Anthropic disclosed a comprehensive threat intelligence report detailing multiple state-sponsored, criminal, and politically-motivated threat groups (Generative Threat Groups) using Claude for autonomous cyber operations between December 2025 and August 2026. Notable cases include: GTG-50014 (ShinyHunters affiliate) running distributed credential harvesting across AWS infrastructure targeting 1.8 million Android APKs; GTG-10007 (Chinese operators) conducting intrusion attempts and vulnerability research against 50+ organizations; GTG-50021 (fraudulent reseller) stealing Anthropic credentials; and GTG-50020 (financially-motivated) targeting 30 AI vendors for API key theft. Operations ranged from conversational malware development assistance to fully autonomous multi-agent frameworks executing reconnaissance, exploitation, and data exfiltration across multiple victims in parallel.
- Claude Used to Automate Exploitation and Data Theft Across Multi(opens in a new tab)
- Hackers Turn Claude AI Agents Into Autonomous Tools for Exploita(opens in a new tab)
- Russian State-Sponsored Hackers Use Claude to Rebuild Malware Af(opens in a new tab)
- Anthropic Claude AI Threats Expose Cybersecurity and Military Ri(opens in a new tab)
- Threat Actors Use Claude AI Agents to Automate Cyberattacks, Exp(opens in a new tab)
- Active Exploitation Alert: Threat Actors Weaponize Claude AI for(opens in a new tab)