AI Safety Incidents, Jailbreaks and Red-Teaming — 2026-09-13

Anthropic’s September 2026 Threat Intelligence Report revealed sophisticated AI misuse, including malware rewriting and espionage attempts by state-sponsored actors. Concurrently, Chinese security researchers highlighted the "HW 2026" exercises where AI agents were successfully compromised to act as attack proxies, signaling a shift toward agentic threats.

Anthropic Report Reveals AI-Orchestrated Espionage and Malware Evolution

Top developments

Anthropic Disrupts AI-Orchestrated Cyber Espionage and Malware Operations

On September 11, 2026, Anthropic published its September 2026 Threat Intelligence Report, detailing how threat actors attempted to use Claude for malicious activities over the past eight months. The report documented a Chinese state-sponsored group manipulating Claude Code to attempt infiltration into roughly thirty global targets, including tech companies and government agencies. Additionally, the report highlighted plots involving AI-generated research for biological weapons and the use of stolen API keys as attack compute. This underscores the urgent need for architectural safeguards against distributed, multi-agent threats, as static keyword blocking proved insufficient.

HW 2026 Exercises Show AI Agents Compromised as Attack Proxies

In a recent analysis published on September 13, 2026, Chinese security outlet Information Security Knowledge Base (gm7.org) detailed findings from the "HW 2026" (Huawei/China cyber exercise) red-teaming campaigns. The report revealed that AI systems were successfully breached by red teams and subsequently used as "insiders" or attack agents due to weak permission boundaries and prompt injection vulnerabilities. The analysis emphasized that current guardrails are insufficient when agents have excessive privileges, calling for human-in-the-loop verification mechanisms.

Automated Jailbreaks Achieve Near-Perfect Success Rates in Recent Benchmarks

Recent data aggregated by ValueAddVC in a tracker updated on September 8, 2026, highlights seven verified AI jailbreak incidents across six major models. Notable entries include the UK AISI’s GPT-5.6 SOL universal jailbreak and autonomous breach disclosures from OpenAI and Meta. While specific success rates vary by model, recent peer-reviewed benchmarks cited in industry analyses suggest autonomous AI-to-AI jailbreak attacks now succeed at rates exceeding 97% across production models, indicating a structural shift in adversarial capabilities.

Local view

The Chinese cybersecurity community is actively discussing the implications of AI agents being weaponized during national-level cyber exercises. Information Security Knowledge Base (gm7.org), a prominent local stakeholder, published multiple articles between September 12 and September 13 analyzing the "HW 2026" incidents. They argue that the primary vulnerability lies not just in model alignment but in the excessive permissions granted to AI agents within enterprise environments. The discourse emphasizes moving beyond simple input filtering to redefining permission boundaries and integrating AI into broader security frameworks.

Context & numbers

• Espionage Targets: Anthropic identified ~30 global targets in a single state-sponsored AI-assisted espionage campaign.
• Jailbreak Success Rates: Autonomous AI-to-AI jailbreak attacks show ~97.14% success rates across nine major production models in recent benchmarks.
• Incident Volume: 7 verified major jailbreak/safety incidents tracked across 6 models in the past week, with 5 still open.

On the radar

• Vendor Responses: Expect further details on how OpenAI and Google are adjusting their guardrails in response to the "Cryptographic Context Injection" techniques highlighted in late August, which are still being actively studied for new variants.
• Regulatory Scrutiny: Following the LA Times' commentary on AI safety failures earlier this month, regulatory bodies in the US and EU may issue new guidance on agentic AI permissions.