Insights

Anthropic’s Threat Report: Agentic AI security beyond the model

How stolen credentials, prompt injection, and AI supply-chain attacks should reshape enterprise AI governance.

Adnan Masood, PhD, Chief AI architect, UST.

In one compromise documented in Anthropic’s September 2026 threat report, an attacker moved from a stolen developer token to full administrative control of a cloud environment in roughly three hours.

Could your organization identify the affected integration, authorize containment, revoke access, and verify that the attacker was out within that window?

Anthropic presents selected notable cases, not typical misuse or industry-average attack times. They still give enterprise leaders concrete scenarios to test their defenses.

DIVIDER

What the attacks reveal

The report exposes two connected problems: criminals using AI to attack businesses, and criminals attacking the AI infrastructure those businesses deploy.

Among suspected ShinyHunters affiliates, one operator scanned 1.8 million Android application packages for embedded credentials. Another breached a software provider and extracted data belonging to roughly 200 customer organizations. The entry points were familiar; AI helped expand the operations' reach.

Anthropic also describes a China-based group, GTG-10007, running parallel AI workflows for vulnerability research, intrusion, and data collection. Reported outcomes included stolen student records and access to a retailer’s production systems. Previously unknown vulnerabilities were validated in the actors’ laboratory, which should not be confused with successful exploitation of every intended target.

The AI infrastructure itself was another route in. In the GTG-50020 case, malicious instructions caused an AI vendor’s evaluation sandbox to expose production credentials. The attacker reused stolen keys in a campaign targeting roughly 30 AI companies in four days. Anthropic states that its own systems were not compromised in this case.

My reading is that AI lowers the labor and coordination costs of exploiting weak boundaries. That makes securing the surrounding application as important as selecting the model.

DIVIDER

What agentic AI security actually means

An AI agent connects a model to tools so it can take actions, inspect results, and continue working toward a goal. Agentic AI security protects the data, identities, tools, and systems involved in that work while preventing actions outside its authorized purpose.

For example, a customer-service agent may need to retrieve an order, but not change the customer’s bank details. A coding agent may propose a production fix without having permission to deploy it.

The governing question is not simply whether the model produces acceptable answers. It is whether the application can enforce what the agent is allowed to do. I would build that protection around five pillars.

1. Identity and permissions that limit the damage

Give each production agent an accountable owner and permissions tied to its task and the user it serves. Least privilege means granting only the access needed, rather than inheriting a developer’s broad account permissions.

Enforce authorization in the systems executing actions, not through instructions asking the model to behave. OWASP explicitly recommends this separation.

Treat AI credentials as production secrets: inventory them, scan for accidental exposure, limit spending authority, and test revocation. Prefer short-lived credentials where supported. Where static keys remain necessary, keep them behind controlled services rather than in client applications or agent-readable files.

2. Boundaries that survive prompt injection

Prompt injection is malicious content that redirects a model from its intended task. With tool access, that redirection can become credential theft or an unauthorized system change, as the evaluation-sandbox case demonstrates.

Treat retrieved documents, websites, and tool responses as untrusted input. An instruction in a support ticket should never carry the authority of an approved administrator.

Isolate code execution, restrict outbound connections, and keep production secrets out of testing environments. Use narrowly scoped tools instead of unrestricted command execution wherever possible. Prompt filtering is useful, but the application must remain constrained when a filter misses an attack.

3. A traceable AI supply chain

The report says selected requests to Moonshot and DeepSeek were forwarded to Claude, including sensitive company information and active credentials. These are Anthropic’s attributed findings, not evidence that every request followed that route.

A model router directs requests between providers. Enterprises should verify the complete processing path, including fallback providers used during outages or capacity constraints.

Review connectors, software dependencies, retention, and downstream access alongside the model contract. Require approval for material routing changes. A promise not to train on customer data does not, by itself, identify every organization that may process it.

4. Detection and containment built into operations

One reported espionage operation used AI to modify malware when security products detected it. That reinforces the need to examine behavior and identity activity alongside known malicious files.

Connect agent actions to cloud, application, and identity logs. Preserve evidence outside the agent’s administrative control, with appropriate privacy and retention limits.

Test containment from the first usable signal through workload suspension, credential revocation, and removal of additional access. Include delegated agents and queued jobs. The report describes attackers creating new credentials to survive rotation; replacing the original key does not prove access has ended.

5. Evaluation and governance across the lifecycle

Security evaluation should test whether the whole workflow respects its boundaries, not merely whether the model refuses a harmful prompt. Try malicious documents, misleading tool responses, unauthorized data requests, and attempts to bypass approval.

Retest after model, permission, or integration changes. Set limits on retries, runtime, and spending; define safe behavior when tools fail. Require informed human approval for consequential actions.

For leadership, measure tested permission coverage, containment time, failed controls, and unresolved exceptions. Maintain the supporting evidence for audit and compliance. Count successful legitimate work too: security that makes the application unusable will not support adoption.

DIVIDER

Connecting frontier safeguards with enterprise defense

A frontier lab develops models near the leading edge of capability. Anthropic’s approach combines model safeguards, misuse detection, investigations, and updates informed by observed attacks. Its recently announced Enterprise Frontier Safeguards also describe customer-controlled monitoring data and customer-led review, with phased rollout planned for later this fall.

Enterprises still own their integrations, permissions, and operational response.

UST’s Anthropic partnership connects Claude with enterprise engineering and industry delivery. Anthropic identifies UST as a Global Premier Partner and supports its commitment to train 20,000 associates. CyberProof, a UST company, adds AI security, threat detection, response, and continuous exposure management.

The practical value of combining these capabilities is continuity: the team building an agent should work from the same threat scenarios, permission boundaries, and evidence requirements as the team defending it. Partnership does not replace that discipline; it should help deliver it.

Secure agentic AI is demonstrated when useful work gets done, unauthorized actions are blocked, and the organization can explain and contain what happened. That is the standard I would take from Anthropic’s report into the next enterprise AI deployment.