Artificial Intelligence Monitor — 13 September 2026

Lead Signal

Anthropic published its September threat intelligence report this week, the most detailed frontier-lab disclosure of state-backed artificial intelligence weaponization to date. The report documents an Iran-linked operation that used Claude to build naval targeting handbooks tracking United States ship positions, personnel, aircraft identifiers and satellite imagery, alongside missile navigation and drone-swarm design research attributed to other state-linked actors. The report also describes a chikungunya gain-of-function request that Claude blocked, which was then rerouted to and fulfilled by a rival model with weaker safeguards, and documents China-linked actors compiling intelligence on Catholic cardinals, Taiwanese Christian leaders, Tibetan Buddhists, dissidents and activists while automating monitoring reports on Uyghurs, Tibetans, Taiwan political figures and foreign media. In Mali, Claude reportedly served as the core engineering tool for a state surveillance platform called Lakana 360 monitoring approximately twenty five million SIM cards.

The disclosure lands as the Governance Health Composite falls to 0.46 on a deteriorating trajectory, a reading that reflects the combined weight of confirmed state-actor weaponization, a European standards vacuum ahead of a first enforcement deadline, and diverging United States state enforcement actions. The Concentration Index shows capital concentration reinforced this week by projections that the United States will capture forty eight percent of a projected thirty one point six trillion dollar cumulative global AI infrastructure investment through 2050. Frontier labs are increasingly functioning as de facto intelligence agencies with early and granular visibility into state-actor weapons development, a role that current governance frameworks do not formally address in terms of information sharing obligations or liability.

Other Developments

Agentic cyber-attacks reach a new scale. A Russian-speaking threat actor deployed an AI-agent swarm built on OpenAI Codex and a DeepSeek model that compromised four hundred and forty PaperCut instances at three hundred and ninety five organizations across forty eight countries, reaching domain administrator access in as little as twenty six seconds at peak. This is among the first well documented cases of deployed, non-lab-controlled agentic AI achieving mass compromise at this speed and scale, and it has received comparatively thin mainstream attention relative to the Anthropic disclosure despite comparable severity for critical infrastructure operators.

The EU AI Office reaches its first enforcement checkpoint. Providers of general purpose AI models exceeding the ten to the twenty fifth power FLOPs training threshold, roughly a dozen systemic-risk models globally, must submit their first formal systemic risk evaluations to the European AI Office by September 15. This is the first real test of whether the AI Act enforcement architecture, live since August 2, 2026, functions in practice, and it proceeds without a finalized harmonized technical standard against which compliance can be benchmarked.

United States AI accountability fragments at the state level. Alabama Attorney General Steve Marshall, joined by a multistate coalition, opened a subpoena-backed investigation into whether OpenAI violated state consumer protection law following an AI agent security breach. California regulators separately confirmed that the reporting threshold in the state SB 53 safety law did not capture the OpenAI and Hugging Face agent breach incident, and Colorado Attorney General filed proposed Automated Decision Making Technology rules implementing SB 26-189 and HB 26-1263. OpenAI faces a headwind from the Alabama investigation given the added regulatory exposure it creates ahead of any anticipated future public listing, while Microsoft faces a tailwind from OpenAI continued frontier model shipments given the deeper Azure-hosted enterprise access those releases support.

The frontier model wave converges on tiered access, alongside continued capital and personnel movement. OpenAI shipped GPT-6 Astra with tiered cyber-capability guardrails, Anthropic released Claude Fable and Mythos 5.1 with Mythos gated for vetted defenders only, and Google DeepMind released Gemini 3.8 Flash Cyber under Fairwind-gated access, a pattern reported to be driven in part by a Chinese model, GLM-5.3, demonstrating that cyber-exploitation capability now emerges from ordinary post-training scaling. Alongside these releases, SoftBank moved to repay a forty billion dollar bridge loan tied to its OpenAI stake, and Paul Christiano, an alignment researcher with United States AI Safety Institute lineage, joined the OpenAI nonprofit board in the same week that an Anthropic employee in a safety-focused role resigned over concerns reported as being about AI firms gambling with lives.

