Every attack in Anthropic's threat report ran on the cheaper models

I was reading Anthropic's September 10 threat report, which covers nine months of malicious activity involving Claude.

What stood out to me was the models being used. Every operation in the report ran on Haiku, Sonnet or Opus. Across 145 pages, Fable and Mythos appear once, in a case about model distillation.

If you haven't read the report, here's a quick summary of how Claude was used during those nine months, according to Anthropic:

• A Yemen-based cell used Claude to develop missile guidance software, test-fired a guided rocket, then returned to debug why it had failed.
• Alibaba allegedly conducted more than 151 million exchanges with Claude to help train its Qwen models.
• Moonshot and DeepSeek allegedly routed millions of live user queries through Claude, sometimes exposing sensitive data.
• A China-based actor used Claude to work on an anti-torpedo fire-control system and other weapons-related software.
• A Russia-based operator used Claude Code to build software for an autonomous swarm of FPV kamikaze drones.
• Anthropic identified five biology cases in which Claude could have supported bioweapons-related research, although it says intent was not always clear.
• Claude was also used in state-linked surveillance, including profiling dissidents and harvesting data from thousands of people.
• In several cyber operations, humans were no longer carrying out every step themselves. Anthropic says AI was executing or orchestrating much of the operation, with humans acting more as overseers.

A mediocre attacker still compromised 600 firewalls

A Russian-speaking attacker compromised 600 FortiGate firewalls across 55 countries between January 11 and February 18.

There were no zero-days involved. He looked for exposed management interfaces, then brute-forced weak passwords on accounts without MFA. Amazon rated his technical skill as low to medium.

A researcher at Cyber and Ramen later found his server. The attacker had built an MCP server called ARXON that connected network reconnaissance to DeepSeek and Claude.

The models helped with ordinary work: where credentials might be stored, what to inspect next and how to get closer to Domain Admin. He started with an open-source framework called HexStrike and wrote his own system about eight weeks later.

Amazon then looked at the code itself, and this is probably the most useful part of the case.

The attacker was not very good

The code had basic problems. Comments repeated function names, JSON was parsed using string matching, documentation stubs were empty, and the system broke on edge cases.

It also struggled against hardened environments. When the attacker reached a patched machine, he generally did not find another way through. He moved on to an easier target.

He still compromised more than 600 firewalls.

The person, the code and the attack methods were all fairly ordinary. What changed was how much work one person could push through.

Reconnaissance, credential validation, scripting, reading output and processing data all consume human time. If a model can take over enough of that work, an attacker does not have to become dramatically better. He can simply try more things against more targets.

There are plenty of weak targets available. In that environment, an attacker does not need to solve every hard machine. Finding the easy ones faster can already produce a large result.

The best models were mostly unavailable

The absence of Anthropic's strongest models needs some context.

Mythos was announced on April 7 and was never sold publicly. Twelve Project Glasswing partners received access. Fable 5 shipped on June 9, and three days later a Commerce export control directive took it offline worldwide until July 1.

Over the nine months covered by the report, the public could buy a Mythos-class model for roughly ten weeks, at around twice the price of Opus 4.8. So it would be wrong to conclude that attackers preferred cheaper models because the strongest ones were unnecessary.

For much of the period, attackers simply could not easily get them.

There is another complication. Fable routes some cybersecurity, biology and distillation prompts to Opus 4.8, in under 5% of sessions. A cyber prompt sent to Fable can therefore be answered by Opus.

I could not find anything in the report explaining how Anthropic attributes those requests. I would treat that as an open question rather than evidence in either direction.

What I found more useful was looking at what people still managed to do with the models that were widely available.

The cheaper models still did the damage

One case, GTG-10007, involved two undergraduates in Hunan and some colleagues. They connected an agent to appliance firmware through a decompiler and had it work through thousands of decompilation calls.

The system followed cross-reference chains, kept adding information to its own knowledge base, formed vulnerability hypotheses, wrote exploit code and tested it against lab copies. One workflow produced more than a dozen possible zero-days against network appliances in a month.

Another case, GTG-50029, involved one person tracking 42 targets. He got inside 14 of them and built a doxxing search engine with ingestion pipelines, breach-dump cross-referencing, national ID normalization, tests and a containerized deployment.

He loaded it with tens of millions of rows and published it over Tor so people in a political movement could be searched by name. The system was involved even though the person operating it was working alone.

The ShinyHunters cases were more familiar. One affiliate started with a stolen developer token and reached full cloud administrator access in three hours. Another pulled 2,100 Azure AD token sets across 40 corporate tenants in 34 hours.

Most of the underlying attack methods have existed for years: stolen credentials, exposed services, weak passwords, unpatched devices, SQL injection and phishing.

The models were useful around those methods, where a lot of time normally goes into reconnaissance, scripting, checking credentials, reading output and processing data.

That kind of work does not require the best model in the world. It requires something that is good enough, cheap enough and available enough to be called over and over again.

The workflow mattered more than the model

A lot of discussion around AI and cybersecurity focuses on whether a frontier model can discover a new class of vulnerability.

That capability is real. Anthropic says Mythos found vulnerabilities in every major operating system and browser, and Project Glasswing partners have patched more than 10,000 high or critical bugs using it.

I can see the case for restricting access to a system that can discover vulnerabilities at that scale. What I am less sure about is how much those restrictions help with the attacks described in the rest of the report.

GTG-10007 used Sonnet and Opus with a decompiler and a memory file. Several groups used PentAGI, which is available on GitHub. ARXON could talk to two model providers, while another attacker built his own Tor gateway for routing requests to third-party models.

The surrounding software is doing a lot of the work here. It handles tools, memory, retries, reconnaissance and routing, while the model sits inside that system as one component.

Once someone has built that workflow, changing the model is usually much easier than rebuilding the whole system. A weaker model may reduce performance, but the rest of the machinery still works.

This is also why open-source agent frameworks matter more than they may look at first. Connecting models to scanners, decompilers, terminals, databases and memory can turn an ordinary model into something more useful over long tasks.

Blocking one model only goes so far

On June 12, the US government treated one model endpoint as serious enough to shut it off worldwide following a claimed jailbreak. Anthropic's statement that day said the demonstration had found "a small number of previously known, minor vulnerabilities."

During the same period covered by its threat report, a low-to-medium-skilled operator compromised more than 600 firewalls using commodity models and brittle code.

These are different kinds of risk, so I do not think one cancels out the other. They do, however, suggest different policy problems.

Restricting access to a model that is unusually good at autonomous vulnerability discovery can reduce access to that specific capability.

It is harder to apply the same logic to someone using widely available models for reconnaissance, scripting, credential work and data processing. There are more models, more providers and more open-source tools that can be combined in different ways.

The practical change may therefore be less about making an attacker dramatically smarter and more about making mediocre attackers much more productive.

Anthropic reaches a similar conclusion in the report: the attacks themselves are mostly familiar. What has changed is their economics. Work that previously required teams of skilled operators can increasingly be delegated to models running inside automated systems.

Across all seven categories of malicious activity, the only appearance of a Mythos-class model was a distillation case.

The person using it was trying to copy the model. Meanwhile, most of the actual attacks in the report were already being carried out with the cheaper models that everyone else could access.