Anthropic's Claude Was Weaponized by Spies, Hackers, and Propaganda Farms

Anthropic just released its most extensive threat intelligence report to date, and it reads less like a corporate transparency post and more like a declassified intel briefing. The company's Threat Intelligence team disclosed detailed case studies of how state-sponsored groups, cybercriminals, spyware vendors, and propaganda outfits tried to weaponize Claude between December 2025 and August 2026, along with how each operation was detected and shut down.

The full report spans seven harm categories: cyber operations, influence operations, surveillance, scams, biological misuse, conventional weapons development, and something the company calls illicit distillation. Claude Haiku, Sonnet, and Opus models appear across the misuse cases, with no involvement from Claude Fable or Mythos-class models except in a single distillation case.

Sophistication is no longer a signal

The headline finding concerns the economics of attacks. AI models have collapsed the labor and tooling gap that used to separate well-resourced state operations from lone operators. A hacktivist with stolen API keys can now sustain multi-victim campaigns that a year ago would have required a team of specialists.

One case, tracked as GTG-20006, involves a Russian-speaking operator whose tradecraft matches Midnight Blizzard. The actor used AI to monitor how well their tools evaded detection, and if a monitoring agent identified that deployed malware was flagged by a security product, the agents would autonomously modify and rebuild the code until it slipped past. That inverts the traditional detection game: defenders used to slow attackers by publishing signatures, but now the attacker's loop closes faster than the defender's.

Vibe hacking at industrial scale

Another cluster, GTG-50014, involves operators suspected of ties to ShinyHunters. One French-speaking operator ran a distributed credential-harvesting pipeline across a fleet of 10 AWS EC2 workers, mass-downloading 1.8 million distinct Android APKs, decompiling them, and scanning for hardcoded secrets with TruffleHog. Verified findings were piped into Telegram groups organized by secret type.

Operational tempo tells the real story. One breach of an enterprise software company took only hours from first access to bulk data theft, and another compromise escalated from a single stolen developer token to full administrative control of a victim's cloud environment in roughly three hours. Anthropic calls this pattern vibe hacking, where operators give the AI general goals and let it evaluate the environment, write scripts, and iterate until the job is done.

The AI supply chain becomes both target and weapon

Stolen API keys are now first-class loot. Operators who obtain AI credentials gain three things at once: resale value, compute that runs at someone else's expense, and cover that attributes activity to the credential's legitimate owner.

GTG-50020, a Russian-speaking financially motivated actor, pivoted from hotel booking intrusions to hunting AI vendors. By injecting malicious instructions into a vendor's automated evaluation sandbox, the actor caused the sandbox to hand over the credentials it held, including production API keys from multiple providers. Their stated goal was access to a pre-release Claude model. They never got it.

Autonomous espionage swarms

GTG-10007, a Chinese-speaking group operating out of Hunan (two operators identified as undergraduates at a local university), ran what Anthropic describes as an exploit foundry. The operators routinely deployed agent swarms, where a lead AI decomposed reconnaissance and post-exploitation work and dispatched it to many subagents running in parallel, with persistent campaign memory saving target lists, harvested credentials, and standing instructions across working sessions. One workflow iterating continuously on network appliances yielded more than a dozen possible zero-day findings in a single month.

Influence operations get an AI newsdesk

The influence operations section covers nine campaigns from Russia, Iran, Turkey, Bangladesh, Kenya, and the UAE. A few standouts:

• A France-based digital advertising agency (LKM Company) ran a commercial influence-as-a-service network that published at least 8,913 articles in about 20 languages across roughly 70 fabricated news websites, amplified by 70 matching X accounts and 250+ inauthentic commenting accounts.
• An Istanbul-based technology company sold a Malaysian election-manipulation platform marketed as a military-grade, AI-driven, real-time political operations ecosystem, managing about 1,000 fake X accounts with warm-up logic and evasion.
• A distributed MEK/NCRI-aligned operation cloned a real activist's Telegram account, fed Claude 8,400 of his posts to mimic style, and ran live conversations with his contacts inside Iran.

Surveillance built on Claude

The surveillance cases may be the most disturbing. A single consultant working for Malian national security authorities used Claude to engineer a mass-interception platform capable of surveilling communications on all of the country's mobile operators and generating dossiers on targets. The platform, called Lakana 360, monitors roughly 25 million SIM cards, and the warrant requirement on dossier generation was removed at the operator's request.

A separate PRC-aligned operation used Claude to run covert recruitment against Uyghur targets in Syria. The operator spoke no Arabic. The model drafted outreach in the regional dialect, translated replies in real time, role-played as an expert to run a quality check on the mission, and formatted the results for what Anthropic suspects was a handoff to a case officer.

Weapons, biology, and the dual-use gray zone

Anthropic disrupted six conventional weapons cases, including a Yemen-based cell that used Claude Code as its guidance-navigation-control engineering team for a guided rocket. The actors did test-fire the weapon, but the field test appears to have failed, and within hours they returned to Claude to work out why.

On biology, the cases circle the hard problem of dual-use research. A researcher accessed Claude from an unsupported region via US VPS infrastructure and spent weeks planning avian influenza mammalian-adaptation experiments. Robust classifiers meant the exchanges only reached Claude Sonnet 4 and Haiku 4.5, limiting uplift, but the pattern is what matters: state-supported researchers are actively evading regional blocks and using multi-model fallback to keep working.

The distillation wars

The most concrete section covers illicit distillation, where Anthropic names names. The company attributes campaigns to Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime, and MiniMax.

Alibaba's chain-of-thought distillation campaign peaked at nearly 3 million exchanges per day launched from more than 3,500 fraudulent accounts, targeting agentic tasks, software engineering, kernel development, and long-horizon workflows. Anthropic observed over 151 million exchanges attributable to Alibaba between May and July 2026.

Moonshot and DeepSeek went further. Moonshot silently forwarded customer requests to Claude instead of processing them using Kimi, then displayed Claude's responses to users. Over a ten-day window, Moonshot relayed almost 300,000 customer requests to Anthropic, the vast majority routed to Opus. DeepSeek did the same, and Anthropic says the relayed traffic exposed sensitive data including live credentials from a Russian defense agency database and a case management tool built for a municipal Public Security Bureau in China.

To counter this, Claude now summarizes its internal reasoning before responding, which makes stolen transcripts less useful for training another model. Fable 5.1 introduced preserved thinking, which stops new API accounts from altering the system prompt, tools, or messages that precede Claude's reasoning in multi-turn conversations.

What developers should take from this

A few practical signals worth internalizing:

• Treat AI API keys like production credentials. Attackers now scan APKs, GitHub repos, Docker images, and mobile app bundles specifically to mint compute for their next attack.
• The threshold for being targeted has dropped. Autonomous agent frameworks like PentAGI mean a single motivated operator can run multi-victim campaigns previously requiring teams.
• Static detection signatures are increasingly disposable. If your security stack depends heavily on known-bad hashes, expect adversaries to close that loop with AI-driven repackaging.
• If you're building an AI wrapper, LiteLLM deployments, evaluator sandboxes, and reseller proxies are being probed with prompt injection to exfiltrate your production keys.

The report's overarching message is that the attacks themselves aren't novel. Phishing, stolen credentials, SQL injection, unpatched edge devices. What changed is that the labor curve for running them collapsed. Sophistication has stopped being a reliable signal of who is behind an operation, which means threat intel and defense teams need to rebuild their heuristics from scratch.