Cross-Monitor Connections

The findings this cycle extend into several adjacent monitors. The Anthropic report documents Iran-linked propaganda-adjacent and domestic surveillance operations, and China-linked dissident and minority monitoring, that bear directly on the fimi-cognitive-warfare monitor, which tracks AI-enabled influence and surveillance operations. The same report presents evidence of AI-assisted naval targeting handbook construction against United States forces, and of drone and missile weapons research by state-linked actors, directly relevant to the conflict-escalation monitor tracking of autonomous weapons development. The EU AI Office systemic-risk evaluation deadline of September 15, together with the forecast that the United States will capture the plurality of a thirty one point six trillion dollar cumulative AI infrastructure investment figure, underscores compute and chip-supply-chain sovereignty stakes tracked by the european-strategic-autonomy monitor. Finally, the new obligation for systemic-risk providers to disclose energy consumption to the AI Office, together with the identification of power supply rather than chip availability as the decisive factor shaping AI infrastructure investment location, connects directly to the environmental-risks monitor tracking of AI environmental cost.

Outlook

The most consequential open question entering next cycle is whether the AI Office will confirm actual submission of the required systemic-risk evaluations once the September 15 deadline passes; independent confirmation would upgrade the enforcement-checkpoint judgment from High toward Confirmed. Confirmation from the Pentagon or the Department of Defense Office of the General Counsel on the status of the overdue NSPM-11 deliverables, including the Directive 3000.09 update on autonomy in weapon systems, would resolve the current Assessed-confidence finding that the update remains undelivered. Independent investigation of the PaperCut agentic-swarm attack would similarly upgrade that finding from Assessed toward Confirmed or High. Watch also for whether other frontier labs follow the Anthropic transparency posture in disclosing state-actor misuse, and for a state-gazette-verified filing date on the Colorado rulemaking that would move that claim beyond single-tracker sourcing.

Sector & Domain Briefs

Defence — AI Monitor

The most consequential defence-sector development this cycle is the threat intelligence report published by Anthropic in September, documenting an Iran-linked operation that used Claude to build naval targeting handbooks tracking United States ship positions, personnel, aircraft identifiers and satellite imagery. The same disclosure documents drone-swarm design research and missile navigation work attributed to other state-linked actors, marking the most detailed public accounting yet of adversary states operationalising a commercial frontier model for weapons development. The capability-to-deployment gap this cycle is stark: adversary state actors are operationalising frontier commercial models for weapons research and targeting faster than United States military AI governance instruments are being finalised. The four NSPM-11 autonomy deliverables due September 3, including an update to Defense Department Directive 3000.09 governing autonomy in weapon systems, remain unconfirmed as delivered, with the public directives index still carrying the 2023 version. This governance-delivery gap is compounded by reported friction between a senior Defense Department official and Anthropic researchers over AI safety warnings related to military applications, friction that surfaced in the same week Anthropic disclosed the extensive state-actor misuse of its own model. The stealth signal here is notable: the public rejection by a top Pentagon official of an Anthropic researcher warning received far less coverage than the underlying threat report itself, even though the two developments describe the same underlying tension from opposite institutional vantage points.

Export and access restrictions on frontier compute have not prevented adversary states from achieving significant AI-assisted military capability through commercial application programming interface misuse rather than through indigenous model development. This is an important asymmetry: the barrier to adversary weapons-relevant AI use is not compute access or model training capability, but simply commercial account access to a frontier lab product, a barrier that has proven porous despite safeguards. Anthropic states that it disrupted every operation documented in its report and shared findings with authorities and other AI companies where appropriate, indicating the lab is functioning, in effect, as a defensive intelligence function layered on top of its commercial service. That role is not one that any current governance framework formally recognises, and the gap between what frontier labs now know about state-actor weapons development and what governments require them to report is one of the more consequential asymmetries this monitor is tracking.

