For most of the past two years, security teams have treated AI as something attackers use to write better phishing emails or clean up their code. Anthropic’s own disclosure this week describes something further along: agent frameworks running reconnaissance, exploitation and data theft against dozens of victims in parallel, for hours or days at a stretch, with a human checking in only occasionally, if at all.
What Anthropic Found
In a threat intelligence report covering activity it disrupted between December 2025 and August 2026, Anthropic said it identified and shut down multiple threat clusters that had turned its Claude models into operators rather than assistants. The report spans seven harm categories, from influence operations to illicit model distillation, but the cyber operations cases are the ones that should reorder a CISO’s threat model.
Anthropic described a spectrum of autonomy across the clusters it tracked. At one end, human operators still made every targeting decision and used Claude as an advanced tool. At the other, the company found, “operations ran autonomously, with minimal human input or supervision,” including multi-agent frameworks that conducted reconnaissance, exploitation and theft against multiple victims in parallel. Anthropic said the pattern showed up across several unrelated clusters, not one isolated incident.
Media Partner
Espionage at Machine Speed
The clearest case is GTG-20006, a cluster Anthropic assessed with high confidence to be Russian state-sponsored espionage activity consistent with Midnight Blizzard. The operators targeted more than 20 distinct organizations and used AI agents to run agent swarms, in which a lead agent broke reconnaissance and post-exploitation work into pieces and dispatched them to subagents running in parallel. The operation exfiltrated more than 300,000 national identity records and commercial registry data belonging to more than half a million companies. Anthropic said the operation maintained persistent campaign memory: target lists, harvested credentials and standing instructions were saved across sessions, so operators could resume mid-campaign with the program’s accumulated context intact.
A Breach Completed Before Lunch
A second cluster, GTG-50014, tied to the ShinyHunters extortion ecosystem, used AI agents to analyze 1.8 million distinct Android APKs and identify roughly 200 downstream customers whose systems it went on to compromise. In one run, the operation harvested more than 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours. Anthropic’s own accounting of the case load is blunt: breaches completed in two to three hours, with dozens of victims handled in parallel by a small number of human operators directing AI agents to do the work that used to take a team days.
An Exploit Foundry With a Memory
A third cluster, GTG-10007, which Anthropic traced to a Chinese-based exploit development operation, used Claude to build and maintain what amounted to a persistent research pipeline, with standing instructions saved across working sessions so the agent could pick up vulnerability research and exploit development exactly where it left off. None of these clusters required a novel model capability. They required only that an operator wire an agent framework into existing tools and let it run.
A fourth pattern Anthropic flagged sits closer to the supply chain than to any single intrusion. The company disrupted GTG-50021, a Russian and Ukrainian-speaking group that ran a fraudulent Claude reseller operation, offering access that Anthropic said was “neither cheap nor actually Claude”: customers believed they were buying discounted access, but their traffic was silently proxied to a different model while the reseller’s own tooling installed a credential harvester that stole their real Anthropic account logins and sold those onward to other proxy resellers. A separate set of actors, Anthropic said, compromised AI wrapper services built on LiteLLM using prompt injection to exfiltrate the production API keys those services held. In each case, the target was not a model but the credentials sitting behind it.
What It Means for the Security Leader
The operational lesson is not that AI made these actors smarter. It is that AI made them faster and more parallel, at a moment when most detection programs are still tuned to human-paced intrusions. Anthropic said it identified most of these clusters through anomalous usage patterns on its own platform, such as a single account driving an implausible volume of tool calls against a narrow set of targets, rather than through a tip from a victim. That detection model works for Anthropic because it can see the request stream. Most enterprise security teams cannot see it at all: agent traffic to a third-party AI provider typically looks, from the network’s vantage point, like ordinary API traffic to a SaaS vendor. Anthropic itself is now the disruption point in several of these cases, which is a useful check but not a substitute for a defender’s own visibility. Earlier this month, Google’s Threat Intelligence Group published its own account of adversaries treating AI systems as both target and tool, and separately, three US agencies accused China-based labs of mass AI model theft through distillation. Read together, the pattern is not one vendor’s problem. It is a shift in how quickly an intrusion, once started, can finish.
Anthropic’s own guidance for defenders centers on treating AI access itself as sensitive infrastructure. API keys, session tokens and the sandboxes, proxies and reseller arrangements customers build around AI access all sit inside the attack surface now, not outside it. Procurement teams that shop around for a cut-rate AI subscription routed through an unofficial reseller are, in effect, handing credentials to a party the security team has no visibility into.
What to Do Now
- Treat AI API keys, session tokens and agent-to-tool credentials with the same access controls, rotation policy and monitoring as production infrastructure credentials, not as a developer convenience.
- Build detection around agent behavior, not just model output: sustained multi-hour or multi-day tool-call sequences against the same target set are a signal, even when each individual call looks benign.
- Restrict AI access procurement to authorized vendor channels and flag any arrangement that routes traffic or credentials through an unverified intermediary.
- Assume that once an intrusion starts, the window to detect and contain it before automated tooling finishes the job is measured in hours, not days.
Source: Anthropic
