Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

The findings were detailed in Anthropic's September 2026 threat intelligence report, which examined malicious and abusive activity observed between December 2025 and August 2026.

According to Anthropic, the activity represents a shift from attackers simply asking an AI chatbot for code or technical advice toward using AI agents as operational components capable of carrying out long-running attack workflows with relatively limited human intervention.

Category	Details
AI platform	Anthropic Claude
Activity period	December 2025 – August 2026
Threat actors	State-sponsored groups, cybercriminals and other malicious operators
Primary techniques	Reconnaissance, exploitation, credential theft, data collection and exfiltration
AI role	Autonomous and multi-agent cyber operations
Targeting	Government, defense, technology and other organizations
Key development	AI used as an operational attack component rather than only an advisory tool
Main concern	Greater attack scale, speed and automation

Anthropic said the threat actors involved represented multiple categories, including state-sponsored groups, financially motivated criminals, commercial surveillance operators and politically motivated actors.

From Chatbot Assistance to Autonomous Operations

The most significant aspect of the findings is the way Claude was integrated into attack infrastructure.

Traditional AI-assisted attacks might involve a human operator asking an AI model to:

• Write a phishing email
• Explain a vulnerability
• Generate a script
• Modify malware
• Analyze stolen data

The operations described by Anthropic went considerably further.

AI agents were incorporated into workflows that could perform multiple consecutive tasks, including:

Reconnaissance → target discovery → vulnerability identification → exploitation → credential access → data collection → exfiltration

Anthropic described these operations as involving multi-agent frameworks, with different AI-driven processes handling separate parts of an attack.

This architecture can significantly reduce the amount of manual work required from an attacker.

AI-Driven Reconnaissance

Reconnaissance is normally one of the most time-consuming stages of a targeted intrusion.

Attackers need to determine:

• Which systems belong to a target
• What technologies are exposed
• Which services are running
• What vulnerabilities may exist
• Which accounts may be valuable
• Where sensitive information is stored

AI agents can accelerate this process by continuously processing large amounts of information and determining which findings should be investigated next.

Instead of an operator manually reviewing hundreds or thousands of results, an AI-driven workflow can prioritize targets and feed the most promising findings into subsequent attack stages.

This creates a much tighter relationship between reconnaissance and exploitation.

Exploitation Becomes an Automated Decision Process

The more concerning development is that AI was not limited to identifying potential vulnerabilities.

Anthropic reported cases where Claude was used within workflows that progressed from identifying weaknesses toward exploitation.

This means an AI system can potentially evaluate an environment, identify an attack path and then determine which technical action should be attempted next.

The significance is not necessarily that AI has discovered entirely new exploitation techniques.

Rather, the model can combine known techniques at machine speed and continuously make decisions about what to try next.

For defenders, this can reduce the time available to detect and disrupt an intrusion.

Credential Theft and Access Expansion

Once an attacker gains an initial foothold, credentials frequently become the next objective.

AI-assisted workflows can help identify potentially valuable credentials among large quantities of information, including:

• Configuration files
• Environment variables
• Browser data
• Authentication tokens
• API keys
• Cloud credentials
• Application secrets
• Email accounts

The model can then help determine which credentials are likely to provide additional access.

This creates a potentially dangerous cycle:

Compromise one system → discover credentials → access another system → discover more credentials → expand access

Human operators may previously have needed to manually inspect each stage. AI agents can potentially automate much of this process.

Large-Scale Data Theft

Anthropic also reported AI being used to process and organize stolen information.

This is important because data theft is not simply a question of transferring files.

Attackers first need to determine:

What data is valuable?

AI can potentially classify and summarize stolen material, identify sensitive records and help prioritize information for exfiltration.

Potentially valuable information can include:

• Financial records
• Government documents
• Intellectual property
• Credentials
• Customer information
• Internal communications
• Strategic documents
• Source code

The ability to rapidly analyze stolen information can make extortion and espionage operations more efficient.

Why Multi-Agent Architecture Matters

A single AI assistant has significant limitations.

A multi-agent system can divide a complex operation into specialized tasks.

For example:

Agent	Potential Role
Reconnaissance agent	Identify hosts and services
Vulnerability agent	Analyze potential weaknesses
Exploitation agent	Attempt available attack paths
Credential agent	Identify authentication material
Collection agent	Locate valuable information
Analysis agent	Classify stolen data
Exfiltration agent	Prepare and transfer selected data

A coordinating process can then connect the results from each stage.

This resembles the structure of a human penetration-testing or intrusion team, but with software agents performing many of the repetitive activities.

Anthropic said the observed activity went beyond simple question-and-answer interactions and involved multi-agent frameworks executing reconnaissance, exploitation and data-exfiltration tasks.

State-Sponsored Actors Are Also Adopting the Model

The activity was not limited to financially motivated criminals.

Anthropic identified multiple cases involving state-sponsored or state-aligned actors.

One previously disclosed operation involved the Russian-linked GTG-20006 cluster, which Anthropic says used Claude to support a cyber-espionage campaign targeting government, military, diplomatic and defense organizations. The activity included an AI-assisted workflow capable of modifying malware when security products detected it.

This illustrates how AI can potentially support both ends of the intrusion lifecycle:

Attack development → deployment → detection monitoring → adaptation → redeployment

That feedback loop could make conventional static detections less effective over time.

The Economics of Cyberattacks Could Change

AI does not necessarily need to make an individual attacker dramatically more technically capable to have a major security impact.

It can instead reduce the cost of performing complex operations.

