Merged edition · 8 October 2026. This combines Prahari X Global Risk Report 001 with The Buy Side Lens: Anthropic Threat Intelligence, September 2026 v2. They share an underlying evidence base and now form one website article.
The strategic question is how much consequential work a small operator can coordinate, not how fluent a chatbot’s answer sounds. The two original reports approach that question from complementary directions: the Prahari brief explains public-security and data-routing risks; the Buy Side Lens note follows the mechanism into enterprise controls and possible spending. The merged argument is that greater automation increases the value of knowing who can act, what they can access and how an organization can stop or reconstruct the action.
What the primary report establishes
Anthropic’s 10 September report describes selected misuse cases disrupted between December 2025 and August 2026. It says an Alibaba-linked campaign generated over 151 million exchanges in May–July, that Moonshot’s routing network used 5,380 fraudulent accounts, and that a Mali surveillance platform covered roughly 25 million SIM cards. Its weapons case describes a test appearing to fail; it does not establish a reliably deployed weapon. These are the provider’s allegations and measurements, not an independent audit or a census of AI use. Anthropic primary report.
The numbers have different objects and denominators. They should not be added or displayed as though they were one scale of harm. Exchanges are interactions, accounts are access identities, and SIM cards are not distinct people. The source’s detailed weapon-development material is not needed to understand the institutional risk and is not reproduced here.
The operating boundary matters more than the answer
The prompt-routing cases in the original reports show why the visible application name is an incomplete control boundary. If an application sends a document to another provider, the transfer occurs before the user decides whether the answer is useful. Output quality cannot establish that the intended data-processing arrangement was followed.
A practical review therefore maps the application operator, downstream model providers, storage locations, administrators and retained logs. It records which transfers are approved and how a change is communicated. A statement that data is not used for training does not by itself answer who processes it, who stores it, or who can retrieve it.
The same distinction applies to credentials. A document may disclose a plan; a live key can authorize action. A secure workflow should avoid putting reusable secrets into prompts, limit the access granted to an agent and make revocation possible without rebuilding the whole operating environment. These are defensive implications of the source analysis, not claims that one control eliminates all risk.
Small headcount no longer defines a small operation
The original Buy Side note describes skill compression: research, coding, translation, review and data processing can be coordinated through one interface. The Prahari brief adds the human consequence: a small operator may build systems that affect many people when it already has access to sensitive records.
The critical distinction is between assistance and authority. An AI system may help create software without supplying the original data or deciding who is targeted. Responsibility for purpose, permission and deployment therefore remains central. An impressive demonstration should not hide the external access, infrastructure and human choices required to produce the outcome.
For institutional analysis, count the resources actually necessary to sustain a process. These include privileged access, reliable execution, compute, usable data, review, maintenance and an objective. A reduction in labour on one task may shift the bottleneck to another. The research supports testing that shift; it does not justify a universal percentage reduction in staffing.
Figure 01 · Conceptual framework
From answer to consequential action
How the parts connect
- Human objectiveassigned toIdentity
- Identityconstrained byPermissions
- PermissionsauthorisesExecution
- Executionrecord and reviewAudit and stop
- Audit and stoprevise accessPermissions
A defensive operating model
| Control question | Evidence a reviewer should request |
|---|---|
| What can the agent read? | A documented data boundary and actual access configuration |
| What can it change? | Task-scoped permissions and approvals for consequential actions |
| Who else processes the input? | Provider and subprocessor information with change notification |
| Can the action be reconstructed? | Logs linking user, agent, tool, resource and time |
| Can access be stopped? | Tested revocation and recovery procedures |
| Who owns the incident? | A named accountable function and rehearsed handoffs |
NIST’s Generative AI Profile is a voluntary risk-management companion that supports evaluating trustworthiness across the lifecycle. It is a governance reference, not certification that a particular deployment is safe. NIST AI 600-1.
