Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data
Anthropic reports state-linked and criminal actors used Claude AI agents to automate espionage, extortion, and exploit development, stealing 300,000+ identity records and drone IP.
Anthropic's threat report details AI-driven campaigns disrupted between December 2025 and August 2026, including suspected Russian cluster GTG-20006, which targeted Ukrainian and European governments, defense firms, and drone supply chains using fully automated attack chains. The group stole over 300,000 national identity records and commercial-registry data on 500,000+ companies from a North African government technology authority, plus a proprietary drone-vision SDK. Suspected ShinyHunters affiliates decompiled 1.8 million Android APKs on 10 Amazon EC2 workers to find hardcoded secrets and abused stolen AI API keys, while the Chinese-speaking GTG-10007 cluster generated over a dozen potential zero-day findings against network appliances in one month.
- GTG-20006, a suspected Russian state-linked cluster, automated the full attack chain with Claude agents against European and Ukrainian targets.
- AI workflows rebuilt and redeployed malware after detection, sharply compressing defenders' detection-to-evasion window.
- ShinyHunters-linked actors decompiled 1.8 million APKs on EC2 to hunt hardcoded secrets and stole AI API keys.
- GTG-10007 operators automated vulnerability research, producing a dozen potential zero-day findings against network appliances in a month.
- Anthropic urges treating AI API keys, tokens, and agent integrations as production-grade secrets with least privilege.
- ATT&CK
- T1566 PhishingT1555 Credentials from Password StoresT1114.002 Remote Email CollectionT1041 Exfiltration Over C2 ChannelT1552.001 Credentials In Files
- Vendors
- AnthropicAmazon EC2
- Products
- Claude
- Threat actors
- GTG-20006GTG-10007ShinyHunters
- Organizations
- Anthropic
- AI models
- Claude
From the original article
3 min read at gbhackers.com
Threat actors are increasingly using Claude-based AI workflows to automate cyberattacks, accelerate data theft, and reduce the technical expertise needed to run complex intrusions. Anthropic’s report details cyber espionage, financially motivated extortion, supply-chain compromise, and hacktivist activity disrupted between December 2025 and August 2026.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.