The broader picture for defence-sector AI penetration this cycle is one of acceleration without matching doctrinal or regulatory response. The same week that adversary states were shown assembling naval targeting handbooks against United States forces using a commercial chatbot interface, the United States own federal military AI governance apparatus missed a public deliverable deadline. Whatever the internal reasons for the delay, the optics of simultaneous adversary capability advance and domestic doctrine delay are unfavourable, and they will likely draw continued congressional and press attention in the coming weeks. The Anthropic disclosure also names Mali as a site of Claude-enabled state surveillance activity, through a platform called Lakana 360 built for a state intelligence service and reportedly monitoring approximately twenty five million SIM cards; while this is more a domestic-surveillance than a battlefield application, it illustrates the same underlying dynamic of frontier model capability outrunning any external oversight mechanism, defence-adjacent or otherwise.

The jurisdiction risk matrix reflects this shift directly: Iran and Russia are both now rated at the highest overall risk level tracked by this monitor, with deteriorating trajectories, specifically because of documented AI-enabled weapons and targeting activity attributed to actors linked to each jurisdiction. This is a notable methodological point for readers of the defence brief: the risk rating is not a statement about the jurisdiction own AI governance framework, which in both cases remains rated low on regulatory readiness and enforcement capacity, but rather a statement about the jurisdiction demonstrated capacity to weaponise foreign commercial AI systems against third-country targets. That distinction matters for policy response, because export controls and model-access restrictions, the traditional levers available to the United States and its allies, are aimed at capability denial rather than at deterring the kind of commercial-account misuse documented in the Anthropic report.

Outlook

The defence sector enters the next cycle with an open and consequential question: will the Department of Defense or its Office of the General Counsel confirm, deny, or explain the status of the overdue NSPM-11 deliverables, including the Directive 3000.09 update. Confirmation either way would resolve the current assessed-confidence finding that the update remains undelivered and would materially change how this monitor rates the autonomous weapons and military AI misuse vector, currently held at the highest rating this cycle. Also worth watching is whether other frontier labs follow the Anthropic disclosure posture and publish comparable threat intelligence reporting on state-actor misuse of their own models; if Anthropic remains the outlier, that asymmetry in transparency will itself become a governance question, since it means the public record of adversary AI-enabled weapons development activity is currently a function of one lab disclosure choices rather than any systematic industry or government reporting requirement.

Critical Infrastructure — AI Monitor

The defining critical infrastructure development this cycle is a deployed, non-lab-controlled agentic artificial intelligence cyberattack of a scale not previously well documented. A Russian-speaking threat actor built an AI-agent swarm on top of OpenAI Codex and a DeepSeek model and used it to compromise four hundred and forty PaperCut instances across three hundred and ninety five organisations in forty eight countries, reaching domain administrator access in as little as twenty six seconds at peak. This is a qualitatively different kind of incident from the lab-sandbox agentic-misuse demonstrations that have dominated industry discussion to date, because the agent swarm here was deployed by a third party against live production infrastructure rather than tested under controlled conditions by a lab red team. The capability-to-deployment gap in this sector is severe: agentic AI infrastructure security has not kept pace with the speed of agent-framework adoption, and the twenty six second figure for reaching domain administrator access is, on its own, a meaningful data point for anyone responsible for incident response timelines in a critical infrastructure environment.

The stealth flag attached to this development is significant in its own right. Despite representing a qualitative escalation beyond earlier lab-sandbox agentic-misuse demonstrations, and despite affecting nearly four hundred organisations across dozens of countries, the PaperCut agentic swarm campaign received comparatively thin mainstream coverage relative to the Anthropic threat intelligence report published in the same week. Both disclosures describe frontier or near-frontier models being used for unauthorised and harmful purposes, yet only one generated sustained mainstream attention, largely because the Anthropic disclosure was self-reported by a well known frontier lab with an established media relationship, while the PaperCut campaign was surfaced by a specialist security research firm relayed through an aggregator. This asymmetry in coverage matters for critical infrastructure operators specifically, because it means the incident type most directly relevant to their own defensive posture, a deployed agentic attack against production systems, is systematically less visible than lab-disclosed misuse of the same underlying model family.

