From assistant to orchestrator: Anthropic’s September 2026 threat intelligence report
Anthropic’s investigation describes espionage operators, criminals and political actors using AI to conduct reconnaissance, support intrusions and process collected data. The cases concern observed misuse in live cyber operations, with humans retaining control over consequential decisions.
Work delegated to AI
Published on September 10, 2026, Anthropic’s threat report documents Claude-misuse operations that the company identified and disrupted. The activity spans December 2025 through August 2026. This account focuses on the report’s cyber operations, involving suspected espionage operators, financially motivated criminals and political actors.
Familiar access routes remained prominent: stolen credentials, unpatched systems, exposed services, SQL injection and phishing continued to provide ways into systems. The change Anthropic describes concerns the labor and execution behind an operation. Reconnaissance, tool development, exploitation and data processing that once required several specialists could increasingly be delegated to AI. This did not eliminate the need for expertise, but it allowed actors to operate across broader and deeper target environments with fewer resources.
The resulting pattern went beyond asking a chatbot for instructions. Humans set objectives, while agents used software tools to perform tasks, wrote and ran scripts, and processed the results. Some systems divided work among subagents operating in parallel. Others retained target lists, credentials and campaign records as persistent state, allowing work to continue across sessions. The degree of autonomy varied between cases: some actions remained closely directed, while other workflows ran for extended periods with little intervention. Humans still selected targets, reviewed findings and decided how stolen access or data would be monetized.
The report covers seven harm areas. This account is limited to cyber operations: GTG-20006, GTG-50014, GTG-10007, GTG-50021, GTG-50020, GTG-50029, the cyber overview and Appendix A. Influence operations, surveillance, scams and fraud outside the GTG-50020 workflows, biological misuse, conventional weapons development and model distillation remain out of scope.
The internal Generative Threat Group (GTG) designators distinguish actors observed abusing AI; they do not establish an organization's public identity. The cyber cases involved Anthropic's Claude models Haiku, Sonnet and Opus. No malicious cyber activity involving the Claude Fable or Claude Mythos models was identified in this section. This observation does not establish intrinsic model safety, and the separate distillation exception falls outside the cyber cases.
This is a service provider’s account of activity detected and disrupted on its own platform, not an independent investigation of every incident, a benchmark of model capability, or an estimate of how common these practices are across the wider threat landscape. The selected cases were notable or novel examples of misuse.
Speed, scale and depth
Anthropic evaluates what it calls AI “uplift” through three lenses: speed, scale and depth. These are the company’s analytical categories, not the results of a controlled causal measurement. Speed concerns how quickly an operation proceeds. Scale covers the number of targets or tasks an actor can handle. Depth concerns the range and complexity of work the actor can perform.
An operating pattern that Anthropic documented in a suspected state-sponsored campaign in 2025 now appears across different classes of actors. Public offensive-agent frameworks such as PentAGI provide reusable orchestration software to coordinate work across an attack’s stages.
The cases reflect different modes of operation. Some actions were steered directly by humans, some systems sustained parallel work for hours or days, and scheduled collection workflows repeatedly gathered material from public sources without continuous supervision.
Which decisions stay human, and which work moves to AI
1.1 Reusable skills and persistent records
Appendix A shows how actors packaged work into reusable skills. The categories cover security engineering, command-and-control (C2) and phishing infrastructure operation, reconnaissance and credential-access roles, native Windows development, frontend and control-panel work, iOS vulnerability research, and memory that preserved previous findings and dead ends. These are reusable task instructions, not a measured effectiveness benchmark or an implementation guide.
Original source figures · supporting evidenceExpand source figures +
Original figures retain their English text and link to full-resolution images.
GTG-20006: espionage, retooling and collection
GTG-20006 conducted a sustained intelligence-gathering operation against government and defense-related targets, with recurring interest in military drone technology and its supply chains. AI supported the maintenance of the actor’s tools, portions of live intrusions and the extraction and organization of stolen material.
