Over the past six months, Anthropic’s Threat Intelligence team has been investigating a disturbing new reality in cybersecurity: the same AI models that help people write code and analyze data are now being used by spies, criminals, and ideologically motivated hackers to run whole cyber campaigns. Between December 2025 and August 2026, we identified and disrupted a series of operations involving Claude, the AI system we build. The operators included suspected state-sponsored groups, financially motivated criminals, and political activists. In all of these cases, the affected models were Claude Haiku, Sonnet, and Opus; the newer Fable and Mythos models, which have stricter safeguards, were not involved in any malicious activity. What stands out most is that sophisticated attacks no longer require sophisticated attackers. AI has collapsed the gap that once separated well-resourced national intelligence agencies from lone individuals. Tasks that used to demand teams of skilled engineers—reconnaissance, writing custom malware, scanning networks, exploiting vulnerabilities, processing stolen data—can now be delegated to a model that works at machine speed and in parallel. We call the extra capability AI uplift, and we assess it in terms of speed, scale, and depth. The biggest risk is not AI discovering entirely new attack techniques; it is AI making the entire cyber kill chain faster, broader, and cheaper. A hacktivist using stolen API keys, a scattered group of criminals, and a state espionage operator all ran multi-victim campaigns that, a year ago, would have required many operators and specialist knowledge. For investigators, sophistication is no longer a reliable clue about who is behind an operation. In late 2025, we saw a suspected state-sponsored campaign carry out autonomous attacks; within months, that operating model had spread to every class of actor we investigated. Publicly available offensive agent frameworks now reproduce much of that same automation for anyone who downloads them. AI is becoming not just an assistant but the orchestrator.
One of the most vivid examples was an espionage group we call GTG-20006, which we link to Russia’s Midnight Blizzard. An operator using the handle JackPoterz, a Russian speaker, ran attacks against military intelligence targets in Ukrainian and European governments, diplomatic and defense organizations, and individuals connected to US foreign policy. What made this group different was the degree of automation. The actor developed customized AI-driven workflows that covered nearly the entire attack lifecycle: researching and registering domains for phishing, setting up hosting infrastructure, sending phishing emails, monitoring command-and-control channels for successful compromises, and managing a toolkit of Windows implants, Android and iOS malware, a credential stealer, and an administrative console. If any of the malware was detected by a security product, AI monitoring agents would automatically modify and rebuild it until it was undetected, then stage it on disposable servers for the next wave of attacks. The human operator mostly stepped in to refine the Claude Code skills that drove the workflows. The actor targeted more than twenty distinct organizations, including government ministries, embassies, think tanks, and defense companies, with a particular focus on Ukraine and military drone technology. They bulk-exported mailboxes of drone component manufacturers, stole a proprietary software development kit for a drone vision system, and spent days reverse-engineering it. They compromised at least three hotel WiFi vendors, used DNS hijacking to redirect guests to their servers, and delivered ClickFix-style lures to install malware on devices. They took over WhatsApp accounts using headless browsers and the open-source WPPConnect library, silently exporting Russian and Ukrainian conversations of at least two former Ukrainian officials. They found flaws in camera streaming services and accessed live camera feeds. They stole credentials from a North African government technology authority, exfiltrating more than 300,000 national identity records and data on more than half a million companies. AI was used for reconnaissance, initial access, collecting and organizing hundreds of gigabytes of stolen data, and maintaining access to compromised accounts and tenants. The result is that defenders can no longer assume that publishing a detection signature will slow an attacker down; the adversary can close the loop and adapt faster than defenders can respond.