The useful exercise is to rehearse a small number of concrete incidents: a key reaches the wrong service; an agent receives broader access than intended; an unexpected provider handles a sensitive file; or a system acts on an incorrect result. Record how the institution detects the issue, stops further access, preserves evidence and keeps essential work running. A policy document is valuable only if those responsibilities can be carried out.
The buy-side transmission is a hypothesis to test
The second source contributes an investment framework, but its strongest claims should remain conditional. More automation may increase demand for identity management, privileged-access controls, runtime monitoring, data protection and incident response. It does not follow that every security vendor receives incremental revenue, that every AI feature is separately priced, or that rising technical risk guarantees a sector re-rating.
| Mechanism | Potential buyer response | Evidence needed for a commercial conclusion |
|---|---|---|
| More machine identities | Broader access governance | Paid workloads and actual attach rates |
| Agents reach production systems | Runtime permission and monitoring tools | Production deployment and renewal evidence |
| More sensitive data crosses services | Data controls and provider review | Enforced policies and separately funded requirements |
| Faster operational change | More continuous assurance | Demonstrable reduction in review time or losses |
| Limited internal expertise | Managed services | Sustainable margins and repeat contracts |
This table is the merged reports’ analytical thesis. It contains no current market-size estimate or stock recommendation. The commercial test is whether a supplier occupies a necessary control point, can prove it works and can retain economic value after bundling and competition.
What would weaken the thesis
The original buy-side note correctly identifies counterevidence. Enterprises may incorporate the necessary controls within existing suites; budgets may stay flat; agent deployment may remain narrow; or loss severity may not rise as feared. In those cases, the security need can be real while the incremental revenue opportunity is modest.
Monitor recurring spend, paid production use, retention, control coverage and measured incident outcomes. Separate broad IT-budget growth from an AI-specific effect. A vendor’s sales narrative and an independently observed customer purchase are different evidence classes.
Keep the limits attached when sharing
One provider observes its own services and detection process. Its selected cases demonstrate possible mechanisms but do not estimate worldwide prevalence. Absence of detected activity on a model class may reflect access, safeguards, economics or the observation window; it does not establish immunity.
The merged article therefore preserves the two sources’ most useful combination: accessible explanation of security consequences, followed by a disciplined test of institutional and economic implications. It removes the unsupported collective biography and classified-experience claims in the older note. The analysis should establish credibility through its evidence and reasoning.
Figure 02 · Conceptual framework
An output check cannot undo a data transfer
How the parts connect
- Input materialpolicy checkApproved route
- Approved routeapproved processingProcessing chain
- Processing chainreturnsReturned output
- Processing chainlogsEvidence record
- Returned outputreview resultEvidence record
Full original report: AI Made Hacking Cheap. Every Company Now Pays the Security Bill.
The supplied original is retained below with dated editorial notes. The web analysis above and its corrections remain part of this reading edition.
Original Lens and publication context
A top AI lab’s most detailed misuse report shows one person can now do the work of a hacking team, and rival labs copied its models at industrial scale. Who pays, who gains, and what we would do.
- A top AI lab says attackers now let its AI run whole hacking jobs.
- The tricks are old, but the cost of using them has collapsed.
- It names seven Chinese labs for copying its models, with one campaign logging 151 million requests.
- The market has rewarded the sellers of security but has not yet charged the buyers.
- We prefer security that guards logins and keys, expect lower software profits, and hold less of China’s model-only AI firms.
Supplied archive exhibit · original labels. Read alongside the editorial corrections.
1. What Happened
On 10 September, Anthropic put out its most detailed misuse report so far. Anthropic makes the Claude AI models. The report covers December 2025 to August 2026.
It sorts the misuse into seven kinds. Hacking. Spying on people. Fake news. Scams. Weapons. Biology. And copying its models.
The attackers ranged from state spy services to criminal gangs, spyware sellers and lone activists. The company says it stopped every operation in the report. It banned the accounts and shared what it found with authorities and industry.
They used its everyday models. Its two newest models sit behind tighter checks. Only one case, a copying case, touched them.
