Anthropic says hackers used Claude to mine 1.8M Android apps

Anthropic has said that multiple threat groups attempted to abuse its Claude AI model for malicious purposes, including extracting secrets from 1.8 million Android apps, according to reporting published on 11 September 2026 by BleepingComputer. The groups named by the company include financially motivated actors as well as state-sponsored espionage groups linked to Russia and China.

"Secrets" in this context are the credentials and keys that developers embed in software, such as API tokens used to authenticate to back-end services. Sifting 1.8 million applications for such material is the kind of repetitive, large-scale work that a general-purpose model can accelerate. The reporting does not say which apps were affected, how many secrets were recovered, or what was done with anything the attackers obtained.

The incident is an example of tool misuse rather than a software flaw. There is no indication in the reporting of a vulnerability in Claude itself being exploited. Instead, the model was used as intended, but pointed at a task its operator does not permit. That distinction matters for defenders, because the fix is enforcement and detection at the provider level rather than a patch that customers can apply.

Separately, and on the same day, BleepingComputer published research from the security firm Huntress describing a related but distinct pattern: attackers abusing trusted AI platforms to host malicious content, poison search results and trick users into installing malware. Huntress examined campaigns aimed at AI users that made use of weaponised Claude Artifacts, shared AI conversations, sponsored search results and ClickFix-style lures.

Claude Artifacts are self-contained pieces of content, such as web pages or small applications, that the model generates and hosts for users to view and share. Shared AI conversations work in a similar way, producing a public link to a transcript. Both features give an attacker something valuable: a page served from a domain that users and security tools are inclined to trust. ClickFix lures, according to the Huntress research described in the report, are prompts that persuade a victim to run a command or take an action themselves, framing it as a fix for a supposed problem.

Taken together, the two reports point at the same underlying issue from opposite ends. In the first, the model is the attacker's tool. In the second, the platform around the model is the attacker's infrastructure. Neither requires the attacker to break anything. Both rely on the fact that AI vendors offer powerful, general capabilities to anyone who signs up, and that the resulting output carries the reputation of a trusted brand.

Anthropic's disclosure is its own account of activity it detected and, on the reporting available, the company has confirmed the abuse attempts. The reports do not state what enforcement action was taken against the accounts involved, nor whether affected app developers have been notified. Organisations that publish Android applications may wish to review what credentials are embedded in their shipped code, independent of this incident.