Claude Report — 2026-09-13
- Anthropic publishes a September threat-intel report: Claude misused for autonomous drone-targeting software, near-bioweapons-threshold research, and state-linked cyber ops.
- Claude Code v2.1.270 and Agent SDK TS v0.3.270 ship Sep 12, fixing a Bash regression that re-asked permission for read-only git commands.
- claude-agent-sdk-python stays stalled at v0.2.152, now 11 days behind sibling SDKs with no new package release.
- agent-guardrails-kit ships two more adversarial rounds, closing an `rm -rf`-parent-directory bypass and a dozen ways git itself leaks committed secrets.
- oraios/serena resumes active development with a language-server registry after a quiet week.
🚀 Anthropic Official
Detecting and countering misuse of AI: September 2026 (Sep 10-11)
Anthropic's Threat Intelligence team documents activity disrupted between December 2025 and August 2026 across cyber operations, influence operations, surveillance, fraud, biological misuse, conventional weapons, and distillation. Highlights include a Russia-linked group using Claude Code to build autonomous drone-targeting software with no human in the loop, newer models that "can no longer be assumed to fall safely below the threshold for meaningful bioweapons assistance," and state-sponsored actors running Claude as an execution layer inside multi-agent attack frameworks rather than just for content generation.
Claude Code v2.1.270 (Sep 12)
Fixes a regression introduced in v2.1.269 that made read-only git commands unexpectedly ask for permission again after a Bash session had been running for a while.
Claude Agent SDK TypeScript v0.3.270 (Sep 12)
Ships a parity bump matching Claude Code v2.1.270's git-permission regression fix, with no other SDK-level changes.
claude-agent-sdk-python remains stalled at v0.2.152 (Sep 2), now 11 days behind the TypeScript SDK with no new package release despite Claude Code advancing three more versions.
🔌 Claude Code Plugins
Plugin tracking skipped this run — official marketplace install-count cache unavailable.
🛠️ Skills
tt-a1i/archify
Rejects invalid arguments across its remaining CLI commands and regenerates the skill archive under official Node 22 (Sep 13, #307).
affaan-m/ECC
Classifies directory-traversal failures distinctly from other memory-read errors, extending its Sep 12 incomplete-read fix with finer-grained diagnostics.
Unchanged in window: K-Dense-AI/scientific-agent-skills (no commits since Sep 12, 02:09 UTC, already reported), ayghri/i-have-adhd (no commits since Sep 10, 15:48 UTC), agentskillexchange/skills (only automated sync-bot regeneration commits).
🤖 Agents & Subagents
anthropics/claude-agent-sdk-typescript
See Anthropic Official above — v0.3.270 (Sep 12) ships the git-permission regression fix.
nicobailon/pi-subagents
Lands a run of test-hardening and portability fixes — Node 24 module mocks, portable cwd-restore behavior on Windows workflow workers — through Sep 13, without a new version tag past v0.67.0.
anthropics/claude-agent-sdk-python
Stays frozen at v0.2.152 (Sep 2), now 11 days stale with no new package release despite Claude Code shipping v2.1.270.
Unchanged in window: anthropics/commerce-agents (no commits since Aug 31), VoltAgent/awesome-claude-code-subagents (no commits since Sep 7).
🔗 MCPs & Integrations
DeusData/codebase-memory-mcp
Fixes a daemon race so its userns security-guard test actually runs instead of silently skipping (#2195), and rewords a security-audit-triggering comment, continuing a dense Windows/daemon reliability push through Sep 13.
oraios/serena
Resumes active development after a quiet week, merging a language-server registry (SolidLSP) that lets externally provided LSP implementations register with the framework (Sep 12).
Unchanged in window: upstash/context7 (no commits since its already-reported Sep 11 OpenTelemetry release), ChromeDevTools/chrome-devtools-mcp (no commits since its already-reported Sep 11 fixes), github/github-mcp-server (no commits since v1.12.1, Sep 8).
💡 Community — Workflows & Ideas
agent-guardrails-kit — rounds 10 and 11 (Sep 12)
Closes an rm -rf-parent-directory bypass — deleting a protected directory's ancestor was never checked because every rule only asked "is this path inside a guarded tree," never the reverse — and documents a dozen ways git itself becomes the secret reader (git log -p, git show, git clone, tar of .git), plus MCP tool calls that carry a raw shell command instead of a file path; measured 366 executed attacks with 0 leaks and 0 false positives.
📰 Quick Mentions
- Reuters: how Anthropic says Claude was used for weapons, spying, cyber operations — Secondary coverage of the Sep 10-11 threat-intelligence report.
- Claude status: elevated errors for Mythos 5.1 and Fable 5.1 — Incident logged Sep 11 on Anthropic's status page.
- awesome-mcp-servers keeps growing — Merges new server listings (mcp-gatehouse, ToolTrace, ankusdrive) through Sep 13.
- Show HN: transferable sessions between Claude Code instances — Sep 12 pitch for moving a running Claude Code session between machines.
- Show HN: give Claude Code/Cursor a real eng team (tiers, roles, escalation) — Sep 12 role-based subagent escalation structure.