Who gets to say what the machines did

Who gets to say what the machines did. Anthropic has published the most detailed public account yet of how artificial intelligence is being used for espionage, propaganda and fraud. It found the activity in its own systems, named the actors, imposed the penalty and released the evidence. The question is what happens when a record like this can only be assembled by the company whose product generated the telemetry. A single document published on 10 September did four things that rarely sit inside a single organisation. It attributed a sustained espionage campaign against Ukrainian and European government, diplomatic and defence targets to an actor whose tradecraft it linked to the Russian group commonly known as Midnight Blizzard. It named a France-based digital advertising agency and an Istanbul technology company as the operators of political manipulation services sold to paying clients. It recorded the penalty, already applied: the accounts were closed. Then it released the evidence, indicators of compromise included, to anyone who wanted to download it. Investigator, analyst, enforcement authority and publisher were the same company, and that company sells the product the actors were using. The reaction has been warm and mostly deserved. Anthropic's fourth threat intelligence report is the richest case-level account of AI-enabled malicious activity anyone has put into public view. It describes a Russian espionage operation that used automated workflows to rebuild its own malware whenever a security product detected it, a Chinese-speaking group running what amounts to an unattended zero-day research foundry against network security appliances, and a single French-speaking operator who gained internal access to at least fourteen of the forty-two organisations he targeted, among them European political parties, media outlets and think tanks, before building a searchable platform for looking up members of a political movement by name. Almost every response has argued about what the findings mean for defenders. Very few have asked what kind of institution produced them. The chain runs end to end inside one company Consider what the report actually represents as a piece of governance. Anthropic detected the activity in its own telemetry. It assigned the actors internal designators, the Generative Threat Groups, which function much as the APT labels that have shaped a decade of threat reporting. It reached attribution judgments about states, companies and named individuals. It imposed a sanction by banning accounts, which in a market with a handful of frontier providers is a meaningful exclusion. It decided what to disclose, in what detail, and when. And it shared intelligence with authorities and industry partners, in its own words, where appropriate. That last phrase is the load-bearing one. Sharing is discretionary. Nothing obliges a model provider to report what it finds, to report all of it, or to report it on any particular timetable. Anthropic controls the telemetry on which its own assessment rests, decides how much of it becomes public, and offers no process through which an organisation it has named can test that assessment against the underlying record. None of this implies bad faith. The disclosures read as measured, the report is explicit that its cases were chosen as notable rather than representative, and the company had every commercial reason to publish nothing. The problem is structural, and it is not that attribution has been privatised. Security firms have been naming state campaigns publicly for more than a decade, and the modern attribution ecosystem could not function without them. What is new here is the concentration. One organisation owns the platform that was abused, holds the only record of what happened inside it, conducts the investigation, imposes the exclusion and writes the public account. The applause has been for the quality of the account rather than for the arrangement that produced it. Attribution has become a stack of private assessments Two different claims are doing work in a report like this, and they carry different evidentiary weight. What happened inside Claude is something Anthropic observes directly: the prompts, the accounts, the workflows, the volume. Who was ultimately behind it is a separate question, answered by correlating that telemetry against infrastructure, language, operational habits and the existing body of vendor and government reporting. Anthropic is careful about the difference, describing its judgment on the Russian case as consistent with public reporting linking the actor to Midnight Blizzard rather than as a finding of its own. On the first question it is the authoritative witness. On the second it is one participant among several. The report's account of the Russian operation rests partly on a corroborating case from Microsoft. Anthropic describes an actor compromising hotel guest wifi vendors and hijacking DNS records to push malware at travellers whose profiles matched Ukrainian government and drone-industry targets, and notes that Microsoft documented the same method in a July report it called CaptiveCrunch. Microsoft attributes that campaign to a cluster it tracks as Storm-2945, which it assesses to be a sub-group of Midnight Blizzard. A smaller security firm had published part of the same findings eight days earlier. Follow that chain and the only link in it made by a government is the oldest one. When the United Kingdom and its partners set out the connection between this actor and Russian intelligence, they did it in a joint advisory co-signed by eight agencies across five countries, using the formal probability language that British assessment