Anthropic says AI ran most malicious Claude operations it stopped

Anthropic published its September 2026 threat intelligence report on Wednesday, covering malicious Claude use it detected from December 2025 through August 2026. The report says "a majority of the operations described in this report were enabled by AI via direct execution or orchestration", and lists specific state, criminal and hacktivist groups it disrupted across cyber attacks, influence operations, surveillance, fraud and model theft.

The groups Anthropic names

Anthropic tracks the actors by internal labels. GTG-20006, "consistent with public reporting linking the actor to Midnight Blizzard", is a Russian espionage group that attacked more than 20 organizations including the Ukrainian government, its military and drone manufacturers. It also used Claude to monitor how well its own malware families evaded known security tools. GTG-10007, a Chinese group doing vulnerability research, targeted about 50 organizations across education, retail, energy, technology, healthcare, finance, manufacturing and government. GTG-50014, described as associates of the ShinyHunters criminal group, ran breaches at airlines, energy companies and SaaS providers and exfiltrated more than one terabyte of data. A French-speaking hacktivist tracked as GTG-50029 attacked 42 organizations and successfully accessed at least 14 of them.

The report also names nine separate influence operations, from Russia, Iran, Turkey, Gulf states, South Asia, Africa and Europe.

What the operators are doing differently

The pattern Anthropic highlights is that operators now give Claude general goals and let it decide what to do next. In the ShinyHunters case, that meant telling the model to use a stolen credential and copy data from a large set of targets, then letting Claude "evaluate the environment, author and execute scripts". The report calls this "vibe hacking", after the coding term.

One workflow inside the Chinese vulnerability-research group produced "more than a dozen possible zero day findings" a month. Device code phishing, in which an attacker abuses legitimate cloud-email sign-in flows to intercept tokens, is called out as a technique spreading across otherwise unrelated actors.

AI companies themselves are now direct targets. The report warns of malicious actors "constantly mining these sources for exposed keys and analyzing them for authentication abuse vectors", and describes one Russian financial-crime group, GTG-50020, that attacked about 30 AI companies in four days.

By model, Claude Haiku, Sonnet and Opus are the ones the malicious accounts used. Claude Fable and Mythos "showed no malicious activity" in the tracked cases, with one attempt to copy a model as the exception.

For a team that releases software, the practical point is this: the number of attacks a group could run used to be limited by how many skilled operators it could hire. When one operator can give a general goal to Claude and get back vulnerability leads or scripts that copy data out, that limit goes up. An API key checked into a public repo, or an old device-code login prompt, gets found and used faster than before, and by more people at once. Replace the keys that were exposed on the internet, put a rate limit on device-code flows, and assume any credential path a person could work through can now be tried by a machine, at machine speed.

Source

Anthropic: Detecting and countering misuse of AI, September 2026.