On September 10, Anthropic published its most detailed threat intelligence report to date: eight months of operations in which people tried to misuse Claude, how they were found, and how they were stopped. It is 154 pages about attackers. This post is not about the attackers. It is about six findings in the report that describe, in the model vendor's own words, why safety that lives inside a model is not enough once an agent can pay, delete, publish or send.
One honesty note first. The report is about people misusing a model. Ripcord is about a company's own agents making expensive mistakes. The bridge between the two is the mechanism, not the villain, and every point below ends at your own agent, not at a state actor.
The distillation section is the one to read twice. Seven labs ran industrial campaigns to extract Claude's capabilities into their own models, at a peak of nearly 3 million exchanges a day. Anthropic's conclusion is one sentence: the safeguards that stop Claude being misused "do not transfer when our models are distilled." The capability travels. The refusals stay home.
This is the whole argument for a control layer in one line, written by the party with the most to gain from the opposite claim. Your fleet runs several models, some of them distilled open weights, and the safety you get is a property of one deployment, not of the capability. A rule that has to hold across every model your agents will ever run cannot live inside any one of them.
The report says so explicitly, and adds that several of the most serious compromises it describes came from operations where a human directed every step. Autonomy multiplies scale and speed and lowers the attacker's cost; how bad an action is comes from somewhere else.
That somewhere else is what our gate prices: what an action would cost if it turns out to be wrong, and how much of that comes back. It also retires the lazy answer to agent risk, which is "put a human in the loop." A human in the loop approved the worst cases in the report.
In one surveillance-tooling case, Claude refused nine of ten requests that were malicious on their face, and the safeguards performed worse once the actor split the work into small, individually harmless sessions. In another, a refusal was reversed by asking again. A weapons cell split its work across sessions so that no single session showed intent.
Every one of those is a per-prompt classifier meeting an aggregate. It is also exactly the shape of the money-laundering pattern called structuring: five payments of $9,640 instead of one of $48,200. A gate that scores each action alone waves all five through. A gate that adds up the flow over 24 hours catches it at payment two. That window, and the freeze that fires when the same action is re-submitted after a human said no, exist because the report's finding is true of every classifier, including ours.
A dating-app network ran more than 4,700 AI personas against at least 25,000 people in two weeks. The system prompt read as an ordinary companion deployment, and the deception was not visible from inside any single conversation. In a few sampled cases the model's own reasoning noticed the harm, and the output continued in persona anyway.
The lesson is not that the model was careless. It is that a model judging its own action, with only that action in view, is grading its own homework. The harm was a property of the whole operation. Only something standing outside the exchange, counting, could have seen it.
Every stolen API key in the report came from a customer environment, never from Anthropic. Attackers mined app binaries, code repositories, container images and customer-deployed AI agents for credentials, then ran their own workloads on the victim's keys. In one case a prompt-injected evaluation sandbox handed over the production credentials it held. Anthropic's advice to organizations is to treat AI keys and agent integrations with the same seriousness as production credentials, because attackers already do.
Two things follow. An agent that holds credentials will eventually hand them to someone, so the gateway should hold them and the agent should never see them. And the report names the attacker's third gain from a stolen key, after resale and free compute: the activity is attributed to the key's legitimate owner. Without an independent record of what your agent did, you cannot tell its real work from someone driving its key. The ledger is that record.
A consultant built a national interception platform for a state intelligence service. Anthropic banned the account and states plainly that the enforcement did not affect the deployed product, which runs on local models. A weapons cell had already compiled an offline toolkit that no longer needed Claude.
Banning an account stops token generation. It does not stop an agent that is already wired into a payments API. The control has to sit where actions happen, at the tool call, not where text is generated. That is the answer to the most common question we get from investors, which is why the labs will not simply absorb this layer. They cannot reach it.
Three moves, all of them cheap next to the alternative. Hold the credentials at a gateway the agent talks through, so there is nothing on the agent to steal. Score aggregates as well as actions, so fragmentation is a signal instead of an evasion. Keep a record of every action outside the agent and outside the model, so that when a key is misused you can prove which actions were yours.
That is the whole rule. The report is the best evidence we have seen that it has to live outside the model. Source for every claim above: Anthropic, Detecting and countering misuse of AI: September 2026, published September 10, 2026.
The demo workspace runs a week of agent traffic through the live engine, no account needed. The $48,200 wire is sitting in the approvals inbox.
Open the demo →