Anthropic reports Claude use in live intrusions and alleged model extraction

A Russian-linked espionage actor used Claude across significant parts of live cyber operations against government, defence and diplomatic interests, according to a new Anthropic threat-intelligence report that documents a broader role for AI in conducting attacks.

Published on 10 September 2026, the report covers activity Anthropic investigated and disrupted between December 2025 and August 2026. Its findings span cyber operations, influence activity, surveillance, scams and fraud, biological misuse, conventional weapons and illicit model distillation.

The report’s two principal cybersecurity strands are distinct. Anthropic says the Russian-linked actor used Claude while attacking external organisations. It separately alleges that laboratories based in China attempted to reproduce Claude capabilities through fraudulent accounts, proxy or reseller services and stolen API credentials. None of the reviewed evidence indicates that Anthropic’s core infrastructure was compromised.

AI agents embedded in live intrusions

Anthropic tracks the Russian-linked actor as GTG-20006 and says it conducted espionage operations involving more than 20 organisations and individuals, concentrated in Ukraine and Europe. Targets covered government, defence, diplomacy, research and the military-drone supply chain.

The operation combined established techniques, including phishing, compromised credentials, device-code and OAuth abuse, malicious infrastructure and malware, with AI-based workflows. According to Anthropic, Claude assisted with reconnaissance, tooling, intrusion execution, data processing and attempts to avoid detection.

The company also reported a more automated role for AI agents during malware development. It says the actor used agents to monitor whether tooling was detected, then repeatedly modify and rebuild it in response. Humans retained important decisions, including target selection and review, so the operation should not be characterised as fully autonomous.

Microsoft has independently corroborated part of the Russian-linked activity. In its CaptiveCrunch investigation, published on 31 July 2026, Microsoft said it had observed the actor it tracks as Storm-2945 conducting AI-augmented device-code and OAuth phishing since February. From early May, Microsoft also observed the actor manipulating traffic on hospitality and other captive-portal networks to support malware delivery and credential theft.

Microsoft assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard and said AI supported a significant portion of its operations. The UK National Cyber Security Centre and allied agencies, including the Australian Signals Directorate’s Australian Cyber Security Centre, have previously assessed that Midnight Blizzard, also known as APT29, is almost certainly part of Russia’s SVR.

That corroboration does not resolve every attribution question. Anthropic says GTG-20006’s tradecraft, targeting and use of a Russian-speaking operator are consistent with public reporting on Midnight Blizzard. Microsoft independently links overlapping CaptiveCrunch activity to a Midnight Blizzard sub-cluster, but the available public evidence does not establish that every incident grouped under GTG-20006 was an SVR operation.

Mailboxes, identity records and drone technology

Anthropic says the campaign progressed beyond planning into credential theft, persistence, data collection and exfiltration. Its telemetry indicates that one cloud-email espionage platform enabled access to and exfiltration of mail records from at least eight organisations.

The company further alleges that the operators stole hundreds of gigabytes of information. Reported losses included bulk mailbox exports from at least two drone-component manufacturers, a proprietary software development kit and related product information. Anthropic also says a North African government technology authority lost a credential database containing more than 300,000 national identity records and registry information covering more than 500,000 companies.

Those victim counts and loss figures come from Anthropic and have not been independently confirmed in the reviewed sources. Victim identities were not disclosed, limiting external assessment of the individual incidents and their consequences.

Separate campaigns sought Claude capabilities

In a separate set of findings, Anthropic attributed unauthorised distillation campaigns against Claude to seven laboratories based in China. The company linked operations to Alibaba, Moonshot, DeepSeek and Xiaomi, among others, but the named-company attributions remain publicly uncorroborated.

Anthropic alleges that Alibaba-affiliated operators generated more than 151 million exchanges between May and July 2026 through more than 3,500 accounts it considered fraudulent. It says the operation sought to extract reasoning capabilities for Qwen development.

Claude Haiku, Sonnet and Opus models appeared across the reported misuse and capability-extraction cases. Anthropic identified no misuse involving Fable models in this report, while Mythos-class models appeared in one illicit-distillation case. The company did not provide a complete model by case breakdown.

Some allegations also raise a separate data-handling concern for users of third-party AI services. Anthropic says workflows associated with DeepSeek, Moonshot and Xiaomi relayed some users’ conversations to Claude. According to the company, conversations from hundreds of users across at least 12 languages exposed names, email addresses, company information and active credentials.

That account has not been independently verified. The available evidence does not establish whether affected users were notified or whether receiving laboratories retained the information. Reuters reported that Alibaba, Moonshot, DeepSeek and Xiaomi did not immediately respond to requests for comment. It also reported that China’s Ministry of Foreign Affairs was unaware of the Anthropic report, supported beneficial AI development and opposed distortion of facts and smears against China.

Disruption without a conventional patch

Anthropic says it banned linked accounts and organisations, introduced monitoring for attempted re-registration, incorporated findings from the investigation into its safeguards and shared intelligence with relevant partners. It also released a separate package of indicators for defenders.

There is no software patch, fixed version or CVE because the disclosed operations did not depend on a newly identified product vulnerability. The Russian-linked actors abused legitimate services, identities and authentication mechanisms, while the distillation campaigns allegedly used fraudulent accounts, intermediaries and stolen access credentials. The account bans do not establish that operators lost tools, stolen data or model outputs already retained elsewhere.

Microsoft advises organisations to treat hotel, airport, conference and other guest networks as untrusted, using private connectivity where practical. Users should not install updates, certificates or diagnostic utilities presented through captive portals and should instead verify updates through trusted operating-system mechanisms.

Identity teams can block Microsoft Entra device-code flow where it is unnecessary and govern required use through Conditional Access. Microsoft also recommends phishing-resistant multifactor authentication or passkeys, tighter controls on authentication-method registration and sign-in-risk policies that challenge or block suspicious access. Organisations can use Anthropic’s indicator package and Microsoft’s detection material to assess possible exposure.

Anthropic’s broader report describes five scientific-use cases that it says could have supported biological-weapons development, although it does not allege that the scientists intended harm. It also attributes six conventional-weapons-related cases to actors in China, Russia and Yemen. These claims remain unverified and do not change the central cyber finding that AI was embedded in active operations rather than confined to advice or planning.

No Australian victim or domestic data exposure has been publicly identified. The findings nevertheless have defensive relevance for Australian government, defence, diplomatic, technology and travelling workforces, particularly where personnel use guest networks or route sensitive prompts through third-party AI services. Outstanding questions include how completely GTG-20006 overlaps with CaptiveCrunch, which organisations were affected and whether the named laboratories will respond to Anthropic’s allegations.

How do identity, service boundaries and third-party routing change the interpretation of AI-assisted intrusion activity? One place to examine those foundations is The Hack Academy’s online cybersecurity training programme, offering self-paced learning and practical exercises alongside theory across listed subjects such as networking, cloud security and internet vulnerabilities.