Anthropic’s September 2026 threat-intelligence report describes malicious attempts to use Claude across cyber operations, surveillance, influence operations, scams and fraud, and other harmful activities. Anthropic says it disrupted the activity it identified, used the findings to strengthen safeguards, and shared intelligence where appropriate.
The report is intentionally focused on notable misuse rather than normal customer activity. It should not be read as evidence that ordinary AI use is inherently malicious. But it is a strong reminder that a capable tool becomes more dangerous when it has excessive access, stolen credentials, or authority beyond the job it is supposed to perform.
For businesses, access is a design decision
When companies first experiment with automation, it is tempting to give a service account broad permissions because that makes integrations easier. That shortcut creates unnecessary risk.
A customer-status assistant that only needs to read order and shipment information should not be able to change prices. An RFQ workflow that prepares a quote should not automatically inherit authority to alter the product master. A document-processing agent should not receive access to every shared drive simply because some relevant files live there.
The right question is not “What can this AI do?” It is “What is the minimum access this workflow needs to complete this specific business job?”
Four access controls that matter immediately
1. Separate identities
Use dedicated service identities for production workflows instead of shared employee credentials. That makes permissions, logging, revocation, and incident review much clearer.
2. Separate read from write
Many workflows can deliver most of their value with read access plus a draft queue. Write access should be added only where the operational benefit justifies it and the validation and rollback controls are ready.
3. Limit the data boundary
If an order workflow needs customer number, SKU, price, quantity, and shipment data, do not automatically send unrelated notes, financial records, or full customer histories to the model.
4. Monitor unusual behavior
Look for changes in transaction volume, access patterns, failed authorization attempts, unexpected API usage, repeated retries, and abnormal costs. A workflow that behaves differently from its baseline deserves review even if it has not yet produced a visible business error.
Credentials deserve special treatment
Anthropic’s report includes examples involving technical misuse and compromised access. For an SMB, a realistic control is to keep credentials outside prompts and model context, store them in appropriate secret-management systems, rotate them when necessary, and ensure the model receives only the capability exposed through the integration—not the raw credential itself.
This is one reason Bridge Road separates the model from the integration layer. The model can interpret a request, but a controlled service decides whether a requested system action is allowed and how it is performed.
Governance enables more automation, not less
Least privilege may sound restrictive, but it actually makes it easier to automate confidently. A narrowly authorized workflow has a smaller blast radius. That makes testing simpler, monitoring clearer, and production approval easier.
Our vendor and model risk framework examines data boundaries, permissions, logging, provider changes, resilience, and cost before production launch. The Order-to-Customer workflow is a good example: it can retrieve useful customer status without granting the model unrestricted access to the systems behind that answer.
AI is increasingly capable. Good architecture makes sure capability is not the same thing as permission.
