Anthropic Claude misuse analysis of multi-agent reconnaissance, exploitation, and exfiltration
Technical Analysis
Summary
Hide ▲
Show ▼
Anthropic says Claude AI was abused by multiple threat groups, including ShinyHunters, Midnight Blizzard, and GTG-10007, for credential harvesting, reconnaissance, phishing, malware development, exploit development, and data exfiltration. The report says the activity ran from December 2025 to August 2026 and shows AI use moving beyond prompting into multi-agent automation that executed much of the workflow. In one ShinyHunters-linked case, a pipeline on 10 AWS EC2 workers mass-downloaded 1.8 million Android APKs, scanned them with TruffleHog, and routed verified secrets to Telegram. Anthropic also says the same period included abuse to obtain 2,100+ Azure AD token sets tied to 40+ Microsoft tenants and at least 1TB of stolen data.
Related Happenings
X47.c Windows botnet offering AI API-draining and credential-theft tooling
Malware Activity
H score28
First: 23.09.2026 17:00
Last: 23.09.2026 17:00
Sources 1
About this happening:
The previously undocumented x47.c Windows botnet now appears in a seller offering 18 attack methods, including an AI API drain command that can burn paid credits a...
X47.c Windows botnet offering AI API-draining and credential-theft tooling
Malware ActivityAbout this happening: The previously undocumented x47.c Windows botnet now appears in a seller offering 18 attack methods, including an AI API drain command that can burn paid credits a...
FBI employee and applicant data leak claim
Data Leak
H score84
First: 22.09.2026 22:13
Last: 22.09.2026 22:13
Sources 1
About this happening:
ShinyHunters claims it breached the FBI using a new Oracle PeopleSoft zero-day and stole data tied to current and former FBI employees and job applicants. The...
FBI employee and applicant data leak claim
Data LeakAbout this happening: ShinyHunters claims it breached the FBI using a new Oracle PeopleSoft zero-day and stole data tied to current and former FBI employees and job applicants. The...
China-based AI labs illicit Claude distillation campaign
Campaign
H score27
First: 11.09.2026 19:15
Last: 11.09.2026 19:15
Sources 1
About this happening:
A coordinated industrial-scale distillation campaign against Claude is extracting reasoning and tool-use outputs to train competing models, increasing the risk of unauthor...
China-based AI labs illicit Claude distillation campaign
CampaignAbout this happening: A coordinated industrial-scale distillation campaign against Claude is extracting reasoning and tool-use outputs to train competing models, increasing the risk of unauthor...
UNC6780 open-source software supply chain campaign targeting AI environments
Campaign
H score45
First: 08.09.2026 15:02
Last: 08.09.2026 15:02
Sources 1
About this happening:
UNC6780 is running a large-scale open-source supply-chain campaign that targets AI-assisted coding tools and software dependencies across PyPI, npm, and Docker Hub...
UNC6780 open-source software supply chain campaign targeting AI environments
CampaignAbout this happening: UNC6780 is running a large-scale open-source supply-chain campaign that targets AI-assisted coding tools and software dependencies across PyPI, npm, and Docker Hub...
AIR Security emerges from stealth with $50 million funding and AIR firewall
Commercial Activity
H score18
First: 03.09.2026 15:00
Last: 03.09.2026 15:00
Sources 1
About this happening:
AIR Security has emerged from stealth with $50 million in funding and the launch of AIR, a firewall built for AI agents. The rollout expands the market for agent s...
AIR Security emerges from stealth with $50 million funding and AIR firewall
Commercial ActivityAbout this happening: AIR Security has emerged from stealth with $50 million in funding and the launch of AIR, a firewall built for AI agents. The rollout expands the market for agent s...
Timeline
-
11.09.2026 17:29 3 articles · 13d ago
Anthropic warns Claude models are being used for cyber attacks and mass surveillance
Initial DisclosureAnthropic warned that Claude models were being used by cybercriminals and state-sponsored hackers for cyber attacks, weapons design, propaganda, and mass surveillance, and said the use of AI had gone beyond simple chatbot prompting into multi-agent frameworks executing reconnaissance, exploitation, credential harvesting, and data exfiltration.
Show sources
- Claude Used to Automate Exploitation and Data Theft Across Multiple Victims — thehackernews.com — 11.09.2026 17:29
- Claude Used to Automate Exploitation and Data Theft Across Multiple Victims — thehackernews.com — 11.09.2026 17:29
- Hackers abused Claude to extract secrets from 1.8M Android apps — www.bleepingcomputer.com — 11.09.2026 23:19