Anthropic just published a report on how its own models are being abused, and it is worth reading for the conclusions, not the scare factor. Between December 2025 and August 2026 the company tracked attackers using Claude not as an advisor but as an operator: it runs reconnaissance, writes and debugs exploits, steals data, and even rebuilds malware until antivirus stops catching it. The headline finding is an uncomfortable one — sophisticated attacks no longer require sophisticated attackers.
What they found
Anthropic gave these players its own label: Generative Threat Groups, or GTGs. They range from state-sponsored crews to financially motivated criminals, commercial spyware vendors and propaganda shops. The company measures the AI’s role through a concept it calls “uplift” — how much more harm happened because of the model, scored across three axes: speed, scale and depth.
The key observation is the rise in autonomy. AI used to be a chat assistant: suggest some code, draft an email. Now the full spectrum is in play, up to fully autonomous operations where a human sets the goal and multi-agent chains run reconnaissance, exploitation and exfiltration for hours on their own. One group even kept a standing “collection fleet” of 13 agents running on a schedule with no human in the loop. Claude Haiku, Sonnet and Opus were all used, and public offensive agent frameworks like PentAGI helped the tradecraft spread across every class of actor.
| Group | Who | What they did with Claude | Scale |
|---|---|---|---|
| GTG-20006 | state espionage, Russian nexus | automated the full kill chain and detection evasion | 20+ orgs, hundreds of GB stolen |
| GTG-50014 | ShinyHunters, financially driven | “vibe hacking”: set a goal, let the model run | breach in 2–3 hours, over 1 TB exfiltrated |
| GTG-10007 | vulnerability research, China | agent swarms hunting 0-days in firmware | ~50 orgs, a fleet of 13 agents |
| GTG-50020 | Russian-speaking, financially driven | pivoted to the AI supply chain | ~30 AI companies in 4 days |
| GTG-50029 | lone hacktivist, France | wrote and fixed exploit code in real time | 42 political entities, internal access to 14 |
An automated exploit foundry
The clearest example is the Chinese group GTG-10007. It built an “appliance zero-day research” pipeline: load firmware into a decompiler, have an assistant agent walk the decompilation chains (thousands of calls), check findings against a knowledge base, form vulnerability hypotheses, and then write and test the exploit on the spot. Per Anthropic, one such workflow produced more than a dozen candidate zero-days in a single month. A reconnaissance loop ran alongside it, continuously scanning target verticals through device search engines. The human here is an operator, not a researcher.
Malware that evades antivirus on its own
GTG-20006 bolted an autonomous evasion loop onto its implants. Monitoring agents watched whether the malware had been flagged by security products. The moment a detection fired, the agents identified which artifact was burned, rewrote and rebuilt it, and repeated until the malware went dark. Anthropic states the consequence plainly: AI has inverted the cost back onto defenders. A new signature used to slow the attacker down; now a capable adversary can “close the loop” and bypass detection faster than defenders can build and ship it.
The new loot: API keys
A whole thread of the report is the hunt for keys and tokens to the AI services themselves. GTG-50020 compromised one vendor’s evaluation sandbox and lifted production API keys for several providers at once. Others exfiltrated keys from LiteLLM gateways via prompt injection. The logic is simple: a stolen key is three things at once — a product to resell, free compute to fund attacks, and cover, since the traffic looks like it comes from the legitimate owner. This mirrors what we have documented in autonomous agents turned into credential thieves — attacking AI infrastructure has become an objective in its own right.
Why this changes the rules
Anthropic’s main takeaway is not about any single group but about the economics of attacks. AI erased the labor-and-tooling gap that separated well-funded state operations from lone operators. Hence things that seemed impossible until recently: a SaaS vendor breached with access to 200+ downstream customers in 34 hours, a doxxing platform built solo, dozens of victims run in parallel. And one more unpleasant result: the sophistication of an operation is no longer a reliable signal of who is behind it. Fingerprint-by-tradecraft attribution is breaking down; a lone actor now hits with the reach of a group.
We keep seeing this shift, and not for the first time. The same logic drove the recent campaign against PaperCut servers, and it sits alongside the trend we tracked in the state of AI cyber models.
What to do about it
Anthropic banned the identified accounts, added detections and shared intelligence with the industry. But everyone has to defend now, and the one hard requirement is speed. The practical minimum:
- Test your perimeter at the attacker’s tempo. If recon and exploitation run autonomously around the clock, a once-a-year assessment does not save you — continuous exposure monitoring does.
- Prepare for self-adapting malware: signatures alone are no longer enough; you need behavioural detection and fast post-incident analysis.
- Get your secrets in order. API keys and tokens are now primary loot: store them protected, rotate them, and monitor their use so a stolen key cannot quietly fund someone else’s campaign.
- Govern the agents you run yourself. Put a runtime firewall in front of them that gates dangerous actions and keeps a tamper-evident log — the core of the three lines of defense for AI agents, with the practical steps in how to secure an AI agent.
Bottom line
Anthropic’s report is not a story about “AI learning to hack.” It is about AI removing the last barriers: you used to need skill, time and a team — now a goal and access to a model will do. The tooling is still neutral, but the balance of power shifted, and not toward defenders. The good news is that the countermeasures are the same — fast patching, continuous testing, behavioural detection, disciplined secrets and a ready plan — you just have to run them at machine speed. If your services face the internet and your agents run without guardrails, that is where to start, before someone else’s swarm of agents gets there first.