According to a company threat report, Anthropic states that a number of threat groups, including those motivated by financial gain and state-sponsored espionage groups associated with Russia and China, tried to misuse its Claude AI model for malicious purposes.
From December 2025 through August 2026, Anthropic documented a variety of instances of AI abuse covering cyber and influence operations, surveillance, scams, and other areas.
Of the activities that were disrupted, one actor used Claude to create a pipeline that scanned 1.8 million Android APKs for hardcoded secrets. Anthropic has removed the accounts in question and modified its guardrails.
The report also assigns the activity to the ShinyHunters group as well as to groups linked to Russia and China.
How ShinyHunters Scanned 1.8 Million Android Apps for Secrets
During the eight-month period, Anthropic interfered with a number of the activities associated with ShinyHunters, a group famous for carrying out large-scale data theft attacks which usually start with social engineering and the compromise of accounts.
A French-speaking member who went by the handle “frkoo” deployed a credential-harvesting pipeline on ten AWS EC2 instances, the pipeline downloading the apps from various app stores and then searching the 1.8 million Android APKs for secrets.
As Anthropic explained, “The pipeline mass-downloaded 1.8 million different Android APKs from multiple app-store sources, decompiled them, and used TruffleHog to search for hardcoded secrets.”
The confirmed findings were sent in real time to a Telegram group which was divided into more than 100 source types.
An actor employed a different automated procedure to gather GitHub organization email addresses and to acquire GitHub Personal Access Tokens.
According to Anthropic, it was these two pipelines that supplied the initial-access credentials that were used in most of the breaches that have been confirmed in connection with the actor.
The actor also established a carding website at policenationale[.]cc which impersonated the French national police in order to sell stolen records of payment cards and the details of the cardholders.
Claude Misuse by ShinyHunters and State-Linked Groups
Anthropic has stated that the suspected ShinyHunters members also obtained AI API keys and used them to gain access to other organisations or carry out reconnaissance. For example, they breached a software-as-a-service provider and took the data of about 200 of its downstream customers.
One of the ShinyHunters actors, with the aid of Claude, took around 34 hours to obtain more than 2,100 sets of Azure AD authentication tokens linked to over 40 corporate Microsoft tenants, Anthropic stating that “AI agents carried out nearly all of the work”.
Other actions carried out by ShinyHunters affiliates have included breaching a technology provider and stealing 1TB of data, compromising an airline, and gaining access to an energy company’s systems.
In one instance, the attacker went from a single stolen developer token to full administrative control within less than three hours.
Anthropic’s report also points to activity carried out by the Russian espionage group known as Midnight Blizzard, which used Claude to automate the development of malware, conduct research, acquire infrastructure, carry out phishing attacks, ensure persistence, manage command-and-control operations, and extract data.
The group established a feedback loop that caused the malware to be rebuilt each time it was detected by security products. Anthropic found that the group was targeting more than 20 government, defence, diplomatic, intelligence and foreign policy organisations, employing methods such as device-code phishing, ClickFix attacks, DNS hijacking via compromised hotel Wi-Fi, takeovers of WhatsApp accounts, and malware for Windows, Android and iOS.
The group carried out its operations by means of AI-powered workflows based on Claude Code skills, the human operator only modifying those skills when necessary.
Anthropic has also outlined an espionage operation carried out by a group that speaks Chinese and which is known as GTG-10007, the members of which used Claude as an engineering and orchestration layer to carry out a range of tasks such as making intrusion attempts upon production systems, carrying out reconnaissance on the networks of foreign governments in the Middle East, in Europe, and in Southeast Asia, conducting vulnerability research and developing exploits against endpoint-security products, and creating malware.
The group carried out automated vulnerability-research workflows while the operators were away and as a result discovered a number of previously unknown vulnerabilities in a major security product and produced working exploits for several families of network and security appliances.
The operations of the group targeted about 50 organizations across a variety of sectors, including government, education, energy, healthcare, and finance, and there were confirmed breaches at an education-technology company, a retailer, and a government agency in Southeast Asia.
Anthropic’s Response and Security Lessons for Developers
Anthropic states that it has disrupted the actors’ use of Claude for harmful purposes and has therefore suspended the relevant accounts.
The company also modified its guardrails in response to the misuse it had observed, introduced additional measures to enable quicker detection of future misuse, and got in touch with the authorities, industry partners, and the victims.
Anthropic listed the categories of misuse it had recorded as including cyber and influence operations, surveillance, scams, model distillation, and the development of biological and conventional weapons, without going into detail about the latter.
For developers and organizations, the report points to several concrete exposures the attackers exploited:
- Check mobile apps for hardcoded secrets because the APK-scanning process specifically focuses on credentials that are embedded in Android apps.
- Because it can be so quickly leading to administrative control, GitHub Personal Access Tokens and other developer tokens should be carefully rotated and scoped.
- Since AI API keys are sensitive credentials, they should be protected, as stolen keys have been used to attack and carry out reconnaissance on other organizations.
- Look at the security of authentication tokens across the various cloud tenants, since Azure AD tokens are being rapidly extracted from dozens of tenants.
What Remains Unconfirmed
The report by Anthropic is based on the activity that it saw and stopped on its own platform, and the assignment of that activity to particular groups is Anthropic’s own judgement.
The full extent of the campaigns apart from Claude, and the identities of the people behind accounts such as “frkoo”, have not been established.
Although Anthropic states that it has banned the accounts and informed the relevant parties, it does not provide a complete breakdown of the total number of successful breaches in all the operations described.
