Last week Anthropic published a threat report. I'm surprised it's not had more publicity, especially in the UK public and defence sectors. There has been some coverage in the security press and plenty of discussion in the AI-safety world, but from the part of the sector that actually runs government and defence systems, where the report has direct implications, I have come across very little.
One line in the report should concern anyone running a security team in government more than the Russia headline does. Most AI strategies now carry a paragraph about adversaries using AI, and this report is a description of what that looks like in practice.
The headline is an espionage actor the report links, consistent with public reporting, to Midnight Blizzard aka APT29 or Cozy Bear. The report says they targeted more than 20 organisations, among them government ministries, defence and intelligence bodies, embassies and think tanks, concentrated in Ukraine and Europe, in a campaign from March to August 2026, with military drone technology suppliers being a recurring target. After stealing the complete software development kit for a drone vision system from a military drone maker, the group spent several days reverse-engineering it: the product architecture, the hardware bill of materials, the supplier dependencies, and the details of an unannounced product.
Two other cases in the report matter just as much if not more, because of how little it took to run them. Chinese-speaking operators, two of them identified as undergraduate students, ran autonomous vulnerability research against security products and network appliances, and one workflow produced what the report counts as more than a dozen possible zero-days in a single month, with a fleet of 13 collection agents running on scheduled jobs alongside it.
A French-speaking hacktivist got inside at least 14 of 42 targeted European political parties, media outlets, think tanks and their SaaS providers, and built a doxxing platform holding tens of millions of rows. The heading the report puts on the trend is blunt:
"Sophisticated attacks no longer require sophisticated attackers."
In the Midnight Blizzard case the group had agents watch whether its malware was being flagged by security products and, when it was, modify and rebuild it until it was no longer detected. Some of its payloads also froze the victim machine's security updates, so new detection signatures never arrived. The report's conclusion is that "AI has inverted the cost back onto defenders" and that a capable adversary can now, with the report's qualifier "at least in theory", "close the loop", bypassing detections faster than a defender can develop and deploy them.
For as long as I have worked in this field, one of the defender's few structural advantages has been that a new detection forced the attacker to stop, rework and retest. The report shows that advantage has been removed. It is specific that the removal applies to static detections: a signature written for a known artefact stops working the moment the artefact is rebuilt.
In 2018 I gave a talk at the US Department of Energy's Cybercon on OODA loops, Boyd's observe, orient, decide, act cycle, taking that concept from fighter pilots to cyber defence and arguing that a defender has to cycle through that loop faster than the attacker cycles through theirs. It was hard then, and AI tooling was not freely available. This report shows that the attacker's loop can now run at machine speed, and that leaves the question of how a defender can outperform an attacker when every turn of the loop passes through a change board.
The phrase "human in the loop" is usually offered as reassurance. The report contains an uncomfortable version of it. Its summary of the cyber operations is that "Humans remained in the loop by setting the targets of attacks and reviewing exfiltration." The humans kept the key decisions to themselves: which targets and what to do with the stolen data, and in the Midnight Blizzard case, each individual targeting choice. But the reconnaissance, exploitation, lateral movement and the evasion were delegated to models that run "at machine speed and in parallel", and one breach went from a single stolen developer token to full administrative control of a cloud environment in roughly three hours! The attacker has designed their loop so the slow part, the human, only sits where judgement is needed.
Now look at the defensive loop in a typical government or defence environment. To be fair, those controls exist for good reasons. Change control, accreditation and configuration baselines are there because an unreviewed change to a security tool can take down a service that matters, and in the environments I have worked in, that risk is real. But those controls were designed when the adversary's tempo was human too. In those environments, getting a new detection rule from the analyst who wrote it to running in production is a process measured in weeks, sometimes longer if it touches a baseline, and every step of it involves a person waiting for another person.
That difference in speed is the gap the report highlights, and the tooling is not the cause of it. The report itself says that none of these operations depended on a technique defenders have never seen; what changed is the economics. Most departments already own detection platforms capable of taking a new rule in minutes. What they don't own is a decision about who is allowed to make that change, at what speed, with what evidence, and who carries the risk when it is wrong. The strategy paragraph says adversaries use AI. The team below it cannot act inside the adversary's loop because nobody has given them the authority to.
Three questions will tell you where an organisation actually stands.
- How long, end to end, from a new detection being written to it running in production?
- Who can authorise that change without convening a change board?
- When the security tooling flags something, does anyone act on it at a speed that would have mattered in the Midnight Blizzard case, where the malware was being rebuilt as fast as it was caught?
If the honest answers are weeks, nobody, and no, the paragraph in the strategy is a statement of awareness rather than a statement of capability.
Two further things are worth taking from the report. The first is that it describes only one vendor's platform, while the same capability exists on every other frontier model and on open-weight models that no lab reports on, so the cases it describes are only what one company could see. The disruption in each case also came from the vendor banning accounts on its own platform, which is a defensive layer no department controls and one that only covers the models whose makers choose to look.
The second is a case in which a financially motivated actor injected instructions into an AI vendor's evaluation sandbox to extract its production API keys, then attacked roughly 30 AI companies in about four days with the same technique. Elsewhere in the report, criminals who found a victim's AI keys during an intrusion switched their own attack workloads onto those keys, so the compute was billed to the victim and the activity attributed to them. The report's advice to organisations is to "treat AI keys and agent integrations with the same level of seriousness as they do production credentials". The AI tooling a department buys to speed up its own defence is now part of the attack surface, and it needs to sit in the same change and detection loop as everything else.
The useful question for anyone leading data, AI or security in government is no longer whether adversaries are using AI. It is how many weeks currently sit between your team knowing something and being allowed to act on it, and who has the authority to reduce that number.
Sources