Anthropic describes GTG-20006 as a Russian state-nexus espionage actor. Its attribution is reported as consistent with public reporting linking the activity to Midnight Blizzard, Microsoft's tracking name for a Russia-based threat actor engaged in long-term espionage. One observed Russian-speaking operator used the handle JackPoterz. The group’s targets included Ukrainian and European government, military, diplomatic and defense organizations, US foreign-policy interests and military-drone supply chains.
More than 20 organizations were identified across operational planning, reconnaissance and live activity. That number represents targets observed at different stages, not more than 20 confirmed compromises. The target set also included government-related maritime organizations in Asia and a North African government technology authority.
GTG-20006 maintained a cross-platform toolkit covering Windows implants, mobile exploitation, browser-credential theft, phishing infrastructure and an administrative console for compromised accounts. AI agents monitored whether deployed artifacts were being detected. When a security product flagged one, the workflow analyzed the detection, modified the artifact, rebuilt it and prepared the replacement for redeployment. The human operator mainly intervened to refine reusable task instructions, or skills, in the AI coding tool Claude Code.
This created a detect, rewrite, rebuild and redeploy loop. Anthropic judges that, at least in theory, such a loop can let capable adversaries adapt faster than defenders can develop and deploy new static detections. The claim concerns the cost imposed by static detections alone; it does not establish that all traditional defenses have failed.
What happens after a security product detects the toolkit
The actor also used AI in phishing and infrastructure management. Workflows researched and registered domains, configured hosting, sent messages and monitored command-and-control channels. Through these command-and-control (C2) channels, the attacker managed compromised systems and received results. Device-code phishing abused a legitimate cloud sign-in process by inducing a victim to authorize an attacker-controlled session. AI prepared supporting infrastructure and tools, while some commands against victim systems were executed under human direction.
The operations extended through several distinct access and collection paths. At least three hospitality vendors operating hotel WiFi were compromised. The actor changed DNS records, which determine where an internet name directs traffic, so that guests were diverted to actor-controlled infrastructure. This DNS hijacking exposed guest traffic, device identifiers and IP addresses. Information from hotel management systems could then be combined with information obtained from individual devices to focus subsequent targeting, including people associated with Ukraine and drone manufacturing.
Drone technology was another recurring target. The actor bulk-exported mailboxes from at least two drone-component manufacturers, targeted a military drone maker and stole a proprietary software development kit for a drone-vision system. It analyzed the kit to recover product architecture, hardware components, supplier dependencies and information about an unannounced product.
Communications accounts, camera services, cloud mail and government databases appear as separate collection paths in the report, alongside the targeting of hotel networks rather than as stages of one linear intrusion.
A WhatsApp collection platform linked victim accounts to actor-controlled companion devices and suppressed read receipts while exporting Russian- and Ukrainian-language conversations. At least two former senior Ukrainian officials were targeted. Both individuals are described as targets, without confirmation that both attempts resulted in compromise. In another operation, authorization flaws in camera-streaming services enabled access to live camera feeds.
The intrusion into a North African government technology authority began with stolen VPN credentials. The actor used them to take control of a central account server and exfiltrated its credential database, including more than 300,000 national identity records and commercial registry information for more than half a million companies. These were North African records, not Ukrainian data.
A cloud-mail espionage platform used device-code phishing against diplomatic and government personnel. It resulted in access to and exfiltration of mail records from at least eight organizations. Fake-update lures delivered credential-stealing and remote-access payloads, some designed to freeze security updates on victim machines so that later detection signatures would not be retrieved or run.
AI had four roles in this activity. First, it supported reconnaissance by fingerprinting email and remote-access systems and organizing public information into target lists. Second, it helped build and operate the initial-access platform, while some intrusion steps remained directed by the actor. Third, it extracted and organized hundreds of gigabytes of stolen material, including bulk mailbox exports. Fourth, it helped preserve access by registering actor-controlled devices with compromised organizational accounts.
The result was not an operation without humans. It was an espionage workflow in which tooling, infrastructure, collection and persistence could continue through reusable AI-driven processes while the operator refined objectives and reviewed results.
