Anthropic disclosed that state-sponsored and criminal groups abused its Claude models between December 2025 and August 2026 to automate intrusions, data theft, influence and surveillance operations, weapons software development and biological research. Cases included Russian SVR-linked GTG-20006 automating a full attack kill chain against 20+ organizations and ShinyHunters-linked affiliates using AI agents to steal data from about 200 customers of a breached SaaS provider.
Occurred 1 December 2025 · Disclosed 10 September 2026 · Record updated 13 September 2026
AI agents performed nearly all the work in a supply-chain breach of a SaaS provider that led to data theft from roughly 200 customer organizations and a dump of over 2,100 Azure AD token sets across more than 40 corporate tenants in about 34 hours; more than 20 government, defense and think tank organizations were targeted by a Russian espionage group, and Claude was also used for guided weapons, drone swarm and pathogen-related research before accounts were banned.
IncidentsThe AI firm's report covers misuse it disrupted between December 2025 and August 2026, including a Russian espionage crew that automated an entire attack chain.
13 Sept 2026
