
The reported Russian-linked campaign demonstrates how AI can potentially assist with complex cyber-espionage operations.
The alleged Chinese model-distillation campaigns demonstrate another side of the problem: advanced AI models themselves are becoming strategic assets that competitors may attempt to extract and reproduce.
And Dario Amodei’s call for slowing capability development shows that even the companies building these systems are increasingly concerned about the speed of progress.
The central issue is therefore no longer whether AI will become more capable.
It almost certainly will.
The bigger question is whether security, governance and human oversight can advance quickly enough to keep up.
The next stage of the AI race may consequently be defined by two competing forces: companies trying to build models that can do more, and governments, researchers and AI developers trying to ensure that those capabilities do not become impossible to control.
That makes AI cybersecurity one of the most important technology stories of 2026 — not because of what AI can do in a demonstration, but because increasingly capable systems are now beginning to operate in the real world.