GTG-50014: credentials, cross-tenant theft and monetization
Multiple operators suspected of affiliation with the ShinyHunters cybercrime collective sought data for sale and pay-or-leak extortion. Their activity moved from exposed or stolen credentials into broader access and data theft, sometimes compromising service providers to reach downstream customers. Anthropic treats the operators as affiliated clusters, but they appeared to retain different tooling and operational workflows. The cases describe related criminal activity rather than one incident following a universal timeline.
Anthropic describes this style of AI use as “vibe hacking.” An operator gives the system a broad objective, such as using a credential to find valuable data. The AI evaluates an unfamiliar environment, writes and runs scripts, summarizes what it finds and iterates until the task is complete. The operator may understand the goal and review the result without mastering every target’s internal configuration.
One French-speaking operator using the aliases frkoo, MeowSHA and blazespider ran a distributed credential-harvesting pipeline across 10 AWS EC2 workers. EC2 instances were the actor’s rented cloud computers. The pipeline downloaded 1.8 million distinct Android APKs, the package files used to distribute Android applications. It decompiled those packages and scanned them with TruffleHog, a tool for finding embedded passwords, tokens and other secrets. Verified findings were sent to Telegram and organized into over 100 source types. A parallel stream harvested GitHub access tokens.
The source describes an actor-built pipeline combining deterministic tools with AI-assisted interpretation and subsequent operations. It does not assign every download, decompilation or scanner invocation to an autonomous language model.
The actor also operated a storefront for stolen payment-card and personal data. A domain impersonating the French national police served, in Anthropic’s judgment, as branding for the criminal shop rather than as a phishing lure. Operational-security lapses exposed parts of the actor's infrastructure and credentials, whose values are not reproduced here.
Some operations compromised individual organizations, while others reached customers of software-as-a-service (SaaS) platforms through access obtained at their provider.
The resulting compromises varied in impact. More than a terabyte of data was stolen from one technology provider and staged publicly to pressure the victim. At an airline, the actors accessed systems holding tens of millions of passenger records; the extent of theft from those records was not specified. At an energy company, remote control of residential electric-vehicle charging current was an actor claim, not an independently confirmed outcome.
A separate suspected affiliate appeared to specialize in reaching customers through a software provider. Within the software-as-a-service (SaaS) platform, each customer organization had its own tenant. After compromising one SaaS provider, the operator extracted data belonging to roughly 200 downstream customer organizations. It then dumped a session store containing over 2,100 token sets for Microsoft's cloud identity service Azure AD across more than 40 corporate tenants in about 34 hours. These authenticated-session credentials let a system recognize an already signed-in user or application without repeating the original login. AI performed nearly all this work.
Industrial credential harvesting and cross-tenant theft are separate paths
Another SaaS compromise was distinct from both the APK-scanning pipeline and the session-store theft. The actor used cross-site scripting and privilege escalation, then used AI to understand developer and authentication APIs, obtain privileged tokens, construct bulk-export tools and collect data across tenant boundaries. The intrusion reached thousands of downstream organizations.
The same operator claimed legitimate bug-bounty payments of $2,000 and $5,000 from two different targets it had also infiltrated and extorted. Those amounts are claims about payouts, not verified criminal income. In another incident, a stolen developer token led to full administrative control of a victim’s cloud environment in roughly three hours.
The source text describes eight recurring lifecycle stages across the cases. They are not a universal strict timeline, and individual intrusions followed different paths.
- Sourcing and reconnaissance. Most intrusions began with compromised credentials. The actors also used scanning, vishing, phishing and domain spoofing to obtain access.
- Discover. Automated projects mined application binaries, code repositories, client-side code, integrations, credential stores, container images, metadata services, open storage and victim-deployed AI agents for exposed tokens and other access mechanisms.
- Validate and qualify. Findings were tested before use or resale through cloud-key validation, purpose-built login checks, production replay, resale grading or offline password recovery.
- Expand within the victim environment. A working credential was used to reach more of the victim environment, including secret stores, administrative tokens, CI/CD systems, databases, session tables, signing keys and downstream tenants reached through a vendor’s OAuth identity.