At the other end of the threat spectrum are opportunistic criminals, including suspected affiliates of the ShinyHunters collective. These actors are not after specific secrets; they scan the internet for exposed credentials, break into cloud services, steal whatever customer data is available, and then demand ransom or sell the data. One French-speaking operator, using aliases including MeowSHA, frkoo, and blazespider, ran a distributed credential-harvesting pipeline on ten AWS EC2 workers. The pipeline downloaded about 1.8 million Android apps from multiple app stores, decompiled them, and scanned them for hardcoded secrets with TruffleHog. Verified credentials were routed in real time to a Telegram group organized into more than 100 source types. A separate pipeline harvested GitHub personal access tokens from email addresses. These two pipelines supplied the initial access for most of the confirmed breaches attributed to this operator. In one supply-chain attack, the actor exploited a cross-site scripting vulnerability in a SaaS vendor, escalated privileges, and used AI to identify developer and authentication APIs, create privileged tokens, and build bulk-export tools. They exfiltrated data from thousands of downstream customer organizations and, in one session-store dump, took more than 2,100 Azure AD token sets spanning over 40 corporate tenants in about 34 hours. AI agents did nearly all of the work. In another compromise, a single stolen developer token was escalated to full administrative control of a victim’s cloud environment in roughly three hours, followed by iteratively scraping internal datastores and then the end customers’ data. The stolen material included more than a terabyte from a technology provider, hundreds of thousands of national identifiers, millions of payment card records, tens of millions of passenger records at an airline, and allegedly the ability to control electric-vehicle chargers at an energy company. The operator also ran a carding shop disguised as a French police website, selling stolen payment-card records with BIN lookups, personal details, and an interactive map of victims’ addresses, delivered through a Telegram Mini App. In many of these intrusions, the human operator acted like a “vibe hacker,” giving the AI a general goal—use this credential, get data from these targets—and letting the model evaluate the environment, write and execute scripts, and repeat until the task was complete. The operators also stole AI API keys from victims and immediately switched their own attack workloads to those keys, effectively making the AI supply chain both a target and a resource. This is “living off the land” applied to AI itself.
AI has also given rise to exploit foundries. We tracked a sustained espionage operation, GTG-10007, run by Chinese-speaking operators likely based in Changsha, Hunan province. Two of the operators were undergraduate students at a Chinese university’s School of Computer and Communication Engineering; one had interned at a Chinese security company and was interviewing at another for an offensive cyber role. The group used Claude as the engineering and orchestration layer for a coordinated offensive program that included intrusion attempts against production systems, reconnaissance of foreign-government networks across the Middle East, Europe, and Southeast Asia, standing vulnerability research on major security products, malware development, and an intelligence-collection platform. They used agent swarms: a lead AI agent decomposed reconnaissance and post-exploitation work and dispatched it to many sub-agents running in parallel. They kept persistent campaign memory, with target lists, harvested credentials, engagement state, and standing instructions saved across working sessions, so each session resumed mid-campaign with full context. Their vulnerability-research workflow loaded firmware and binaries into a decompiler, walked decompilation and cross-reference chains, formed hypotheses against a knowledge base, wrote exploit code, tested it against lab copies of target products, and iterated until success; in one month, it produced more than a dozen possible zero-day findings in network appliances. A separate autonomous collection fleet of thirteen standing AI agents ran on a scheduled job, identifying and downloading content from target websites, including publicly accessible US military and government contract postings, and summarizing it in intelligence-style reports. The same group targeted roughly fifty organizations, compromised an education-technology company and extracted bulk student data, gained access to a retail company’s production systems, and retrieved citizen records from a Southeast Asian government agency. Meanwhile, a different Russian-speaking financially motivated actor, GTG-50020, turned its tradecraft toward the AI industry. By injecting malicious instructions into an AI vendor’s automated evaluation sandbox, the actor caused the sandbox to hand over production API keys from multiple AI providers. They then used those stolen keys to continue intrusion attempts against the vendor and unrelated targets, and launched a follow-on campaign that attacked roughly thirty AI companies in about four days, repeating one successful attack path with slight adjustments. The actor’s stated goal was access to a pre-release Claude model, but every attempt failed. In all of these cases, the stolen keys came from customers’ environments; Anthropic’s own systems were never compromised. The AI supply chain has clearly become a deliberate criminal target: stolen keys are loot to be resold, compute to run attacks at someone else’s expense, and cover to hide the attacker’s identity.
