Anthropic has released a comprehensive threat intelligence report detailing how its Claude artificial intelligence models were misused by cybercriminals, state sponsored operators, commercial surveillance vendors, and influence networks between December 2025 and August 2026. The company said it identified multiple threat clusters that it classifies as Generative Threat Groups, or GTGs, spanning financially motivated actors, cyber espionage groups, propaganda networks, commercial spyware providers, and politically driven campaigns. According to Anthropic, the growing capabilities of AI have significantly reduced the technical barriers that once separated well resourced operations from smaller threat actors. Rather than using AI only for writing code or answering questions, some operators incorporated Claude into multi agent workflows capable of conducting reconnaissance, exploitation, credential harvesting, and data exfiltration with limited human involvement. Anthropic stated that it disrupted several of these operations while continuing to monitor how AI is being integrated into increasingly complex cyber activities.
The report highlights numerous cyber campaigns that relied on Claude throughout different stages of their operations. One of the most notable cases involved GTG 20006, a Russian linked cyber espionage group that shares operational characteristics with Midnight Blizzard, also known as APT29 and Cozy Bear. Anthropic said the group used AI to automate malware development, monitor security detections, rebuild malicious software after detection, and coordinate phishing and infrastructure management. Other campaigns included GTG 50014, which reportedly automated the download and analysis of approximately 1.8 million Android application packages using cloud infrastructure before extracting hard coded secrets for further use. Another operator linked to the ShinyHunters ecosystem reportedly used Claude to accelerate reconnaissance and support supply chain data theft involving software as a service providers. GTG 10007, a Chinese speaking threat actor, was observed conducting reconnaissance against foreign government networks, researching vulnerabilities in endpoint security products, and developing exploit capabilities while targeting organizations across education, finance, healthcare, manufacturing, technology, retail, energy, and government sectors. Additional groups focused on stealing AI provider API keys, targeting AI vendors, exploiting software platforms, and conducting autonomous reconnaissance and exploitation through coordinated multi agent frameworks capable of operating for extended periods with minimal supervision.
Anthropic also described how Claude was used beyond cyber intrusions to support influence operations, surveillance activities, and information campaigns. According to the report, several groups employed the model to generate political content, rewrite articles, manage fabricated news websites, and automate multilingual messaging for social media campaigns. Other operations used Claude to produce government style briefings, profile social media users, organize open source intelligence, and develop structured databases focused on monitored communities. The report also outlines surveillance related activity linked to actors in multiple regions, including campaigns targeting diaspora communities, religious organizations, activists, political figures, and journalists. Some operators reportedly used Claude to analyze large collections of WhatsApp conversations, Telegram discussions, and social media content before converting the information into structured intelligence reports. Anthropic further identified operations that developed commercial surveillance platforms capable of analyzing online activity, monitoring public opinion, and generating intelligence dossiers for government or commercial customers. Several campaigns also involved automated profiling systems, browser extensions designed to collect user information, and software intended to manage large scale interception and surveillance activities.
Beyond cyber espionage and influence campaigns, Anthropic said it also disrupted attempts by several actors to use Claude for weapons related research and military technologies. According to the company, it neutralized misuse involving guided weapons development, anti torpedo fire control specifications, electronic warfare targeting software, and autonomous drone swarm engineering. Anthropic stated that increased adoption of advanced AI models provides providers with unique visibility into emerging cyber threats and evolving misuse trends that may not yet be visible through traditional intelligence sources. By publishing these findings, the company aims to support governments, technology providers, cybersecurity organizations, and the broader industry with a better understanding of how artificial intelligence is being incorporated into real world cyber operations, surveillance activities, and coordinated influence campaigns while encouraging stronger safeguards for the responsible deployment of advanced AI systems.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