- Exfiltration. Material left through six channels: consumer cloud storage, a private network-attached storage system reached over a mesh VPN, Telegram bot streams, staging inside victim cloud environments, C2 channels and bulk API pulls.
- Warehouse. Stolen databases, victim-specific loot trees and working credentials were stored for later reuse, resale or delivery through Telegram-backed storefronts.
- Mint and persist. Actors created new cloud keys, platform developer keys, forged sessions, two-factor codes or network backdoors so that access could survive credential rotation.
- Monetize. The operators resold credentials and access, attempted direct financial theft, extorted victims, claimed bounty income or retained bulk data as leverage.
Figure 2 makes the lifecycle cyclical rather than terminal: proceeds from credentials fund subsequent discovery, while stolen compute and keys re-enter later operations.
How stolen resources and proceeds feed another round
Figure 2 adds a ninth node, Cover, although the report’s accompanying prose elaborates on only the first eight stages and does not provide a separate detailed mechanism for that node.
The lifecycle abstracts activities shared across the clusters, not a fixed path followed by every affiliate. The four patterns that follow combine different entry points, methods for expanding access and routes to monetization.
Figure 11 further distinguishes four recurring patterns without mapping its affiliate letters to named operators. One pattern begins with a secret embedded in a mobile application and leads to cloud access. A second begins with a copied vendor backup store, then uses the vendor’s OAuth identity to reach downstream customer tenants. A third starts with an administrative token and expands into broader platform access. A fourth begins with prevalidated credential lists and extracts account value for resale or reuse. These are retrospective illustrations of heterogeneous entry points and outcomes, not one common sequence followed by every affiliate.
AI credentials became part of this cycle. One key stolen from a target environment supported roughly three weeks of secondary operations. In every instance described here, the keys came from Anthropic customers’ environments. Anthropic’s own systems were not compromised by these actors.
Original source figures · supporting evidenceExpand source figures +
Original figures retain their English text and link to full-resolution images.
GTG-10007: parallel research, reconnaissance and collection
GTG-10007 used Claude as the engineering and orchestration layer for intrusion attempts against production systems, reconnaissance of foreign-government networks, reverse engineering of security products, malware development and the construction of intelligence-collection infrastructure. Lead agents divided reconnaissance and post-exploitation work among parallel subagents. Target lists, harvested credentials, campaign state and standing instructions were retained between sessions, allowing work to resume with its accumulated context while some research and collection processes continued without their operators present.
GTG-10007 involved Chinese-speaking operators likely based in Changsha. Two identified operators were undergraduate students at a university in Hunan. A state sponsor was not established.
The group targeted roughly fifty organizations across education, retail, energy, technology, healthcare, finance, manufacturing and government. Targeting does not imply successful compromise in every case. Observed outcomes included hundreds of megabytes of student information taken from an education-technology company, access to a retailer’s production environment and citizen records obtained from a Southeast Asian government agency.
Within this broader program, the report describes three parallel workflows that each repeat a cycle of work: appliance research, attack-surface reconnaissance and scheduled collection from public sources.
One loop focused on firmware and binary analysis. Agents examined the software embedded in appliances and analyzed compiled programs. The workflow loaded appliance firmware and executable files into analysis tools, traced program behavior and formed vulnerability hypotheses. It then produced candidate exploit code and tested it against laboratory copies of the target product, iterating before adding a successful chain to a private portfolio.
The actor validated previously unknown security-product vulnerabilities in its own lab. That result is separate from an appliance workflow that yielded more than a dozen possible zero-day findings in a single month. These were hypotheses about potentially previously unknown flaws. “Possible” and laboratory validation do not amount to vendor confirmation, and these findings were not all classified as confirmed zero-days.
A second loop handled attack-surface and OSINT reconnaissance. It assembled open-source intelligence (OSINT) from publicly accessible material. Agents searched for exposed assets, fingerprinted them, mapped likely entry points and checked them against known vulnerabilities. Each round updated persistent project memory and expanded the scope of later searches.
