AI Made You Worth Attacking. Anthropic Just Showed the Math.

On September 10, Anthropic published a 154-page report on threat actors it caught using its models for malicious activity between December 2025 and August 2026. Most of the coverage will focus on the espionage and the zero-day research. The finding that matters most has nothing to do with new techniques. The attacks documented are the familiar ones: stolen credentials, unpatched edge devices, exposed services, SQL injection, phishing. What changed, in the report’s own words, is that “the economics of the attacks have changed.” Running them got cheap enough that a company too small to be worth an attacker’s week is now worth an attacker’s afternoon.

What did Anthropic actually find?

Read the case studies for headcount and ignore the blast radius, because the blast radius is unremarkable. You have lived through larger breaches than anything in this report.

One French-speaking individual, working alone, targeted 42 organizations and got inside at least 14 of them. Anthropic’s note on the custom doxxing platform that actor built is the line worth remembering: “the entire platform was created by just one person.”

Elsewhere in the report, a single stolen developer token became full administrative control of a cloud environment in roughly three hours. Breaches ran from first access to bulk data theft in two to three hours. One campaign worked through roughly thirty companies in four days by finding a single working attack path and repeating it against each target with small adjustments. In another, AI agents carried out nearly all of a multi-victim campaign while the human handled target selection and reviewed the take.

None of those numbers set records. Every one of those campaigns used to require a team, a budget, and weeks of skilled labor. The headcount is the story here, and it should worry anyone whose defense strategy quietly assumed attackers had better things to do.

The report’s framing is that sophisticated attacks no longer require sophisticated attackers. That deserves a precise reading, because a version of it has been true for well over a decade. Exploit kits, ransomware-as-a-service, and initial access brokers have been putting professional-grade tooling into amateur hands since the early 2010s. What the amateur got was access. They rented capability that somebody else built, and they were limited to whatever that somebody had packaged.

What this report documents is a different thing. These operators built their own. One actor developed and debugged a previously undocumented WordPress exploit in a single working session, including writing the lab harness to test it, then used it against at least four victim sites. Another ran what Anthropic calls an automated exploit foundry: an autonomous workflow doing vulnerability research around the clock against network and security appliances, which produced more than a dozen possible zero-day findings in a single month. A third built monitoring agents that watched whether its own malware had been detected, then rebuilt and redeployed the toolkit until it went invisible again.

That is custom capability, developed on demand, adapted to the specific target. The distinguishing feature between a nation-state crew and a motivated individual, in Anthropic’s words, “is no longer sophistication but intent.” The gap that used to separate them came down to who could afford to build capability from scratch. That was the expensive part, and it just stopped being expensive.

Why does this hit smaller organizations hardest?

Because of one paragraph in the trends section that reads like an actuarial table for your industry.

Anthropic’s analysts describe what AI does to attacker return on investment: it “compresses the cost side,” lowering the skill threshold and the labor required per campaign, “while leaving potential payoffs largely unchanged.” Then the conclusion: “This favorable shift in unit economics makes previously marginal targets viable and encourages higher-volume, lower-touch operations.”

Previously marginal targets. That is a phrase about you.

For twenty years, small and mid-sized organizations have run on an unspoken defense: we are not worth the effort. Too small for a nation-state, too obscure for an organized crew, too weird a stack for anyone to bother learning. The smaller you were, the more that felt true. That defense was never a strategy, and it was real anyway, because attacker labor was expensive and had to be aimed at the biggest payoff available.

That math has been repriced. When reconnaissance, exploitation, tooling, and data processing get delegated to agents running in parallel at machine speed, a $40,000 ransom from a 200-person manufacturer stops being beneath anybody’s notice. Volume works now. And the report closes the obscurity loophole explicitly: with AI, “diverse target environments are made trivial to understand and adjust to; unique and obscure configurations are made clear and exploitable.” Anthropic’s verdict on that old comfort is one line. “Security through obscurity is no longer viable in this new AI-assisted world: everything connected to the internet is a potential target for exploitation.”

