AI Is Making Cybercrime Easier. Here’s What Small Businesses Need to Know.

Your business uses AI to get more done with fewer people. The person trying to break into it can do the same. That is the uncomfortable thread running through Anthropic’s latest threat report: work that once took a team can increasingly be coordinated by one operator.

Published on 10 September, the report covers operations disrupted between December 2025 and August 2026. It includes cyberattacks, fake news networks, surveillance, scams, weapons-related work and attempts to copy AI capabilities without permission.

It is a set of selected investigations from one provider, not a measurement of every attack happening online. But the examples offer a useful warning for smaller businesses: attackers can spend less effort working out how to use the access they steal. Here are the findings that matter, and what to do with them.

The Attacker Has an Assistant Too

Think of a familiar small-business setup: a shared customer system, a handful of cloud subscriptions and an outside developer who connects everything. In an illustrative scenario, that developer accidentally exposes an access token. An attacker finds it and asks an AI agent to investigate what it can reach.

The agent can help inspect the environment, write scripts and interpret the results. The attacker still sets the objective, but needs less hands-on knowledge of your particular setup. A mistake that might once have required patient investigation becomes easier to exploit.

Across the cyber cases, AI helped with reconnaissance, code execution and data theft. Some workflows retained campaign information between sessions and delegated work to multiple agents. Humans chose targets and reviewed results while software handled much of the work in between.

For a business without a dedicated security team, the practical question is simple: if someone gets in this morning, who will notice before lunch?

Blocking Yesterday’s File Only Gets You So Far

One espionage operator used AI-assisted workflows to monitor whether security products detected its malware. Agents were designed to modify and rebuild detected tools until they evaded those checks. Anthropic describes this in its GTG-20006 investigation.

Malicious domains and file fingerprints still give your IT provider something concrete to search for. But a file can change. Good monitoring also looks at what happens: unusual commands, unexpected credential access, new ways to retain access and large transfers of data.

Ask your provider whether alerts from your laptops, email and cloud services are actually reviewed together. Buying another tool will not close the gap if nobody owns the response.

Your AI Subscription Can Become Their Fuel

The report describes attackers stealing customers’ AI API keys and using them to support further intrusions. An API key is a credential that lets software use a service through your account. One stolen key supported attacker activity for roughly three weeks.

Anthropic is clear that these keys came from customer environments; its own systems were not compromised in those cases. The risk sits in how businesses store and share access.

A key pasted into a shared document, left in an app or committed to a code repository can expose more than your budget. Someone else may use the account to help attack another organisation. Give each integration only the access it needs, assign an owner and make sure that owner knows how to revoke it.

A Real Video Call Doesn’t Make the Whole Service Real

The dating-app investigation is a useful example of how automated fraud can borrow credibility from real people. Anthropic says an operator mixed AI personas with gig workers, who supplied interactions such as video calls and social-media follows. Users were told the service was human.

The business lesson extends beyond dating apps. One convincing interaction cannot authenticate every part of a relationship. A familiar voice, profile or live conversation should not replace your normal process for approving payments or sharing sensitive information.

Keep a separate verification step for changed bank details and unusual requests. Use contact information you already trust. That small pause is valuable when an attacker can sustain convincing conversations cheaply.

A Thousand Accounts Isn’t a Thousand Customers

Influence operators used AI to build the machinery around their content: fake personas, news sites, editorial instructions and dashboards. One Malaysia-focused operation managed about 1,000 fake accounts and republished material under fabricated bylines.

There is an important limit: Anthropic found no evidence that this campaign broke out into authentic communities. Across its influence investigations, much of the content received little or no genuine engagement. Large production numbers do not prove persuasion.

For business owners, the takeaway is to question apparent consensus. Several posts repeating the same claim may trace back to one operation. Before acting on a supplier allegation or a sudden online controversy, look for original evidence and genuinely independent reporting.

The Bigger Risks Need Careful Reading

The report also describes AI helping to build surveillance systems and organise information about targeted communities. Classification, translation and report writing can look harmless separately while supporting intrusive monitoring when combined. Some cases were still pilots; others involved established workflows.

Its weapons-related cases range from design and simulation to a live field test. The biological section describes potentially dangerous research, while explicitly declining to assert that the scientists intended harm. It does not establish that those researchers created biological weapons.

These distinctions matter. An attempted capability, a working prototype and demonstrated harm are different things. The useful common lesson is to assess what a whole workflow enables, rather than judging each apparently ordinary task in isolation.

Do You Know Where Your Prompts Go?

In its final section, Anthropic alleges that some providers and intermediaries forwarded customer requests or collected conversations for unauthorised model training without users’ knowledge. Some traffic included sensitive business information and credentials. These are Anthropic’s findings and attributions.

For a small business, this turns an abstract AI debate into a supplier question. Who processes the information you submit? Does the service route requests through other companies? What is retained, and can it be used for training?

A familiar model name inside an unfamiliar app does not answer those questions. Before putting client records or internal documents into a service, check the actual provider and its data-handling terms. Our guide to AI tools and your data covers the practical questions to ask.

Five Things to Check This Week

You do not need to rebuild your security around every headline. Start with the access and response gaps that faster attackers can exploit.

• List your AI tools and connections. Include staff-installed agents and the email, storage or customer systems they can reach.
• Review keys and permissions. Remove unused access, protect secrets and replace exposed credentials promptly.
• Give alerts an owner. Agree who reviews suspicious logins, endpoint activity and unusual service usage, including outside office hours.
• Keep payment checks independent. Confirm unusual requests through a known contact route before approving them.
• Practise the first response. Know who can disable an account, revoke a key and preserve evidence. Start with a short incident response plan.

The recurring change in this report is how much work an attacker can sustain with fewer people. Your response can stay practical: know what is connected, limit what it can access and make sure someone is ready to act when the behaviour changes.