The Cyber Threat Perspective·Sep 18, 2026·52m·Episode #196

One Hacker, 42 Targets: Inside Anthropic's AI Threat Report | Ep 196

Show notes

Their read: the attacks themselves are familiar. Stolen credentials, unpatched edge devices, exposed services, phishing, SQL injection. What AI changed is speed, automation, and scale, and that is enough to matter.

In this episode:

The skill floor for hacking has dropped, and solo operators are now running campaigns that used to take a team
Threat actors vibe coding phishing kits, credential dashboards, and custom tooling
Automated vulnerability discovery and exploit development, including one workflow that produced more than a dozen potential zero-day findings in a month
Why older models with looser guardrails are showing up in operations while frontier models refuse the same requests
Custom harnesses and multi-agent pen testing frameworks that chain traditional offensive tools under an LLM
Stolen AI credentials and API keys as a high-priority target, plus resellers advertising discounted access to frontier models
On-the-fly obfuscation and retooling that breaks signature-based detection
Why baselining, behavioral detection, application control, and external attack surface hygiene matter more than they did a year ago

Groups covered: GTG-2006, GTG-50014, GTG-10007, GTG-50020, GTG-50021, and GTG-50029.

Spencer and Tyler are penetration testers at SecurIT360.

If you get something out of the show, subscribe and leave a rating or review. It helps more than you would think.

Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov

Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

← Previous

[Replay] Episode 178: Internal Security Controls That Actually Frustrate Attackers

One French-speaking hacktivist targeted 42 organizations and got internal access to 14 of them, working alone. That is the kind of detail Anthropic's September 2026 threat intelligence report put on the record, with data spanning December 2025 through August 2026. Spencer and Tyler walk through all six generative threat groups named in it and what actually changes for defenders. Their read: the attacks themselves are familiar. Stolen credentials, unpatched edge devices, exposed services, phishing, SQL injection. What AI changed is speed, automation, and scale, and that is enough to matter. In this episode: The skill floor for hacking has dropped, and solo operators are now running campaigns that used to take a team Threat actors vibe coding phishing kits, credential dashboards, and custom tooling Automated vulnerability discovery and exploit development, including one workflow that produced more than a dozen potential zero-day findings in a month Why older models with looser guardrails are showing up in operations while frontier models refuse the same requests Custom harnesses and multi-agent pen testing frameworks that chain traditional offensive tools under an LLM Stolen AI credentials and API keys as a high-priority target, plus resellers advertising discounted access to frontier models On-the-fly obfuscation and retooling that breaks signature-based detection Why baselining, behavioral detection, application control, and external attack surface hygiene matter more than they did a year ago Groups covered: GTG-2006, GTG-50014, GTG-10007, GTG-50020, GTG-50021, and GTG-50029. Spencer and Tyler are penetration testers at SecurIT360. If you get something out of the show, subscribe and leave a rating or review. It helps more than you would think. Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here .