Two cautions. First, the author is also a party. It sells AI, and it wants Washington to act against Chinese rivals. The named firms have not accepted its claims.
Second, the day before, the same company published a review of four cases where its own models reached real computer systems. It happened in tests wrongly left open to the internet. An outside reviewer is now checking those cases.
2. Old Tricks, New Price
The report’s main point is about cost, not new tricks.
None of the attacks needed a new method. They used stolen logins, unfixed devices, open doors and fake emails. What changed is who does the work.
AI agents now do most of it. An agent is an AI program that acts on its own, step by step. It scans for targets, writes tools, breaks in and sorts the stolen data. Humans still pick the targets and cash out.
Here is what single operators managed:
- About three hours. One stolen developer key became full control of a victim’s cloud account.
- About 34 hours. One breached supplier gave up more than 2,100 sets of login tokens from over 40 firms. A token is a digital pass that lets a program in without a password.
- About four days. One crew hit some 30 AI firms by repeating a single method that worked.
- One month. One automated loop turned up more than a dozen possible zero-days in network devices. A zero-day is a flaw the maker does not know about, so no fix exists yet.
- One person. A lone attacker built a search engine for exposing people’s private details, loaded with tens of millions of records.
Two things follow. One. Skill no longer tells you who the attacker is. A student, a criminal gang and a spy service now work the same way. Only the aim differs.
Two. Being small is no longer a shield. When an attack costs little, a small target is worth it. Hiding stops working.
The report sums it up in one line: “AI has inverted the cost back onto defenders.” One spy crew set its agents to rebuild its tools each time a security product caught them. The agents kept going until the tools slipped through. The defender writes a new rule. The agent rewrites the tool before the next rule arrives.
The tricks are old. What collapsed is the price of using them.
Supplied archive exhibit · original labels. Read alongside the editorial corrections.
Figure 03 · Conceptual framework
A defensive operating model
How the parts connect
- Set the boundaryoperateMonitor behaviour
- Monitor behaviourcredible concernContain exposure
- Contain exposureinvestigateReconstruct events
- Reconstruct eventslearnRepair controls
- Repair controlsreapproveSet the boundary
3. The New Prize: Keys to AI
A new kind of loot runs through the report. It is the key that lets a program use an AI service.
Firms leave these keys inside apps, code and settings. Criminals hunt for them at scale. One crew pulled 1.8 million phone apps apart, looking for keys left inside.
A stolen AI key pays three ways. One. It can be sold. Two. It gives free computer power for the next attack. Three. The bill and the blame land on the real owner.
One fake reseller sold cheap access to Claude. It was not Claude. The buyers’ requests went to a different model, and a hidden program stole their logins to sell on.
Another crew hit about 30 AI firms in four days. It wanted an unreleased model. It failed every time. The keys it stole came from customers, not from the lab.
The lesson for money is simple. A key to an AI account now needs guarding like cash. That is new work, and a new cost, for every firm that uses AI.
4. The Copying: 200 Million Questions
The biggest numbers in the report are about copying, not hacking. Here is what it counts. These are the company’s own figures.
- Five copying campaigns, close to 200 million exchanges in all. Seven Chinese labs are named.
- One campaign, linked to Alibaba’s Qwen models, made 151 million exchanges from May to July. It peaked near three million a day, spread over about 3,500 fake accounts.
- Moonshot, maker of the Kimi models, quietly passed almost 300,000 of its own users’ requests to Claude in ten days, through 5,380 fake accounts. Its users thought they were talking to Kimi.
- DeepSeek is linked to more than 12 million copying requests in 14 days of July.
- Claude is not sold in China. The copiers came in through proxy services, fake identities, throwaway emails, virtual cards and stolen keys. A proxy is a middleman that hides who is really asking.
The pace did not slow after the first public warning. In June, the company told US lawmakers of 28.8 million exchanges over six weeks. The new count runs at about two and a half times that daily pace.
Supplied archive exhibit · original labels. Read alongside the editorial corrections.
