The Intake
The Intake — Saturday, September 19, 2026
On the substrate
Anthropic September 2026 threat report names illicit distillation as a formal harm category
Anthropic Threat Intelligence Report September 2026 cellcog.ai aicybr.com
If you've been building API-accessible AI services and thinking about what the attack surface looks like at operational scale, Anthropic published its first formal threat intelligence report this week, covering December 2025 through August 2026.
The report tracks approximately 40 threat groups across seven harm categories. Illicit distillation appears as a formal harm category for the first time. The category covers automated API access used to systematically extract and replicate model capabilities at scale. One documented operation processed 1.8 million Android APKs. Another generated 2,475 investigative briefs in 30 days. A third ran 4,700 automated Claude personas in a single dating app fraud operation.
The primary shift the report documents: threat actors have moved from interactive chat sessions to autonomous multi-agent execution. One operation ran continuously for 130 or more days. It targeted 27 institutions. If you're operating services with AI API exposure, this is the first formal taxonomy Anthropic has published of what attacks at that layer look like in practice.
Qwen3.8-Omni-Flash ships with 1 million token context window and near-zero audio costs
Alibaba released Qwen3.8-Omni-Flash on September 18, 2026. The model accepts text, images, audio, and video in a single workflow; it is API-only and weights are not released.
The context window is 1 million tokens. It supports up to one hour of continuous audio-video per call. Pricing is $0.15 per million input tokens and $0.47 per million output tokens. Alibaba reports audio input costs at 98% lower than the predecessor Qwen3.5-Omni-Plus. Audiovisual costs are reportedly 93% lower. The model supports 74 speech-recognition languages.
Alongside the model, Alibaba open-sourced Qwen-MM-Plugins, a plugin layer. Alibaba describes it as integrating with Claude Code, OpenAI Codex, Gemini CLI, and Qwen Code. Benchmark figures are Alibaba-reported with no independent verification published as of this writing. The company reports a +26% average improvement across 30 evaluations. WildClawBench-MM is reported at 71.0. If audio or video processing is part of what you're building toward, evaluation access is through Alibaba Cloud's Qianwen platform.
---
For operators
Claude Code Projects ships Coordinator chat and Worker Threads for parallel cloud work
Anthropic blog Unite.AI MLQ.ai
If you run Claude Code cloud sessions and use Projects to organize your work, Anthropic began rolling out a redesigned architecture on September 17, 2026.
The new structure uses a Coordinator chat and Worker threads. The Coordinator scopes work and delegates to threads. Worker threads are full cloud Claude Code sessions. Each runs on its own git branch and repository copy. The Coordinator handles merge conflict detection and pull request dependency ordering across threads. Threads can also spawn subagents and loops.
The rollout is in beta for select Claude Pro and Max users on cloud sessions. Expansion to remaining Pro and Max users is expected within a week. Team and Enterprise access is described as forthcoming. If you're on Pro or Max, check your Projects interface — if you haven't been invited to the beta yet, the waitlist is at claude.com/form/projects.
Anthropic threat report documents credential harvesting against multi-user API services
Anthropic Threat Intelligence Report September 2026 cellcog.ai aicybr.com
If you're running a service that proxies AI API calls on behalf of multiple users — a team wrapper, a shared-access platform, or an API layer managing credentials for multiple users — the Anthropic threat report documents two cases where that architecture was the attack surface.
One case involves threat actor GTG-50014, previously tracked as ShinyHunters. The operation proxied distillation requests through 5,380 fraudulent Moonshot AI platform accounts. In a separate case, 280 credentials were harvested from a hotel booking system. That operation ran for 130 or more days.
In both cases, per-credential rate limits were absent or insufficient to detect the operation. Per-user request attribution had the same limitation. Detection came through behavioral analysis rather than rate-limit signals. If your service proxies AI API calls for multiple users without per-user attribution, the question this surfaces is whether your behavioral analysis is sufficient to distinguish normal usage from an operation running through credentials your service manages.
---