Anthropic Says AI Is Enabling State-Level Cyber Operations by Less-Skilled Actors
Summary
Anthropic says its report documents Claude misuse in cyber operations and other harms, including espionage, token theft and model distillation. The company says it disrupted the activity and shared intelligence with partners.
Key points
- Anthropic reported Claude misuse across seven harm categories, including cyber operations, scams, influence campaigns and model distillation.
- The company says a Russian-aligned actor targeted more than 20 government and defense organizations across Ukraine and Europe, using AI to modify malware after security detections.
- Anthropic says operators linked to ShinyHunters dumped 2,100 Azure access tokens across more than 40 corporate tenants in about 34 hours.
- The report describes Chinese operators using Claude in vulnerability research workflows that produced more than a dozen possible zero-day findings in a month.
- Anthropic accused seven China-based labs of distillation activity; it says Alibaba-linked operators generated nearly 3 million exchanges per day using more than 3,500 fraudulent accounts.
- Anthropic says it disrupted the reported operations, strengthened safeguards and shared intelligence with authorities and industry partners where appropriate.
Article Details
- Event Type
- Anthropic reported AI-enabled cyber operations, influence campaigns, scams, biological misuse, weapons-related activity, and model-distillation attempts involving its Claude models.
- Impact
- Anthropic reported espionage targeting more than 20 government and defense organizations across Ukraine and Europe; theft of more than 2,100 cloud access tokens across over 40 corporate tenants; compromises involving stolen developer tokens and cloud environments; and theft of mailboxes, software-development materials, and personal and company records. It said it disrupted the reported operations, strengthened safeguards, and shared intelligence with authorities and industry partners where appropriate.
Threat Actors
Vendors
Alibaba Group#AnthropicAnthropicAnthropic says AI has erased the skill gap that once separated state-backed hackers from lone criminals, after documenting Claude misuse across cyber operations, influence campaigns, scams, biological misuse, andDeepSeek#AnthropicMoonshot AIThe report also has a section dedicated to distillation attacks that Anthropic claims were carried out since February by seven labs based in China, including Alibaba, DeepSeek, Moonshot AI, Xiaomi and Zhipu.Xiaomi#AnthropicZhipu#Anthropic
Products
AzureOne supply-chain breach ended with a dump of more than 2,100 Azure access tokens spanning more than 40 corporate tenants in about 34 hours.Claudehas erased the skill gap that once separated state-backed hackers from lone criminals, after documenting Claude misuse across cyber operations, influence campaigns, scams, biological misuse, and weapons-relatedQwenfrom more than 3,500 fraudulent accounts” to harvest the outputs of Claude Opus models for training its Qwen systems.
Countries
ChinaThe report also has a section dedicated to distillation attacks that Anthropic claims were carried out since February by seven labs based in China, including Alibaba, DeepSeek, Moonshot AI, Xiaomi and Zhipu.UkraineA Russian-aligned campaign targeted government and defense organizations in Ukraine and Europe.
Industries
Artificial intelligenceArtificial intelligence has removed the skill advantage that once set state-sponsored hackers apart from lone criminals, according to a threat report Anthropic published Thursday that documents misuse of its ClaudeDefenseA Russian-aligned campaign targeted government and defense organizations in Ukraine and Europe.GovernmentA Russian-aligned campaign targeted government and defense organizations in Ukraine and Europe.