Anthropic: Threat Actors Abused Claude for Cyberattacks

Anthropic says cybercriminals and state-sponsored hackers abused its Claude models for cyberattacks, weapons research, propaganda, and surveillance between December 2025 and August 2026, in some cases running autonomous multi-agent frameworks that carried out reconnaissance, exploitation, and data theft against multiple victims at once. The disclosure comes from Anthropic's own 154-page threat report, which groups the abusers into what it calls Generative Threat Groups (GTGs) spanning state actors, financially motivated criminals, spyware vendors, propaganda institutions, and lone operators. The company says it detected and disrupted the activity.

Anthropic's central warning is about capability, not a single incident: "AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators." Rather than simple chatbot questions, the abuse involved multi-agent frameworks executing reconnaissance, exploitation, and exfiltration. Anthropic describes a spectrum, from Claude used conversationally as an engineering assistant for malware and phishing kits, through operator-directed use where a human approved each target, to fully autonomous operations running for hours or days with minimal supervision.

One highlighted case is a Russian state-sponsored actor Anthropic tracks as GTG-20006, whose tradecraft overlaps with the APT known as Midnight Blizzard, APT29, or Cozy Bear, and which built an AI-assisted workflow to run commands against victim networks, harvest credentials, and exfiltrate data. At the autonomous end, groups tracked as GTG-50014, GTG-50020, and GTG-50029 ran multi-agent operations against multiple victims in parallel. Anthropic said it also disrupted influence operations that used Claude as a content creator, and stressed none gained authentic engagement before takedown.

What does AI-enabled attack automation actually change?

It changes the economics of offense. The skills that once required a funded team, chaining reconnaissance to exploitation to exfiltration across many targets, can now be orchestrated by agents, letting a small operator run at a scale and speed previously reserved for nation-states. That does not create new categories of attack so much as remove the cost and headcount barriers to running existing ones broadly and continuously.

How should defenders respond to agentic threats?

By assuming faster, broader, and more automated attacks, and by verifying defenses continuously rather than periodically. If an adversary can run reconnaissance and exploitation against many targets in parallel for days, then annual or point-in-time testing leaves long windows uncovered. The practical response is continuous, adversary-style testing of your own exposure, tight monitoring of credential use and data egress, and treating any internet-reachable weakness as something an automated agent will find quickly.

Our read

Anthropic's report is useful less as a list of incidents than as confirmation of a trend defenders already feared: the labor gap that separated elite offense from everyone else is closing, and agentic frameworks let attackers run the full kill chain in parallel and around the clock. The takeaway is not that any one model is uniquely dangerous, it is that speed and scale of offense are rising for everyone. The defensible answer is continuous verification, assuming an automated adversary will probe your exposure constantly, and testing whether your controls actually stop the recon-to-exfiltration path before a real agent does.

Reporting by The Hacker News and The Record; figures and group designations per Anthropic's threat report. Sources linked above.

Related: What is MCP security? and What is prompt injection?.