Your weird legacy ERP was never protecting you. Now it is documentation an agent reads in an afternoon.

The part about your backups

Here is the finding that stopped us cold, buried on page 35 in a case study about a hacktivist campaign against European political organizations.

The actor established persistence the usual ways: a webshell hidden among font assets, a WordPress plugin harvesting credentials on every page load. Then this:

“Additionally, GTG-50029 poisoned the victim’s backups, presumably to maintain persistence. If the victim moved to restore their previous environment from backups, they would be re-infected.”

That is an operational decision, and it deserves to be read as one. The attacker anticipated the victim’s recovery plan and pre-positioned inside it. The backup stopped being the way out and became the way back in.

This is the failure mode our industry has been slow to say out loud, because it complicates a very comfortable sales pitch. Immutability protects a copy from deletion and encryption. It does nothing about what was already wrong inside the copy when it was written. An immutable backup of a compromised environment is a compromised environment you have promised yourself you cannot delete. Immutable is a copy. Recovery is a company. And the same report shows the two other pieces that make backup poisoning so effective. One actor’s payloads were “designed to freeze the victim machine’s security updates,” so new detection signatures published by security vendors never arrived on the box. Another built an AI workflow that watched whether its own malware had been detected, then rebuilt and redeployed the toolkit automatically until it was invisible again. Anthropic’s summary of what that does to the defender’s position: AI “has inverted the cost back onto defenders,” and capable adversaries can now “close the loop,” bypassing detections faster than defenders can write and ship them.

So consider the sequence. Detection is being outrun by an agent that iterates until it stops being detected. The endpoint’s ability to receive new detections has been frozen. And the recovery point you would fall back to has been seeded in advance. Three moves, all documented, all in one report, all aimed at the assumption that recovery is the safe harbor.

What actually changes for defenders?

Less than the headlines suggest, and more than most budgets reflect.

Defense still matters. Anything that keeps an attacker out for another hour is worth funding, and nobody should read this report and conclude that endpoint security, MDR, and identity controls have stopped earning their keep. We build detection into what we do for exactly that reason.

What changed is the reliability of any single control that depends on recognizing an attack in time. When the adversary can regenerate its tooling faster than a signature can be authored, prevention and detection become probabilistic in a way that budgets have not caught up with. The report makes the point without editorializing: none of these operations required a novel technique. They required cheap labor. Cheap labor is now infinite.

The control that survives that shift is the one that assumes the first two failed. Recovery is the only outcome an organization can still guarantee for itself, and it is the one most companies have never actually tested under the conditions this report describes. Not “our backups completed last night.” Something harder: can we restore critical services when production is assumed to be compromised, encrypted, or gone, and can we prove the thing we restore is clean?

Almost nobody can answer that with evidence. That, more than any AI capability, is the gap the September report exposes.

What we are not claiming

A quick word on category inflation, because this is the moment where every vendor in our space will rebrand as an AI-era cyber resilience platform.

CyberFortress does not replace your security program. We are not your EDR, we are not your identity provider, and buying us does not mean you can stop funding the controls that keep attackers out. Any vendor telling a stretched IT leader that one platform now covers prevention, detection, response, identity, and recovery is selling a label, and buyers have gotten good at spotting the markup on labels.

Here is our specific slice, stated plainly enough to be checked:

• We prepare organizations for the event. Hardening, DR assessments, and rehearsals that put your team through the decisions before the decisions are real.
• We detect the attack signals that show up in the data layer. Mass file deletion, unauthorized access to backup systems, early-stage encryption behavior, failed and degrading backup jobs. The signals an alert-only stack tends to ignore, and the ones that decide whether your worst day lasts minutes or weeks.
• We recover critical systems and prove it in advance. Drilled, timed, documented restores of clean data, executed by people who have run thousands of live recoveries.

That is the contribution. It is narrower than “cyber resilience” and it is checkable, which is the point.