The broader asymmetric read for this sector is that mass-scale autonomous compromise achieved through commodity agent frameworks now represents the most acute and least governed AI deployment risk facing critical infrastructure operators. Unlike the model-release tiering pattern visible elsewhere in the frontier lab ecosystem this month, where general capability is being deliberately separated from gated security-relevant functionality, the agent-framework layer that enabled the PaperCut campaign sits largely outside any comparable gating regime. OpenAI Codex and the DeepSeek model used in the swarm were not themselves the subject of a security-tier release decision; rather, the agentic orchestration layer built on top of them was assembled independently by the threat actor. This suggests that model-level tiered access, however useful as a governance tool at the frontier lab layer, does not by itself address risk that emerges from the agent-framework and orchestration layer sitting between the model and the deployed system.

Outlook

The most direct open question for critical infrastructure operators entering the next cycle is whether independent third-party investigation of the PaperCut campaign will emerge to corroborate the initial specialist reporting; such confirmation would upgrade the current assessed-confidence rating toward a higher confidence tier and would likely trigger more formal incident-response guidance from national cybersecurity authorities. Operators should also watch for whether agent-framework vendors respond with hardening measures or disclosure requirements of their own, given that the orchestration layer rather than the underlying model appears to be the more proximate point of failure in this incident. Absent such a response, this monitor expects the agentic cyber risk vector to remain at its current elevated rating into the next cycle.

Science — AI Monitor

The scientific research sector this cycle is defined less by a new event than by the continued unresolved tension surrounding Isomorphic Labs, the biopharmaceutical spin-off of Google DeepMind, and its proprietary model reported to be on the scale of a fourth generation AlphaFold system. The advance was first reported in February and continues to draw scientific scrutiny because Isomorphic Labs has kept the underlying technical details of the model proprietary rather than publishing them for independent verification, even as the company has continued to describe the advance in terms suggesting major significance for drug discovery. A named computational biologist has publicly assessed the advance as being on the scale of what a fourth generation AlphaFold model would represent, a comparison that carries weight given the first three generations of AlphaFold were each subject to extensive open publication and independent replication.

The capability-to-deployment gap identified in this sector is structural rather than episodic: commercial drug-discovery incentives are outpacing open scientific disclosure norms for the most capable biological AI systems, and there is no current institutional mechanism that compels disclosure of dual-use-adjacent scientific AI breakthroughs of this kind. This is a different governance problem from the weapons-misuse and agentic-cyber-risk issues dominating other sectors this cycle, because here the risk is not deliberate malicious use but the erosion of the scientific communal verification process that has historically underpinned confidence in major computational biology claims. The stealth flag attached to this item reflects exactly that point: months after the initial disclosure, no institutional mechanism has emerged to compel disclosure of the technical basis for the claimed advance, and the disclosure-governance tension remains as unresolved now as it was when first reported.

The asymmetric read that follows from this pattern is a precedent-setting one for the broader AI-in-science landscape: a structural dynamic is forming in which the most capable scientific AI systems may become the least externally verifiable, precisely because the commercial incentive to protect a drug-discovery lead is stronger than any current disclosure obligation. For downstream biosecurity risk assessment in particular, this is a meaningful complication, because independent verification has traditionally been one of the primary mechanisms by which the research community identifies dual-use risk in a new computational biology capability before it is deployed at scale. If proprietary retention becomes the norm for the most capable systems rather than the exception, that verification function is correspondingly weakened across the sector, not just for the Isomorphic Labs model specifically.

Outlook

Watch for whether Isomorphic Labs, Google DeepMind, or any peer laboratory moves toward a partial technical disclosure, whether through a peer-reviewed publication, a technical report, or a controlled-access research programme, that would allow independent verification of the AlphaFold-class claims without fully surrendering commercial advantage. Absent such a move, this monitor expects the research disclosure gap vector to remain at its current moderate rating, unchanged since the original February disclosure, into the next cycle. Any comparable proprietary-retention decision by another laboratory working on a dual-use-adjacent scientific AI capability would reinforce the precedent and likely warrant an upgrade in this vector rating.