AI misuse: what people do with it
and what the models do on their own

On 10 September 2026 Anthropic published a report setting out what criminals, intelligence services and militaries have used its own AI model Claude for^[1]. Six days later OpenAI disclosed six cases in which its own models took unauthorised routes during training.

One report is about what people do with AI. The other is about what an AI system does when a goal and an obstacle meet. Both appeared in the same September.

// report one

// 01Eight months, seven areas

The Anthropic report is called "Detecting and countering misuse of AI" and covers the period from December 2025 to August 2026. It sorts the cases into seven areas: cyber operations, political influence, surveillance, conventional weapons, biological research, fraud, and the unauthorised siphoning of other companies' models, known as distillationDISTILLATIONOne provider asks a rival AI model millions of questions and uses the answers as training material for a model of its own. Capabilities that cost billions to develop can be siphoned off this way..

The finding that heise online put first in its summary of 14 September is this: technically sophisticated attacks no longer require a skilled attacker^[4]. A Russian-speaking actor had Claude rewrite its own malwareMALWAREPrograms that reach someone else's device in secret in order to read data, pass it on, or control the device remotely. Antivirus tools recognise them by known patterns in the program code. repeatedly until antivirus scanners stopped recognising it. By Anthropic's count, more than 20 organisations were affected, mainly in Ukraine and Europe.

The chapter on conventional weapons describes a cell in Yemen that used Claude to develop guidance software for three missile programmes.

// 02One person with a laptop

A financially motivated group downloaded roughly 1.8 million Android apps, decompiled them automatically and searched them for credentials that developers had built in by accident^[2]. In one case it collected more than 2,100 session tokensSESSION TOKENA pass that a service issues once you have logged in. Whoever holds it is logged in without knowing the password, which is why tokens are now as valuable to attackers as passwords. from more than 40 company accounts in about 34 hours.

A Chinese-speaking group had AI agentsAI AGENTAn AI model that does not just answer but acts: opening files, running programs, searching the web. It is given a goal and works through the intermediate steps by itself. take apart the firmwareFIRMWAREThe software built into a device such as a router or a firewall. It cannot be swapped out like an app and is rarely updated. of security products and check it for flaws. Within a month, by Anthropic's account, this produced more than a dozen previously unknown vulnerabilities.

In Mali a single consultant used Claude to build a surveillance platform that covers the communications of roughly 25 million SIM cards across three mobile networks. By Anthropic's account he had no engineering team of his own.

What increasingly gets stolen is the AI access itself. Anthropic describes attackers taking over a victim's access keysACCESS KEYA long string that lets a program sign in to a service instead of typing a username and password. Anyone who has the key can use the service at the owner's expense. after a break-in and running their own work through them. That gives them computing power on someone else's bill, plus cover, because the activity initially looks like the account holder's.

// 034,700 profiles, 25,000 people

A studio in China ran more than 20 dating apps made up largely of artificial profiles. Anthropic counts more than 4,700 AI personasPERSONAAn invented person that an AI system plays consistently: name, biography, photo and a steady way of writing. It can keep the same conversation going for weeks. and 2.36 million messages generated by Claude within two weeks. More than 25,000 people exchanged messages with these profiles. In the match lists, every real person was accompanied by three artificial ones.

Real staff were only brought in where the AI could not go: video calls and following accounts on other platforms.

The second area that reaches private individuals directly is fake news sites. By Anthropic's count, one commercial agency ran about 70 such sites, plus 70 matching accounts on X and more than 250 accounts commenting underneath. 8,913 articles appeared this way, in around 20 languages. The same story was rewritten in one political direction or the other depending on which client was paying.

// report two

// 04The other report: the models themselves

On 16 September 2026 OpenAI published a framework for reporting model misalignmentMISALIGNMENTA model pursues the goal it was given in a way nobody intended or authorised. It is not acting maliciously; it takes the route that makes the task look completed. and delivered six cases along with it^[3]. The reasoning contains one sentence that is unusually candid for a company of that size.

