Anthropic’s September 2026 threat intelligence report describes access failures worth checking in an agent deployment. A business giving agents access to live systems needs to define what they can read, what they can change, and who reviews their actions.
The report covers activity disrupted over eight months, between December 2025 and August 2026, across seven harm areas: cyber operations, scams and fraud, surveillance, biological misuse, weapons development, influence operations, and model distillation. It was published on September 10, 2026 under the title “Detecting and countering misuse of AI: September 2026.”
Anthropic said the actors included suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals. One case involved stolen AI API keys taken from customer environments and used for additional compute. Anthropic’s own systems were not compromised in that case.
Map access before the workflow goes live
The stolen-key case puts attention on credentials, repositories, integrations, and exposed tokens in the customer’s environment. An agent can encounter the same access problems as other software: shared logins, over-permissioned accounts, forgotten service tokens, and exported customer data.
Make a permissions table for each proposed workflow. Four columns provide a useful starting point:
- What the agent can read.
- What the agent can write or change.
- What requires human approval.
- What gets logged for review.
Fill the table with actual operations. Email access, for example, needs separate entries for reading, drafting, and sending. A contract draft has a different approval path from a submitted contract. Customer-record access likewise needs to distinguish viewing a record from updating it or issuing a refund.
The table makes these decisions visible to the business manager as well as legal, security, and IT. It also gives the implementation team a set of boundaries to enforce and test.
Match the rule to the job
A support agent may summarize tickets while remaining unable to issue refunds. A finance agent may prepare vendor comparisons without authority to approve payment. A recruiting agent may draft outreach while requiring approval before sending it. The responsible manager needs to know those limits and how to spot an attempt to exceed them.
Anthropic’s report also describes AI reducing the labor and tooling gap between well-resourced operations and individual operators. That observation reinforces the need to protect credentials and constrain access. A permissions table is one control; other risks still require their own security measures.
Review the access already in use
Start with a list of live workflows and their owners. Check which systems each AI tool can touch, where its API keys are stored, and whether its integrations grant more access than the workflow requires. Keep credentials out of places an agent can search unless the workflow specifically requires protected access to them.
For each workflow, identify who reviews the logs and how that person would notice a silent failure. Test the distinction between preparing work and taking an external action, especially sending messages, submitting forms, changing records, or moving money.
Document unresolved access decisions before expanding the workflow. That gives managers a concrete way to supervise agent work and gives security teams something specific to verify.
Research and structure: Mai. Direction and voice: John Lipe.
Sources: Anthropic, “Detecting and countering misuse of AI: September 2026,” published September 10, 2026; TechCrunch, “Anthropic reveals rogue AI agents hate CAPTCHAs, just like you,” published September 10, 2026.