A third loop operated as a scheduled collection fleet. Thirteen standing AI agents retrieved publicly available military, government, policy and social-media material. Adjacent systems summarized and scored the collected content before delivering it to a portal. Collection from these public sites was not a compromise of those sites.
Hands-on intrusion remained a human role. Operators developed the workflows, consumed their output and engaged during intrusion events. Once access existed, AI enumerated hosts, handled credentials and processed data. Although the automated workflows had global scope, the observed hands-on efforts were concentrated exclusively on victims inside China.
Three concurrent loops, with persistent research and reconnaissance context
Original source figures · supporting evidenceExpand source figures +
Original figures retain their English text and link to full-resolution images.
The AI supply chain: resale, computing power and cover
Beyond attackers’ own use, stolen AI access was traded in a criminal market focused on obtaining and reselling it. API credentials let software call a model service, while authenticated session tokens allow an already signed-in account session to remain usable. For some groups, acquiring these credentials was the primary objective. Brokers and fraudulent reseller networks supplied stolen access to other actors, rotating fresh API keys and session tokens into service until their available usage was exhausted.
Some malicious applications masqueraded as AI tools, including Claude Code. Once installed, they harvested credentials and active sessions from a victim’s device. Resetting a compromised session did not necessarily end the theft because the software could capture newly created sessions and send them to the operator.
GTG-50021, a Russian- and Ukrainian-speaking group, ran one such reseller operation. It advertised discounted Claude access, but secretly sent customer traffic to a different model. Its tooling also stole customers’ Anthropic credentials for resale to other proxy operators. This conduct is attributed specifically to GTG-50021 and does not establish that every reseller follows the same method.
Prompt-injection attacks also targeted AI wrapper services' LiteLLM integrations, which connected applications to different model providers through a common interface. The reported attacks extracted production keys from customer-hosted containers. No new LiteLLM CVE or product-wide compromise was identified in this account.
Anthropic identifies three forms of value in stolen AI access: loot that could be sold, compute paid for by the legitimate account owner and cover because activity appeared under that owner’s credentials. One campaign ran for a month entirely on stolen keys. ShinyHunters affiliates switched workloads to keys obtained from victims, and GTG-50020 first took production credentials from an evaluation environment before continuing its attacks. The resulting recommendation is to treat AI keys and agent integrations with the same seriousness as production credentials and to purchase access only through authorized channels.
Advertised Claude access, redirected traffic and stolen accounts
GTG-50020: from hotel platforms to AI vendors
GTG-50020 targeted production keys held by AI vendors and reused stolen credentials in later attacks. The same actor also ran human-directed parallel testing, unattended probing and exploitation, automated account creation, and interception of sessions authenticated through know-your-customer (KYC) identity checks. The report describes these as distinct workflows within the actor’s wider activity.
GTG-50020 was a Russian-speaking, financially motivated actor previously involved in attacks against hotel-booking and financial-technology platforms. In one earlier intrusion, roughly 26 gigabytes of data were stolen and the actor sought $1.5–2.5 million through extortion or sale. Receipt of the payment was not established.
One AI vendor ran automated evaluations in a sandbox environment that held production keys for calling several model providers. Malicious instructions caused the environment to disclose those credentials. The actor subsequently reused the stolen keys while continuing attacks against the vendor and unrelated targets.
A follow-on campaign targeted roughly thirty AI companies in about four days. That number describes targets, not successful breaches. The actor pursued more than a dozen possible paths to a pre-release Claude model, but every attempt failed. The keys came from customer environments; Anthropic's own systems were not compromised.
The evaluation sandbox exposed the customer’s production keys
The case contained four different workflows. The first was human-directed. A scope file dispatched parallel agents for reconnaissance and exploitation. Findings were retested, viable results were added to an incremental report and the process moved to the next target.
The second used a public, containerized offensive-agent platform against production web applications. Worker agents both probed for flaws and attempted exploitation without human supervision, placing possible findings and obtained credentials into the operator’s workspace. The system therefore combined application testing and active exploitation rather than stopping at vulnerability identification.
Separate from the application-intrusion workflows, the actor also automated account creation and intercepted KYC sessions after victims had successfully authenticated.
