Anthropic Warns AI Agents Can Now Automate the Entire Cyber Kill Chain

Anthropic has warned that attackers use AI agents to automate every stage of a cyberattack, from finding targets and stealing credentials to moving through networks and exfiltrating data.

Its September 2026 threat report describes campaigns in which Claude became an active part of attack operations, rather than simply helping hackers write code.

The findings cover activity disrupted between December 2025 and August 2026. Anthropic said suspected state-backed groups, criminals, and individual hacktivists used Claude Haiku, Sonnet, and Opus models. Across these cases, AI reduced the time, staff, and technical knowledge needed to attack multiple victims.

According to Anthropic’s threat intelligence report, publicly available agent frameworks can now automate each step of the cyber kill chain.

These systems connect AI models with tools that scan systems, test weaknesses, run commands, and process stolen information. Human operators still choose targets and review results, but agents increasingly handle the work between those decisions. This builds on the earlier AI-led cyber espionage campaign reported in November 2025.

Anthropic now says similar methods have spread beyond suspected state-backed hackers to smaller criminal groups and lone operators. Frameworks such as PentAGI provide reusable systems for coordinating agents, making these workflows easier to adopt.

Anthropic Warns AI Agents

One case involves GTG-20006, a group whose activity Anthropic says is consistent with public reporting on Midnight Blizzard. The actor targeted Ukrainian and European government, military, diplomatic, and defense organizations, with particular interest in drone technology and its suppliers.

Its AI workflows supported phishing infrastructure, credential theft, command-and-control systems, and data collection. Agents also monitored whether security products detected deployed malware. When detection occurred, the workflow modified and rebuilt the tools, retested them, and prepared updated versions for deployment.

That feedback loop could weaken defenses based only on known malware signatures. Rather than waiting for developers to rewrite a detected tool, attackers can delegate repeated changes to agents. Anthropic cautioned that this may let capable groups bypass detections faster than defenders can create and deploy replacements.

Another cluster, tracked as GTG-50014, involved suspected ShinyHunters affiliates. One operator ran a credential-harvesting pipeline across 10 AWS EC2 workers, downloading 1.8 million Android application packages and scanning them for exposed secrets. The operator sent verified findings to Telegram for further use.

In another intrusion, attackers dumped more than 2,100 Azure AD token sets across over 40 corporate tenants in about 34 hours. Anthropic said AI agents performed nearly all the work. These cases show how stolen access can quickly expand into data theft across customers of a compromised software provider.

Anthropic stressed that automation does not mean attackers have removed people from campaigns. Humans remain involved in target selection, reviewing stolen material, and turning access into profit. Greater autonomy also does not automatically mean greater harm. Some serious breaches involved human direction at every step.

The company banned linked accounts, strengthened safeguards, and shared intelligence where appropriate. Its warning also highlights AI credentials as valuable targets.

Stolen API keys can fund further attacks at victims’ expense, so protecting them is as important as other production credentials. Anthropic said the customer-key thefts described did not compromise its own systems.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.