Now the honest part for us. In July, BSL-020 said Chinese models do about 95 per cent of what the best models do, at a tenth of the price. Part of that 95 per cent was borrowed. When borrowing gets harder, the gap can open again.
Doors are already shutting. Labs hide a model’s full working. They check who is buying. They cut off proxy resellers. And Washington has been asked to help.
One more clue. Only one copying case touched the two most guarded models. The gate works, and from here the gate is part of the product. That fits the price floor we described in BSL-028.
Keep one caution in view. These are one company’s counts. China says its AI gains are its own work. Both can be partly true.
5. Who Pays the Bill
Here is our core view. AI cut the cost of attacking. It did not cut the cost of defending. The gap is a bill, and someone has to pay it.
It lands first on the owners of data, not the sellers of security. We saw the same shape in the drone war (BSL-025). A cheap drone forced a costly guard onto every refinery and data centre. A cheap AI agent now forces one onto every firm that holds data.
Supplied archive exhibit · original labels. Read alongside the editorial corrections.
Look at who was hit in this report. Hotel Wi-Fi suppliers, an airline, a power company, a school software firm, a shop chain, software suppliers, political parties and government offices. None of them sells security. All of them now pay for it.
Software sold as a service is the sharpest case. Such a firm holds the keys to hundreds of customers. Break in once and you reach them all. In the report, one breached supplier led to some 200 customers. Another led to thousands.
So security stops being a one-off project. It becomes a running cost, like rent. It eats profit every quarter.
The market has paid the lock-makers. It has not yet charged the lock-buyers.
6. What the Money Said
The market has priced half of this story.
Security sellers listed in the US are up about 30 to 40 per cent this year. Strong results in late August added fuel. That is the revenue side, and it is in the price.
The cost side, we think, is not yet in the price of the firms that must pay it. That gap is what this note is about.
Hong Kong gave a cleaner read on the copying story. Thursday’s fall there came before the report landed, so we leave it out. By early afternoon on Friday 11 September, the two listed firms whose whole business is their AI models were down about 5 and 8 per cent. Both are named in the report.
The big named platforms held. Alibaba was about flat. Xiaomi rose 2 per cent. The Hang Seng stood at 24,742 at the lunch break, down 0.85 per cent.
Supplied archive exhibit · original labels. Read alongside the editorial corrections.
These shares swing hard on any news, so read the split, not the size. For a firm that is only a model, a copying charge hits its whole value. For a firm with shops, phones and a cloud, it is one line among many.
Alibaba took its own hit in June, when the first letter surfaced. Its Hong Kong shares fell to a 16-month low. In late August it still raised HK$80 billion in new shares for AI, at HK$112.70 each. Money keeps flowing to scale.
Figure 04 · Qualitative comparison
Who bears the security cost?
| Actor | Exposure | Evidence to monitor |
|---|---|---|
| Software supplier | Shared credentials and customer access | Identity controls, response time and recurring spend |
| Enterprise customer | Data loss and interrupted operations | Vendor access, backups and tested response plans |
| Security provider | Demand for protection and response | Retention, delivery cost and customer outcomes |
| AI platform | Abuse and account compromise | Access enforcement and attributable incident reporting |
7. What It Means for India
For India, this is more opening than threat.
Start with the risk, and give it a size. Indian IT firms sit inside the systems of the world’s biggest companies. This report shows attackers prize a supplier that opens many doors. One big breach traced to an Indian vendor would hurt contract renewals across the sector.
The risk is real but narrow. The large firms run big security teams, and clients audit them hard. The weak spot is the long tail of small vendors with thin budgets.
Now the openings.
- One. The world needs more defenders. India has them. Security work runs round the clock, and India’s captive centres and IT firms already staff much of it. Faster attacks raise demand for the people who run the defence, not only for the tools.
- Two. India’s own deadline. The data protection rules bite in full on 13 May 2027. Firms must guard personal data and report breaches fast. The Act provides penalties up to ₹250 crore for failures of reasonable security safeguards. The amount depends on the applicable provision and determination; it is not an automatic fine per incident. That is eight months away, and the spending comes first.
