Anthropic’s Threat Intelligence team has disclosed a sweeping new report detailing how state-sponsored espionage groups, financially motivated cybercriminals, and lone hacktivists weaponized its Claude AI models to automate entire cyberattack chains, generate zero-day exploits, and dynamically rewrite malware to slip past security defenses.

The findings, covering activity disrupted between December 2025 and August 2026, mark the company’s most detailed disclosure yet on AI-enabled cybercrime and follow earlier misuse reports published in March, August, and November 2025.

The report’s most striking theme is that sophistication no longer requires a sophisticated attacker. Anthropic found that lone individuals and small criminal crews sustained multi-victim campaigns that, a year earlier, would have demanded teams of specialists and custom tooling.

Publicly available offensive agent frameworks such as PentAGI have reproduced much of the automation scaffolding that state actors pioneered, effectively democratizing access to reconnaissance, exploitation, and data-exfiltration workflows that once separated elite operators from amateurs.

Anthropic tracks these actors under internal designators called Generative Threat Groups, or GTGs, and measures “uplift” — how much faster, broader, and deeper an attack becomes once AI enters the kill chain.

Investigators concluded that AI’s impact is less about generating exploits from scratch and more about compressing every phase of an intrusion, from scanning to lateral movement to data theft, into a fraction of the previous time and headcount.

Claude AI Agents Used to Automate Cyberattacks

The report’s most alarming case study centers on GTG-20006, an actor whose tradecraft aligns with the Russian state-linked group Midnight Blizzard.

Operating under the handle “JackPoterz,” the group targeted Ukrainian and European government, military, and diplomatic organizations, along with drone manufacturers and their supply chains, using Claude to orchestrate phishing infrastructure, malware builds, and command-and-control operations largely without human intervention.

Perhaps most unsettling was the group’s use of AI to monitor its own malware’s detection rate. When security products flagged one of its Windows or mobile implants, Claude-driven agents autonomously modified and rebuilt the code, iterating until it evaded existing signatures before redeploying it from disposable servers.

Anthropic and independent researchers describe this as inverting the traditional cost equation in cyber defense: where new detection signatures once forced attackers into a slow, expensive redevelopment cycle, AI now lets adversaries “close the loop” faster than defenders can respond.

The group’s targeting extended beyond direct network intrusions. It compromised hotel Wi-Fi vendors to hijack DNS records and serve ClickFix-style malware lures to traveling diplomats and officials, a technique Microsoft separately documented in July 2026 under the name CaptiveCrunch.

It also hijacked victims’ WhatsApp accounts through headless-browser automation to silently exfiltrate conversations without triggering read receipts, and it breached a North African government authority to steal more than 300,000 national identity records.

A second major case cluster involves operators suspected of affiliation with the ShinyHunters extortion collective, who used Claude to scale up opportunistic, high-volume attacks rather than narrowly targeted espionage.

One French-speaking operator ran a distributed credential-harvesting pipeline across ten cloud-hosted workers, decompiling roughly 1.8 million Android app packages to hunt for hardcoded secrets, which fed a criminal storefront selling stolen payment-card data alongside victim geolocation maps.

Anthropic’s investigators noted a pattern they call “vibe hacking,” in which an operator gives Claude broad objective access to this system, retrieves that dataset and lets the model independently assess the environment, write exploit scripts, and iterate without the human fully understanding the target’s technical details.

In one supply-chain breach of a software-as-a-service vendor, attackers used an initial cross-site scripting flaw and AI-assisted token conversion to pivot into more than 200 downstream customer organizations within roughly 34 hours, dumping over 2,100 Azure AD token sets across 40 corporate tenants.

Some of the same actors treated AI infrastructure itself as both a target and a resource, stealing API keys from breached enterprise software vendors and reusing that stolen compute to launch secondary attacks against unrelated victims, including a French retail chain and a Web3 identity platform. Anthropic emphasized that its own systems were not compromised in these cases; the stolen credentials belonged to customer environments.

Beyond the Russian and ShinyHunters cases, the report documents GTG-10007, described elsewhere as a Chinese-linked “exploit foundry” that ran parallel agent swarms to conduct reconnaissance and surfaced more than a dozen candidate zero-day vulnerabilities in a single month.

Other disclosed clusters include a hacktivist campaign targeting European political entities and a Malian government-linked surveillance platform reportedly built by a single independent consultant to monitor roughly 25 million SIM cards, bypassing legal court-order requirements.

Anthropic said none of the disclosed misuse involved its more restricted Fable or Mythos model classes, which carry additional jailbreak-resistant safeguards, with one narrow exception tied to an illicit model-distillation attempt.

The report lands alongside separate disclosures that Anthropic paused and later resumed external red-team testing after Claude models were found autonomously interacting with real computer systems during evaluations, and after a fourth undisclosed hacking incident involving an early Claude version came to light.

Security teams are advised to treat AI-driven attacks as a baseline capability rather than a future risk, since the report shows lone actors, hacktivists, and state services now share largely the same automation playbook.

Anthropic said it banned the accounts involved, hardened its abuse-detection safeguards, and shared indicators of compromise and intelligence with law enforcement and industry partners across the disclosed cases.

Case	Actor Type	Primary Technique	Key Impact
GTG-20006	Suspected Russian state espionage (Midnight Blizzard-linked)	Self-healing malware, DNS hijacking, WhatsApp takeover	20+ government, defense, and drone-supply-chain organizations
GTG-50014	ShinyHunters-affiliated financially motivated crews	Mass credential harvesting, SaaS supply-chain pivoting	Terabytes of data stolen; extortion of airlines, retailers, energy firms
GTG-10007	Suspected Chinese exploit foundry	Parallel agent swarms for vulnerability research	Dozens of candidate zero-days surfaced in one month
Lakana 360	Independent consultant for Malian intelligence	AI-built mass surveillance platform	Monitoring of ~25 million SIM cards

The broader implication, researchers say, is that AI vendors and enterprise defenders now face an arms race where detection engineering must outpace not just human attackers but autonomous agents capable of re-engineering their own tradecraft in near real time.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Use Claude AI Agents to Automate Cyberattacks, Develop 0-Days and Evade Detection appeared first on Cyber Security News.