How do you prove recovery works against an attack like this?

You simulate the attack and watch what your organization actually does. Questionnaires, policy reviews, and green backup dashboards all measure something else.

This is what Trinity Tabletop was built for, and the report is a decent argument for running one this quarter. The exercise builds a scenario from your real environment: your industry, your risk score, your protected infrastructure, your compliance obligations, and live alerts from your own monitoring data. Scenarios are grounded in documented real-world incidents, including ransomware, insider threat, cloud account takeover, and supply chain compromise, which is the exact category of attack this report spends 35 pages on. An AI facilitator runs the room live, injects alerts as the situation develops, and calls on the roles that should be answering. Your team leaves with a score out of 100 benchmarked against your industry, a five-axis breakdown, a real-incident comparison showing how your run compared to the actual event, and a prioritized action list with owners and due dates.

Then the harder half, which is the technical proof. Under Trinity, recovery is something you measure:

• Restores get run and timed against your RTO, on your actual data, on a schedule, with the evidence kept on the record. A backup you have never restored is just a guess.
• Recovered data gets scanned before it goes back. On our Asigra deployments, ransomware scanning runs in both directions, on backup and again on restore, so a poisoned recovery point dies in quarantine. Page 35 is the reason that capability exists.
• Recovery gets exercised against a production environment presumed unavailable. Through BRaaS, offsite backups stand up as working production in bare-metal cloud on demand. That is a rehearsal you run on a quiet Tuesday, with the results on paper before anyone needs them.
• All of it rolls into one number. Your Recovery Score is a live grade of how recoverable you are right now, with the gaps ranked by what each one costs you. It is designed to be the number a board can ask about and an executive can defend.

Five questions worth answering before your next board meeting

1. If production is assumed compromised, what is our documented time to restore the three services the business cannot run without, and when did we last put a stopwatch on it?
2. Would we know if someone modified or deleted our backup data? Which alert fires, who receives it, and how fast?
3. Do we scan recovered data for threats before it returns to production, or do we assume the restore is clean because the backup completed?
4. Has anyone outside IT rehearsed their role in a recovery, including legal, finance, and communications?
5. Who has access to our backup infrastructure, and do those credentials share a blast radius with production?

If four of those five get answered with “we think so,” the gap is not technology. It is proof, and proof is the thing this report just made expensive to keep skipping.

Frequently asked questions

Does AI mean ransomware attacks are now unstoppable? No. The techniques documented in the report are conventional: stolen credentials, unpatched systems, exposed services, phishing. Prevention still works against all of them. What AI changed is the volume and speed at which those techniques get applied, which raises the odds that one attempt eventually succeeds against any given organization. Plan for the successful attempt.

Are small and mid-size businesses actually being targeted more? The report describes an economic shift that makes smaller targets worth attacking: lower attacker cost per campaign with payoffs unchanged, which Anthropic says “makes previously marginal targets viable and encourages higher-volume, lower-touch operations.” Combined with the finding that obscure configurations are now trivially readable by AI, the case for assuming you are out of scope has gotten considerably weaker.

Can attackers really corrupt backups? Yes, and it has been documented. In one case study, an actor poisoned a victim’s backups so that restoring the environment would reinfect it. This is why immutability alone is incomplete protection: it prevents deletion and encryption of a copy without validating what is inside the copy. Restore testing and scanning recovered data before it re-enters production are the controls that address it.

What should we do first? Measure your actual recovery time for critical systems under adversarial assumptions, and run one tabletop exercise with the full decision-making team. Both produce evidence you can act on within a quarter, and both are cheaper than discovering the answer during an incident.

---

The attackers automated their side of this. The question for the rest of us is whether recovery is something we can prove, or something we are still hoping about.

Find out where you stand: [ Test Your Fortress ] · [ Talk to a Recovery Specialist ]

Source: Anthropic, "Detecting and countering misuse of AI: September 2026," published September 10, 2026. All quotations and figures cited above are drawn from the report's cyber operations section.