Supplied archive exhibit · original labels. Read alongside the editorial corrections.
- Three. Access. The doors are closing on copiers in China. Indian builders keep proper access to the top models. That is an edge in building AI products for the world.
- Four. Keep a second supplier. From 12 June, US export controls took the two newest top models offline for every customer for 19 days. Access came back on 1 July. A rule aimed elsewhere can still catch you.
- Five. Buy AI only through official channels. A cheap reseller can be a fake that steals your keys.
Put simply, building software got cheaper for everyone (BSL-028). Guarding it got dearer for everyone. Indian firms that do both well will take share.
8. This Has Happened Before. Three Times.
Start with one rule. Every good thing is first made by someone’s mind and work. Force and fraud can take what was made. They cannot make it. So every rich age has had to answer one question: who pays to guard the maker?
1453. Cannon battered the land walls of Constantinople. They had stood for a thousand years. The city fell in under two months. Attack had become cheap. Within fifty years, Italian engineers found the answer: low, thick, angled forts that shrugged off cannon balls. They worked. They also cost a fortune. In the 1550s, Siena spent so much on new walls that it could not pay for an army. It fell in 1555. Florence took it soon after.
1817. Thieves robbed the Royal Navy’s dockyard at Portsmouth with copied keys. The government offered a prize for a lock only its own key could open. Jeremiah Chubb won it in 1818. Now every owner had a reason to buy one. Security became a product, bought again and again. In 1851, during the Great Exhibition in London, an American named Alfred Hobbs picked the best British locks in front of witnesses. There is no last lock. The lock-makers did well. The owners kept paying.
2013. Thieves got into one of America’s biggest retailers through the login of its heating and refrigeration contractor. They took 40 million card numbers. The chief executive was gone within months. In 2015, US card networks moved the cost of copied-card fraud onto whoever had not upgraded to chip cards. The guard stopped being a choice. It became a duty, with a bill.
Three ages, one shape. When taking gets cheap, the guard gets dear. The owner pays. The small owner who cannot pay loses. The guard-maker does well, until the next tool arrives.
Today AI is the cannon. A stolen key is the copied dockyard key. And India’s May 2027 deadline is the 2015 moment: the guard becomes a duty.
9. What We Do
We talk about groups of companies. We do not name single shares.
- Security sellers. Keep them, but do not chase them. Prefer the tools that guard logins, keys and machine identities, and that respond on their own. Hold less of the old boxes at the edge of the network; this report shows they are now prime targets.
- Software sold as a service. Cut what you expect these firms to earn. They hold their customers’ keys, so their security bill rises first.
- Firms that hold lots of personal data. Travel, hotels, telecoms, retail and health. Cut what you expect them to earn for a lasting security cost.
- China’s AI firms that only sell models. Hold less than normal until the copying question settles. Big Chinese platforms with other businesses: neutral. This updates BSL-020.
- The best-guarded AI models. The copying channel is closing. That supports the price floor in BSL-028.
- Indian IT. Stay neutral. Security work is the part that grows. Our buy trigger stands: the first firm with sales rising while headcount stays flat.
- India at home. Favour the firms that sell security and data-protection work into the May 2027 deadline.
- Data centres and AI builds. Keep the security-cost cut from BSL-025 and the preference for suppliers over site owners from BSL-028.
- Unchanged. Refining margin over crude price. Short and medium bonds over long ones. Gold held as insurance. Home demand over firms tied to the world.
TRIPWIRES
- A big breach is traced to an Indian IT vendor using these methods: move Indian IT to below normal.
- The US limits who may use its AI models by nationality: check Indian access at once, and hold even less of China’s model-only firms.
- Security sellers’ growth slips under 20 per cent while prices stay high: trim.
- The outside review of the lab’s own test incidents finds wider failures: expect tighter AI rules and slower rollouts.
- The next count shows copying falling sharply: the gate is holding, and so is the price floor.
Horizon three months. Review date 11 December 2026.