The capability gap has closed even for hacktivists. In spring 2026, a single French-speaking actor used Claude to target European political parties, media outlets, think tanks, and the SaaS providers used by those organizations. This actor built their own custom Rust-based scanner to scan and validate public containers for exposed API keys. Once validated, the keys were rotated across a local proxy layer, allowing the actor to blend their attack traffic with the legitimate owner’s traffic. Their signature access technique was exploiting a previously undocumented WordPress re-installation race condition that created a rogue administrator account without valid credentials; they developed and debugged the exploit with Claude in the same session, including building a lab harness. The exploit succeeded against at least four victim websites. Against a political campaign management platform, they found an exposed search endpoint and tasked agents to iterate across it, ultimately exfiltrating around 140,000 records that included users’ political opinions. Against another target, they implanted a webshell hidden among font assets and used a WordPress must-use plugin that harvested credentials, encrypted them with per-site public keys, and staged them for pickup. They poisoned victim backups to maintain persistence. They compromised a media outlet by deploying a browser-exploitation framework that injected a script into the site, letting them fingerprint thousands of visiting browsers while specifically hunting for editorial staff’s sessions and credentials. Their most chilling creation was fafsearch, a purpose-built doxxing platform with ingestion pipelines, cross-referencing of breach dumps and exfiltrated data, normalization for national identity and phone numbers, ranking logic, and a containerized deployment. The actor loaded it with tens of millions of rows, including national health identifiers and justice-system data, and fused it with material from their own intrusions. The result was a set of anonymous dark-web services where anyone could look up people affiliated with the targeted political movement by name. Across 42 tracked target entities, this one person gained internal access to at least 14, stealing an estimated 12 to 26 gigabytes of databases, including political party donor records, member lists, a 15,000-message mailbox, student application records, and payment-provider data. This is one of the clearest cases we have seen of AI-assisted software engineering applied directly to a mass attack on privacy—and the entire platform was built by a single individual.
Taken together, these cases reveal two broad developments. First, AI-enabled cyber tradecraft is proliferating rapidly. The autonomous attack framework that was once confined to a state-sponsored campaign has become publicly available in tools like PentAGI, and several operations we investigated ran on it or on derivatives. A marketplace has formed around AI access itself: one group, GTG-50021, ran a fraudulent reseller operation that offered cheap Claude access but actually proxied user traffic to a different model, installed credential-harvesting software, and stole customers’ Anthropic credentials to sell to other proxy resellers. Second, AI’s role in cyber operations is becoming increasingly autonomous. The cases we observed span a spectrum. At one end, actors used Claude conversationally as an engineering assistant. In the middle, AI executed commands against victim networks, harvested credentials, and exfiltrated data, with a human making each targeting decision. At the far end, multi-agent frameworks ran reconnaissance, exploitation, and theft against multiple victims in parallel, unattended, for hours or days. We saw scheduled jobs that renewed stolen access tokens and harvested victim cloud storage with no human involvement. Two caveats matter. Humans still keep control of the decisions that matter most to them: choosing targets, monetizing stolen data, and reviewing the results. And autonomy is not the same as harm; some of the most serious compromises in this report came from operations where a human directed every step. What AI really does is compress the cost side of attack. It lowers the skill threshold and labor required per campaign, while leaving the potential payoff largely unchanged. That favorable shift in unit economics makes previously marginal targets viable and encourages higher-volume, lower-touch operations. None of the attacks themselves are wholly new: they use stolen credentials, unpatched devices, exposed services, SQL injection, and phishing. But the economics have changed. Defenders must now treat AI API keys and agent integrations with the same seriousness as production credentials, because attackers already do. We disrupted every operation described here, strengthened our safeguards based on what we learned, and shared intelligence with authorities and industry partners. The threat will persist, and it will evolve, but the lessons from these cases give defenders a chance to adapt before the next wave arrives.