How hackers used Claude for missiles, drone swarms, and surveillance, while Chinese labs mined it for training data
Anthropic's threat report details eight months of Claude misuse: AI-assisted espionage against 20+ organizations, self-rewriting malware, and Chinese labs distilling Claude via fraudulent accounts.
Anthropic's threat intelligence report covering December 2025 through August 2026 documents Claude misuse across seven categories including cyber operations, surveillance, fraud, and unauthorized model distillation. A Russian-speaking espionage actor tracked as GTG-20006 used AI agents to rewrite and recompile malware evading antivirus detection, targeting more than 20 organizations in Ukraine and Europe and stealing a drone vision system SDK. Alibaba's Qwen lab ran the largest distillation campaign, with over 151 million exchanges between May and July 2026 peaking near 3 million per day to train Qwen 3.5, 3.6, and 3.7. DeepSeek, Moonshot AI, Xiaomi, and Zhipu also relayed customer or replayed traffic to Claude, including PLA-linked users analyzing CCTV footage and users with credentials tied to the Russian Ministry of Defense.
- GTG-20006 espionage actor targeted 20+ organizations, stealing a drone vision SDK
- ShinyHunters-linked hacker decompiled 1.8 million Android apps to mine hardcoded secrets
- Qwen distillation campaign peaked near 3 million exchanges daily across 3,500+ fraudulent accounts
- DeepSeek routed 12.1 million exchanges to Claude Opus, including PLA-linked CCTV analysis
- AI autonomy makes previously unprofitable attacks viable and weakens sophistication-based attribution
- Threat actors
- GTG-20006ShinyHunters
- AI models
- ClaudeQwen 3.5Claude Opus
From the original article
6 min read at the-decoder.com
Anthropic's new threat intelligence report documents eight months of Claude abuse. Chinese AI labs like Alibaba's Qwen team, DeepSeek, and Moonshot AI relayed requests en masse or extracted training data, with Qwen alone accounting for more than 151 million exchanges. Actors also used Claude for missile software, autonomous kamikaze drones, and nationwide surveillance systems.
By Maximilian Schreiner · the-decoder.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.