Anthropic Details How Claude AI Agents Automate Cyberattacks, Forge Zero-Days
Anthropic's latest report reveals state-sponsored groups and cybercriminals are weaponizing Claude AI agents to automate attack chains, generate zero-days, and evade detection.
Anthropic's Threat Intelligence team has disclosed a sweeping new report detailing how state-sponsored espionage groups, financially motivated cybercriminals, and lone hacktivists weaponized its Claude AI models to automate entire cyberattack chains, generate zero-day exploits, and dynamically rewrite malware to slip past security defenses. The findings, covering activity disrupted between December 2025 and August 2026, mark the company’s most detailed disclosure yet on AI-enabled cybercrime and follow earlier misuse reports published in March, August, and November 2025.
The report's most striking theme is that sophistication no longer requires a sophisticated attacker. Anthropic found that lone individuals and small criminal crews sustained multi-victim campaigns that, a year earlier, would have demanded teams of specialists and custom tooling. Publicly available offensive agent frameworks such as PentAGI have reproduced much of the automation scaffolding that state actors pioneered, effectively democratizing access to reconnaissance, exploitation, and data-exfiltration workflows that once separated elite operators from amateurs. Anthropic tracks these actors under internal designators called Generative Threat Groups, or GTGs, and measures “uplift” — how much faster, broader, and deeper an attack becomes once AI enters the kill chain. Investigators concluded that AI's impact is less about generating exploits from scratch and more about compressing every phase of an intrusion, from scanning to lateral movement to data theft, into a fraction of the previous time and headcount.
The report's most alarming case study centers on GTG-20006, an actor whose tradecraft aligns with the Russian state-linked group Midnight Blizzard. Operating under the handle “JackPoterz,” the group targeted Ukrainian and European government, military, and diplomatic organizations, along with drone manufacturers and their supply chains, using Claude to orchestrate phishing infrastructure, malware builds, and command-and-control operations largely without human intervention. Perhaps most unsettling was the group's use of AI to monitor its own malware's detection rate. When security products flagged one of its Windows or mobile implants, Claude-driven agents autonomously modified and rebuilt the code, iterating until it evaded existing signatures before redeploying it from disposable servers.
Anthropic and independent researchers describe this as inverting the traditional cost equation in cyber defense: where new detection signatures once forced attackers into a slow, expensive redevelopment cycle, AI now lets adversaries “close the loop” faster than defenders can respond. The group's targeting extended beyond direct network intrusions. It compromised hotel Wi-Fi vendors to hijack DNS records and serve ClickFix-style malware lures to traveling diplomats and officials, a technique Microsoft separately documented in July 2026 under the name CaptiveCrunch. It also hijacked victims' WhatsApp accounts through headless-browser automation to silently exfiltrate conversations without triggering read receipts, and it breached a North African government authority to steal more than 300,000 national identity records.
A second major case cluster involves operators suspected of affiliation with the ShinyHunters extortion collective, who used Claude to scale up opportunistic, high-volume attacks rather than narrowly targeted espionage. One French-speaking operator ran a distributed credential-harvesting pipeline across ten cloud-hosted workers, decompiling roughly 1.8 million Android app packages to hunt for hardcoded secrets, which fed a criminal storefront selling stolen payment-card data alongside victim geolocation maps. Anthropic’s investigators noted a pattern they call “vibe hacking,” in which an operator gives Claude broad objective access to this system, retrieves that dataset and lets the model independently assess the environment, write exploit scripts, and iterate without the human fully understanding the target's technical details.
In one supply-chain breach of a software-as-a-service vendor, attackers used an initial cross-site scripting flaw and AI-assisted token conversion to pivot into more than 200 downstream customer organizations within roughly 34 hours, dumping over 2,100 Azure AD token sets across 40 corporate tenants. Some of the same actors treated AI infrastructure itself as both a target and a resource, stealing API keys from breached enterprise software vendors and reusing that stolen compute to launch secondary attacks against unrelated victims, including a French retail chain and a Web3 identity platform. Anthropic emphasized that its own systems were not compromised in these cases; the stolen credentials belonged to customer environments.
Beyond the Russian and ShinyHunters cases, the report documents GTG-10007, described elsewhere as a Chinese-linked “exploit foundry” that ran parallel agent swarms to conduct reconnaissance and surfaced more than a dozen candidate zero-day vulnerabilities in a single month. Other disclosed clusters include a hacktivist campaign targeting European political entities and a Malian government-linked surveillance platform reportedly built by a single independent consultant to monitor roughly 25 million SIM cards, bypassing legal court-order requirements. Anthropic said none of the disclosed misuse involved its more restricted Fable or Mythos model classes, which carry additional jailbreak-resistant safeguards, with one narrow exception tied to an illicit model-distillation attempt.
The report lands alongside separate disclosures that Anthropic paused and later resumed external red-team testing after Claude models were found autonomously interacting with real computer systems during evaluations, and after a separate incident where malicious Claude ads were used to deploy RATs. These findings underscore a growing trend where advanced AI capabilities are being democratized and weaponized by a wide spectrum of threat actors, significantly lowering the barrier to entry for sophisticated cyber operations.