Consider an intrusion that previously required:

• Multiple skilled operators
• Hours of reconnaissance
• Manual vulnerability research
• Manual credential analysis
• Manual data classification

If AI automates significant portions of those tasks, the same operation may require fewer people and less time.

This potentially lowers the barrier for sophisticated attacks.

Anthropic summarized the broader trend by noting that AI capabilities are narrowing the tooling and labor gap that historically separated well-resourced state-sponsored operations from less sophisticated operators.

AI Does Not Eliminate Human Operators

Despite the increasing autonomy, the observed operations should not be interpreted as completely human-free attacks.

Human operators can still determine:

• Which organizations to target
• What strategic objectives matter
• Which systems should be prioritized
• When an operation should stop
• What stolen information is strategically important

AI can then perform many of the intermediate tasks.

This creates a human-directed, machine-executed attack model.

The distinction matters because defenders still have opportunities to disrupt the operation at the identity, network, endpoint and infrastructure levels.

New Challenges for SOC Teams

AI-assisted attacks create a problem for traditional SOC workflows.

Many security operations still depend on identifying individual indicators:

• Malware hash
• IP address
• Domain
• Filename
• User-agent
• Command line
• Known exploit

AI-generated or AI-modified operations can change these indicators rapidly.

A better defensive approach is to identify behavioral sequences.

For example:

New external login → privilege escalation → credential access → unusual internal discovery → bulk data access → outbound transfer

Even if the malware, IP address or domain changes, the underlying sequence may remain suspicious.

Detection and Threat Hunting

Security teams should increase emphasis on behavioral detection and attack-path correlation.

Identity Monitoring

Monitor for:

• Impossible-travel authentication
• New device registrations
• Suspicious OAuth grants
• Abnormal token usage
• Privileged account activity
• Authentication from unexpected infrastructure

Endpoint Monitoring

Look for unusual process relationships involving:

• PowerShell
• Command Prompt
• Python
• Scripting engines
• Browser processes
• Credential-access utilities
• Archive tools

Network Monitoring

Investigate:

• Unexpected outbound connections
• New C2 infrastructure
• Large data transfers
• Unusual DNS requests
• Connections from servers that normally have limited internet access

Data Access Monitoring

Alert on:

• Bulk database queries
• Large-scale file enumeration
• Unusual archive creation
• Sudden access to sensitive repositories
• Large transfers to previously unseen external destinations

Defending Against AI-Assisted Intrusions

Organizations should focus on reducing the attacker's ability to move between stages.

Strengthen Identity Controls

Use phishing-resistant authentication such as FIDO2/passkeys where possible.

Enforce:

• Conditional access
• Privileged-access management
• Least privilege
• Short-lived credentials
• Strong session controls

Segment Critical Systems

Network segmentation can prevent an attacker who compromises one workstation or server from immediately reaching:

• Domain controllers
• Production databases
• CI/CD infrastructure
• Backup systems
• Security management platforms

Protect Secrets

Do not store long-lived credentials in:

• Source repositories
• Configuration files
• Scripts
• Environment files
• Shared documents

Use dedicated secrets-management platforms and rotate credentials regularly.

Improve EDR/XDR Telemetry

Because AI-generated malware can change quickly, organizations should ensure that endpoint telemetry captures behavior rather than relying only on file signatures.

Process creation, network connections, authentication activity and persistence mechanisms should be retained long enough to support retrospective investigations.

Monitor AI Infrastructure

Organizations deploying their own AI agents should also treat those systems as privileged computing environments.

AI agents with access to:

• Source code
• Cloud infrastructure
• Credentials
• Corporate email
• Databases
• Internal APIs

should operate under strict permission boundaries.

An AI agent should not automatically receive the same privileges as a human administrator.

AI-on-AI Cybersecurity

The rise of AI-assisted attacks also means defenders will increasingly use AI to analyze the same telemetry.

Security teams can use AI to:

• Correlate alerts
• Summarize incidents
• Identify attack paths
• Analyze logs
• Detect anomalies
• Prioritize vulnerabilities
• Investigate suspicious behavior

However, defenders should avoid creating completely autonomous response mechanisms without appropriate controls.

An AI system that can automatically isolate endpoints, disable accounts or modify firewall policies must itself be protected against prompt injection, compromised data and incorrect conclusions.

The Bigger Security Implication

The significance of these incidents is not simply that "hackers are using Claude."

Attackers have been using automation for years.

The important development is that modern AI models can provide a flexible reasoning layer connecting different tools and attack stages.

The model can potentially interpret the output from one tool, decide what information is important and determine what action should happen next.

That creates an attack system capable of adapting to changing environments rather than following one fixed script.

Anthropic's reporting indicates that this transition from manual prompting toward autonomous multi-stage operations is already occurring in real-world activity.

Final Takeaway

The latest cases involving Claude demonstrate that AI-assisted cyberattacks are moving beyond automated code generation.

Threat actors are increasingly integrating AI into reconnaissance, exploitation, credential theft, data collection and exfiltration workflows, allowing multiple stages of an intrusion to be coordinated with significantly less manual effort.

For defenders, the answer is not simply to deploy another malware signature.

Security programs need to become more focused on behavior, identity, attack-path detection and rapid response.

The most resilient organizations will be those that can identify suspicious sequences of activity even when the attacker continuously changes the tools, malware and infrastructure behind them.

As AI becomes more capable of coordinating cyber operations, the security industry is entering an environment where attack automation and defensive automation will increasingly compete against each other.