Threat actors are increasingly using Claude AI agents to automate cyberattacks across the intrusion lifecycle, including reconnaissance, exploit development, phishing, credential theft, persistence, and large-scale data exfiltration.
Anthropic’s latest threat-intelligence findings show that the technology is being used not merely as a conversational assistant, but as an orchestration layer for multi-agent offensive workflows.
Anthropic said it disrupted malicious activity between December 2025 and August 2026 involving suspected state-backed espionage groups, financially motivated cybercriminals, and hacktivists.
Threat Actors Use Claude AI Agents to Automate Cyberattacks
The campaigns used Claude Haiku, Sonnet, and Opus models to speed up cyber operations and reduce the skills, time, and staffing traditionally required for complex intrusions.
The report describes a shift from AI-assisted coding and research to agentic systems that can execute tasks with limited human supervision.
In several cases, operators assigned broad objectives such as identifying vulnerable assets, gaining access, harvesting credentials, or collecting data and allowed AI agents to assess target environments, create scripts, execute commands, and iterate until the task was completed.
However, AI agents handled much of the operational workload at machine speed, including scanning internet-exposed systems, validating credentials, analyzing application code, querying victim APIs, and organizing exfiltrated datasets.
Anthropic warned that this shift changes cybercrime economics. Rather than relying on large teams of experienced developers and operators, smaller groups or individual attackers can now run campaigns against many victims in parallel.
One cluster, tracked as GTG-20006 and assessed as consistent with activity publicly linked to Russian state-aligned espionage, reportedly used customized AI-driven workflows throughout its attack chain.
The group targeted Ukrainian and European government bodies, defense organizations, diplomatic entities, drone-industry suppliers, and other strategically relevant organizations.
The actor used AI to fingerprint email and remote-access services, build phishing infrastructure, register domains, manage command-and-control channels, steal credentials, and export data from compromised cloud environments.
The report also said the group automated malware retooling: when security products detected a deployed implant, AI agents modified and rebuilt the malware until it evaded detection.
Victims allegedly included drone-component manufacturers, where attackers bulk-exported mailboxes and stole a proprietary drone-vision software development kit.
The group also reportedly targeted hotel Wi-Fi vendors, altered DNS settings, and used ClickFix-style lures to deliver malware to connected guests.
Anthropic also identified financially motivated operators associated with suspected ShinyHunters affiliates using AI to speed up credential harvesting, cloud compromise, and extortion.
One operator reportedly downloaded and scanned 1.8 million Android APK files for hardcoded secrets, while another intrusion escalated from a stolen developer token to administrative control of a victim cloud environment in approximately three hours.
In supply-chain compromises, AI agents reportedly identified developer and authentication APIs, generated tools for bulk exports, converted privileged tokens, and collected data across downstream customer environments.
Separate Chinese-speaking operators tracked as GTG-10007 allegedly used autonomous AI workflows to reverse-engineer security products, identify potential zero-day vulnerabilities, develop proof-of-concept exploits, and test them against laboratory copies of target appliances.
The report further highlights AI API keys, session tokens, model gateways, and agent integrations as a growing attack surface.
Threat actors stole AI credentials from victim environments and used them as valuable loot, free attack compute, and a way to conceal activity behind a legitimate customer’s account. Anthropic emphasized that its own systems were not compromised in the documented cases.
Organizations should treat AI credentials like production secrets: store them in secure vaults, rotate exposed keys immediately, restrict permissions, monitor API use for abnormal activity, and secure AI-agent frameworks against prompt injection and token leakage.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
