Threat actors are increasingly using Claude-based agentic workflows to automate reconnaissance, exploitation, credential theft, data exfiltration, and malware redevelopment.
Anthropic said it disrupted operations in which attackers used AI not simply as a coding assistant, but as an orchestration layer capable of executing and iterating across much of the cyber kill chain.
Anthropic’s investigation examined malicious activity disrupted between December 2025 and August 2026.
Hackers Turn Claude AI Agents Into Autonomous Tools
It identified suspected state-backed operators, financially motivated criminals, and hacktivists using Claude Haiku, Sonnet, and Opus models in autonomous or semi-autonomous attack frameworks.
Instead of manually asking a chatbot for individual code samples or technical advice, attackers built multi-agent frameworks able to conduct reconnaissance, identify exposed systems, test credentials, develop intrusion tooling, execute post-compromise tasks, and organize stolen data.
Human operators typically remained responsible for target selection, campaign priorities, and reviewing the results, while AI agents handled repetitive technical tasks in parallel.
Asset discovery, exploit development, phishing infrastructure setup, malware engineering, and bulk data processing tasks that previously required a team of specialists can increasingly be delegated to agents operating at machine speed.
One of the report’s most serious cases involved GTG-20006, an espionage-linked cluster whose activity was assessed as consistent with public reporting on Midnight Blizzard.
The group allegedly used AI-driven workflows to automate infrastructure acquisition, phishing, persistence, command-and-control activity, credential harvesting, and data exfiltration against government, defense, diplomatic, and drone-supply-chain targets.
When security software detected an implant, the AI workflow could modify the malicious code, rebuild it, and repeatedly test the revised artifact until it evaded detection.
The actor then staged updated payloads on disposable hosting infrastructure for use in phishing, ClickFix, and DNS-hijacking activity.
Endpoint detections and signatures remain important, but attackers can potentially reduce the time needed to generate a replacement payload after an existing sample is caught.
These operators allegedly used AI agents to accelerate credential harvesting, vulnerability exploitation, privilege escalation, API abuse, bulk exports, and cross-tenant data collection in compromised SaaS environments.
In one intrusion, an attacker reportedly progressed from a stolen developer token to administrative cloud control in approximately three hours.
In a separate supply-chain compromise, AI-assisted tooling reportedly exploited a cross-site scripting vulnerability, escalated privileges, produced or converted privileged tokens, and enabled data collection from thousands of downstream customer organizations.
An operator provides a broad objective, such as validating access to an environment or retrieving valuable data, then lets the AI assess the environment, generate and run scripts, interpret output, and keep iterating until it reaches the assigned outcome.
A Chinese-speaking cluster tracked as GTG-10007 allegedly operated an autonomous vulnerability-research program against endpoint-security products and network appliances.
Its workflows placed firmware and binaries into decompilation tools, mapped code paths, produced vulnerability hypotheses, wrote proof-of-concept exploits, and tested them in laboratory environments.
Anthropic said one appliance-focused workflow generated more than a dozen possible zero-day findings within a month. The report also highlights the growing value of AI API keys and session tokens.
Attackers allegedly harvested credentials from public repositories, mobile applications, container images, websites, and AI integrations.
A stolen key can be monetized, provide compute capacity at the victim’s expense, and make malicious activity appear to originate from a legitimate account holder.
Organizations should treat AI API keys, agent integrations, model gateways, evaluation sandboxes, and connected automation platforms as production security assets.
Keys should be held in managed secrets systems rather than embedded in source code, mobile apps, containers, or client-side software.
Rotate exposed credentials immediately, and have security teams investigate unusual model usage, abnormal token creation, bulk exports, unexpected device registrations, and cross-tenant API activity.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