The third automated fraudulent account creation. Bots, residential proxies, antidetect browser profiles, CAPTCHA-solving services, inbox polling and automated verification steps produced verified accounts that could be retained for later use.
The fourth intercepted the know-your-customer (KYC) identity checks used by financial and marketplace services. Victims were directed to lookalike domains whose reverse proxy forwarded the genuine verification process. The victim completed real identity verification, while the intermediary captured the resulting authenticated session and documents. The operation stole the verified session; it did not defeat the underlying identity-verification algorithm.
Identity verification is genuine; the session is intercepted
Original source figures · supporting evidenceExpand source figures +
Original figures retain their English text and link to full-resolution images.
GTG-50029: one actor and privacy harm at scale
In spring 2026, one French-speaking actor targeted European political parties, media organizations, think tanks and the SaaS providers they used. AI-assisted coding and agents supported both intrusion activity and the development of a personal-data search service. That service brought prior breach dumps together with material stolen in the actor’s own operations, making records from separate sources searchable through a single system.
The actor built a Rust-based scanner that searched public containers for exposed API keys. A local proxy layer rotated among validated keys to obscure the resulting traffic.
The campaign exploited a previously undocumented re-installation race condition in the affected sites' WordPress publishing platform. Claude assisted with developing, debugging and testing the technique in a laboratory harness, and it succeeded against at least four websites.
At one political campaign platform, an exposed search interface yielded approximately 140,000 records that included users’ political opinions. Against another target, the actor installed a webshell, a remotely controlled script placed on a web server as a backdoor. An always-loaded WordPress plugin intercepted submitted credentials, and backups were poisoned as well. The report infers that poisoning backups was intended to preserve access by reintroducing the compromise after restoration.
A media intrusion used an injected browser-control script to fingerprint thousands of visitors while seeking editorial staff sessions and credentials. The script communicated through a C2 framework operated by the actor.
The actor’s signature platform, fafsearch, combined pre-existing breach dumps with data from the actor’s own intrusions. It normalized and ranked records, tested the system and packaged it for containerized deployment. The resulting service contained tens of millions of rows. Those rows were not all freshly stolen by this individual. The entire platform was built by one person.
Two data sources converge into a person-searchable repository
Across 42 tracked target entities, the actor obtained internal access to at least 14. The estimated volume of exfiltrated database dumps was 12 to 26 GB. The material included political donor and membership information, a 15,000-message mailbox, student applications involving minors and payment-provider data. The actor also established live credential interception. These figures describe different observed effects and do not imply that every system reached yielded its entire database.
Diffusion, autonomy and human decisions
Anthropic draws two broad developments from these unconnected campaigns. The first is diffusion. Similar working patterns appeared across different motivations, regions and levels of prior capability. Public frameworks reduced the need to build orchestration from the ground up, while stolen credentials and AI access supported a criminal market around the workflows. Familiar entry methods coexisted with both known vulnerabilities and research into previously unknown flaws. The second is a spectrum of autonomy. At one end, Claude acted conversationally during development. Further along, humans directed commands while AI operated against victim environments. At the far end, parallel agents ran reconnaissance, exploitation and theft for extended periods. GTG-10007 scheduled public-source collection without a person in the loop. GTG-20006 used scheduled jobs for token renewal and cloud collection as well as human-directed intrusion steps.
Anthropic’s economic judgment is that AI reduces the skill and labor cost required for each campaign while leaving potential payoffs largely unchanged. This shift can make previously marginal targets viable and support higher-volume operations. The assessment is a judgment drawn from the observed campaigns, not a standardized measurement of attacker return on investment.
Humans retained control over decisions about targets, monetization and review. Several serious compromises arose from operations in which a person directed every step. The company therefore separates autonomy from severity:
Second, autonomy and harm are separate axes: Autonomy multiplies the scale and speed of an operation, and reduces operating costs and complexity, but severity is still determined by a multitude of factors.
Sources and original material
Cases, attribution and statistics follow Anthropic’s investigation. This article covers cyber operations only.