Attackers broke into one software company and, through it, reached the data of roughly 200 of that company’s customers.
None of those 200 organisations were breached. None of them made a mistake. None of them had any say in it, and most would have had no way to know it had happened.
That figure comes from Anthropic’s threat intelligence report, published on 10 September, covering operations it disrupted between December 2025 and August 2026.
Why a security report is a procurement story
Most of that report is not for you. It covers surveillance, influence operations, biological misuse and illicit distillation, across more than 50 targeted organisations in education, retail, energy, technology, healthcare, finance and government. If your department is not running a security programme, there is nothing in those pages you can act on.
One finding is different, and it is the supply chain one.
Attackers are now deliberately compromising software suppliers as a route to the customers behind them. Not as an accident of scale. As the method.
That changes what the reader is exposed to. Your own systems can be in good order, your own staff can be careful, your own controls can be exactly what your insurer asked for, and your data can still be sitting inside a supplier who is having a bad month. You cannot audit your way out of that from inside your own building.
Three hours, start to finish
Two numbers in the report are worth carrying, because they settle a question people usually get wrong.
One enterprise software compromise went from a single stolen developer token to full administrative control in roughly three hours. Another reached over 2,100 Azure AD token sets, across more than 40 corporate tenants, in about 34 hours.
The instinct is to picture a breach as a slow thing. Someone gets in, moves quietly, and weeks later the damage is understood. That picture is where “we would notice” comes from.
Three hours is shorter than a morning. It is shorter than the gap between a supplier noticing something odd and a supplier telling anybody. Whatever your response plan is, it is not going to start inside three hours, and it does not need to. What matters is that the timeline has moved and your assumptions probably have not.
The question that belongs in a conversation you already have
You already talk to your suppliers. There is a renewal, or a review, or an account manager who wants half an hour. That conversation has a shape and you know how to have it.
Three questions fit inside it without needing anyone technical in the room.
What AI systems do you run that touch our data? Not what AI features do you offer us. What is running on your side, on our information.
Who audits that, and when did they last do it? An answer naming an external party and a date is worth something. An answer describing a commitment is worth nothing.
If something goes wrong on your side, what will you tell us, and how quickly? This is the one people skip, and it is the one that produces the most revealing silence.
You are not trying to catch anybody out. You are establishing whether the supplier has thought about it, because a supplier who has will answer in specifics and a supplier who has not will answer in adjectives.
What this does not mean
It does not mean stop buying software. Every organisation runs on suppliers and the alternative to supplier risk is building everything yourself, which is worse in every direction.
It does not mean your data is currently compromised. It means the route exists and is being used deliberately, which is a different claim and a smaller one.
And it does not mean the answer is a policy. A policy about supplier AI exposure written by someone who has not asked any supplier the three questions above is a document about an imagined situation. Ask first. Write afterwards, if the answers turn out to warrant it.
Who is telling you this
Anthropic is reporting on misuse of Anthropic’s own product. That is a company account of its own investigations, with no independent verification attached, and it should be attributed that way in any conversation where it carries weight.
It is still worth reading, and the reason is worth being precise about. A vendor publishing research that concludes you should buy the vendor’s product is selling. A vendor publishing what went wrong inside its own systems is doing something else. The incentive runs against disclosure, which is exactly what makes the disclosure interesting.
Compare it with the same week’s alternative. A security firm published figures showing frontier models bypassing endpoint detection 40 per cent of the time, generated on that firm’s own testing range, with no external sample and no independent instrument. Striking numbers, and they are the firm’s own marketing. The difference is not the quality of the research. It is who benefits from the conclusion.
The part that transfers
Your supplier list is longer than you think, and most of it was approved by somebody who no longer works on it.
Pick the three suppliers who hold the most of your information. Not the three you spend the most with, though there is usually overlap. The three who would cause the most difficulty if their systems were open to somebody else for an afternoon.
Ask them the three questions. Write down what they say.
That is an hour of work and it produces something you did not have: a record of what your suppliers claim, in their words, dated. If the answers are good, you have peace of mind that cost an hour. If they are vague, you have found out now rather than during the incident, which is the only time these questions get asked at speed and the worst time to be asking them for the first time.
Two hundred organisations found out the other way.