Anthropic says most malicious Claude use it caught this year ran with the AI in direct control of the attack

Anthropic published its September 2026 threat intelligence report on Wednesday, covering malicious Claude use it detected from December 2025 through August 2026. The report says "a majority of the operations described in this report were enabled by AI via direct execution or orchestration", and lists specific state, criminal and hacktivist groups it disrupted across cyber attacks, influence operations, surveillance, fraud and model theft.

The groups Anthropic names

Anthropic tracks the actors by internal labels. GTG-20006, "consistent with public reporting linking the actor to Midnight Blizzard", is a Russian espionage group that hit more than 20 organizations including the Ukrainian government, its military and drone manufacturers. It also used Claude to monitor how well its own malware families evaded known security tools. GTG-10007, a Chinese group doing vulnerability research, targeted about 50 organizations across education, retail, energy, technology, healthcare, finance, manufacturing and government. GTG-50014, described as associates of the ShinyHunters criminal group, ran breaches at airlines, energy companies and SaaS providers and exfiltrated more than one terabyte of data. A French-speaking hacktivist tracked as GTG-50029 attacked 42 organizations and successfully accessed at least 14 of them.

The report also names nine separate influence operations, from Russia, Iran, Turkey, Gulf states, South Asia, Africa and Europe.

What the operators are doing differently

The pattern Anthropic highlights is that operators now give Claude general goals and let it decide what to do next. In the ShinyHunters case, that meant telling the model to use a stolen credential and pull data from a broad target set, then letting Claude "evaluate the environment, author and execute scripts". The report calls this "vibe hacking", after the coding term.

One workflow inside the Chinese vulnerability-research group produced "more than a dozen possible zero day findings" a month. Device code phishing, in which an attacker abuses legitimate cloud-email sign-in flows to intercept tokens, is called out as a technique spreading across otherwise unrelated actors.

AI companies themselves are now direct targets. The report warns of malicious actors "constantly mining these sources for exposed keys and analyzing them for authentication abuse vectors", and describes one Russian financial-crime group, GTG-50020, that attacked about 30 AI companies in four days.

By model, Claude Haiku, Sonnet and Opus are the ones the malicious accounts used. Claude Fable and Mythos "showed no malicious activity" in the tracked cases, with one attempt to copy a model as the exception.

For a team shipping software, the practical read is that the security ceiling used to be set by how many skilled operators a group could staff. When one operator can hand a general objective to Claude and get vulnerability leads or exfiltration scripts back, that ceiling moves. An API key checked into a public repo, or a stale device-code login prompt, gets found and used faster than before, and by more people at once. Rotate the keys that hit the internet, put a rate limit on device-code flows, and assume any credential path a person could work through can now be walked at machine speed.

Source

Anthropic: Detecting and countering misuse of AI, September 2026.