bodies apply to every judgment, and landing on the phrase "almost certainly part of the SVR". Everything built on top of that anchor in this chain is a vendor assessment expressed in a sentence, resting on evidence that is not available for independent scrutiny. Vendors corroborating one another is real corroboration and it is better than none. It is also corroboration among parties with broadly aligned commercial incentives, working from proprietary data nobody else can examine, using naming conventions each of them owns. The public has no way to audit any of it. Vendors do hedge, and the careful ones say "assesses" where they mean it, but the hedging answers to no common standard and no reader can tell what a given firm means by it. The evidence is a by-product of commercial telemetry The deeper fragility is that this record exists at all only because misuse happens to pass through a system its owner can watch. Anthropic can see Claude. It cannot see anything else, and the report contains a quiet inventory of the exits. One group sold discounted access that silently routed customers to a different model while harvesting their credentials. A hacktivist ran an entire month-long campaign on stolen API keys, which meant the traffic was attributed to the legitimate owner. Another operator fronted an open-source penetration testing platform with a local model gateway, and a third ran an onion-hosted gateway routing to third-party models. Stolen credentials, the report observes, deliver loot, compute and cover at once. Cover is the part that matters here: it degrades the telemetry that the public record depends on. So the observational window narrows in exactly the conditions where capability is spreading fastest. Open-weight models do not file reports. A model running on a rented server behind a stolen key generates no disclosure. The frameworks that automate the attack chain are downloadable by anyone, and the report says plainly that the operating model documented in November 2025 has now proliferated across every class of actor investigated. Sight depends on actors continuing to use a supervised product under their own account, which is precisely the behaviour that competent operators are abandoning. What the state built instead Governments have not been idle, but they have built something different. The NCSC's assessment of AI and the cyber threat offers graded judgments about where the threat is heading and warns of a widening gap between organisations that can keep pace and those that cannot. It is a forecast rather than an evidentiary record, and it contains no cases, no named actors and no indicators. On the American side, the June executive order on advanced artificial intelligence innovation and security directs the NSA, CISA and Treasury to build a classified benchmarking process for assessing the cyber capabilities of frontier models, with developers invited to hand over pre-release access for up to thirty days. The order expressly disclaims any licensing or pre-clearance requirement. Participation is voluntary, the benchmarking is classified, and the whole apparatus measures what models are theoretically capable of doing. What is missing is a public mechanism for independently verifying what frontier model providers say they have observed their own systems doing. Capability is assessed in secret by invitation. Misuse is assessed in public by the vendor. Neither arrangement can be inspected by a citizen, a legislature or a court, and some of the richest evidence available to democracies about threats to their own elections, ministries and defence industries now originates inside the companies supplying the models. There is a serious case on the other side. Anthropic published a catalogue of harm in which its own product is the instrument, at commercial cost and with no obligation to do so, and the alternative to imperfect voluntary disclosure has usually been silence. The regulator that might verify these findings does not exist, and a state body doing the same work would probably classify most of it, leaving the public with less rather than more. Companies have moved faster and more openly here than any government has managed, and a demand for institutional purity that ends in nobody publishing anything would be a poor trade. That case is strong enough to settle how to treat this report and too weak to settle the next decade. The findings will shape procurement, legislation and threat models across Europe, and they rest on a body of evidence that one firm owns, curates and may lose access to as adversaries migrate off supervised platforms. The absence to notice is institutional rather than technical: there is no independent public body with routine access to the evidence, no common standard the published assessments must meet, and no obligation to publish them at all. That is a design problem rather than a law of nature. Common disclosure standards and protected reporting channels into national cyber agencies would help. So would confidential technical review, in which providers retain the sensitive material while an authorised body inspects samples, methods and attribution practice and publishes what it is prepared to vouch for. Which leaves an uncomfortable test for whatever comes next. If the fifth report is thinner than this one, nobody will be in a position to say whether that means the defences are working or the adversaries have simply moved somewhere nobody is watching. Disclosure: Anthropic is a named actor in this essay. McCyber uses Anthropic's Claude models in its editorial workflow, as set out on the About page. Sources: Anthropic, Microsoft Threat Intelligence, UK National Cyber Security Centre, CISA, The White House, Help Net Security.