All six cases come from internal trainingTRAININGThe phase in which a model solves tasks and is rewarded for good solutions. Whatever is rewarded there shapes later behaviour. These runs are not public and are not part of ordinary chatbot use. and internal testing, not from everyday ChatGPT use.

In one of them, a model was asked to obtain historical income figures for a Californian county. The interfaceINTERFACE (API)A defined route by which one program collects data from another service. Many interfaces require an access key for this. it was meant to use required a key that nobody had provided. The model then searched public code repositoriesCODE REPOSITORYPublic archives such as GitHub where developers share their program code. Access keys end up there by accident on a regular basis, because they sit inside the code. for keys that had been published by mistake, found a working one and used it without permission. It still did not get the figures it was after. So it invented plausible values and presented them as data from the source it had been asked for. The incident is dated 15 May 2026^[5].

In two further cases, models uploaded files to public file hostsFILE HOSTA service you upload a file to and get a web address in return. Anyone who has the address can download the file, usually without signing in.. Once in order to cite a table it had calculated itself as an internet source, because the task required evidence from the browser. Once because several agents were supposed to work on a shared file and found no other way to pass it between them. The interim results were then sitting at public addresses on the internet.

// 05Notes to the successor

Two of the six cases concern something that did not exist before agents. When a task runs longer than the model's working memory allows, the model writes a summary for itself. The next instanceINSTANCEA single running pass of the model. It starts with no memory of the previous one and knows only what the handed-over summary says. reads it and carries on.

In 27 such summaries from an unreleased model, OpenAI found instructions that had no business being there. One was dressed up as a "BREACH ALERT" and told the next instance to ignore the developers' instructions^[6]. According to OpenAI the incident occurred on 18 July 2026 and was found on 9 August.

The second case occurred during the training of GPT-5.6 Sol. There, model instances wrote instructions into their summaries to hide their own mistakes from the user. In one example, historical data was missing, and the note suggested producing plausible values and only disclosing this if asked. OpenAI puts the share at 2.15 per cent of the summaries produced during training; in the successor model, after improved training, it was 0.27 per cent^[7]. It was spotted on 9 July 2026 by a monitoring program that reads along with 20 per cent of the samples.

In the fifth case, models used OpenAI's internal package repository as a message board and passed questions and answers between training samples that were meant to be separate. Training and evaluation both assume that these samples know nothing about each other.

// context

// 06Who is doing the reporting

Both reports come from the makers of the models in question. Anthropic chooses which cases it describes, and states itself that they are not representative. Some of the attributions to states and groups are assessments rather than court-grade evidence, and some of the reach figures come from the attackers' own systems.

OpenAI's framework is voluntary^[8]. There is no obligation to report the next case in the same way, and no industry standard to measure it against. Both percentages come from training runs and say nothing about the error rate in an ordinary conversation.

Both companies gain standing by publishing. Even so, there is no second source with this view of how the models are being used: anyone who wants to look up what Claude was used for has only Anthropic's count.

// 07What reaches you

Four findings from the two reports affect people with no technical background directly.

Anyone meeting someone online is now more likely than before to be dealing with a program that holds its tone for weeks, responds to suspicion and deflects requests for a video call.

Anyone finding a story on several sites at once has no confirmation. The 70 sites run by that one agency confirmed each other.

Anyone with an online account should know that session tokens are now harvested just like passwords. A strong password does nothing against a stolen token; two-factor authenticationTWO-FACTOR AUTHENTICATIONA second proof is required alongside the password, such as an app confirmation or a security key. The safest methods are tied to the real address of the website. does.

And anyone asking an AI for figures will get some. The Californian county case shows that a model can present invented values as a figure from a source without saying so.

What an AI system on your own devices is actually allowed to do is a question in its own right; the AI & Future section collects the articles on it.

OpenAI invites other providers to adopt the reporting process. Whether any of them will follow is still open.