Anthropic says criminal and state-backed groups used its Claude models to help carry out real-world cyberattacks and other harmful operations between December 2025 and August 2026. The company’s misuse report says ShinyHunters-linked clusters used AI agents to scale data theft, including a supply-chain-style breach of a software-as-a-service provider affecting about 200 customer organizations and a dump of more than 2,100 Azure AD token sets across 40+ tenants, while Russia’s SVR-linked GTG-20006, also known as APT29 or Cozy Bear, used customized AI workflows to automate phishing, command-and-control, persistence, and exfiltration against more than 20 organizations.
Why it matters: This shows AI is no longer just assisting low-level scams but is being used to speed up serious intrusions by both extortion crews and state spies. Organizations should review cloud identity logs for suspicious token use, tighten phishing defenses, and treat AI-enabled attack automation as an active threat rather than a future risk.
Bill Toulas
2026.09.11
97% relevant
This is a direct update on the same Anthropic misuse report, adding specifics that suspected ShinyHunters actors used Claude to scan 1.8 million Android APKs for hardcoded secrets, harvest GitHub PATs and Azure AD tokens, and move from access to data theft or admin control within hours; it also expands details on Midnight Blizzard’s Claude-assisted phishing, malware, and hotel Wi-Fi/DNS hijacking activity.
2026.09.11
97% relevant
This is directly about the same Anthropic threat report, adding concrete details from the APT29 portion: more than 20 government, intelligence, diplomatic, and defense targets; compromised hotel Wi-Fi providers; targeting of Ukrainian and drone-sector entities; theft of a drone vision SDK; and Claude-assisted reverse engineering and detection evasion.
Eduard Kovacs
2026.09.11
98% relevant
This is the same underlying Anthropic threat-intelligence disclosure about misuse of Claude by Russian-linked actors. It adds concrete operational details: Anthropic links one operation to Midnight Blizzard, says Claude was used to automate malware detection evasion, describes targeting of more than 20 organizations, theft from drone suppliers, hijacking of hotel guest Wi‑Fi via DNS changes, WhatsApp companion-device compromise, and a separate Russian-speaking group’s attempts to steal a pre-release Claude model using stolen AI API keys.
2026.09.10
100% relevant
This article establishes a distinct underlying event: Anthropic’s new misuse report documenting specific criminal and state-backed operational use of Claude across multiple harm areas, including concrete cyberattack cases and scale metrics not captured by an existing tracked story.
← Back to all stories