Claude misused (1/7) : A good hack no longer tells you who did it

This is the first of a seven-part series on the most interesting stories in Anthropic’s September threat report. It took me a while to get through, because the thing runs to 154 pages. What’s in it is how people are misusing one of the smartest models out there, what’s being used to protect the rest of us, and where that protection fell short as well.

The report covers the accounts Anthropic caught and banned between December 2025 and August 2026 for using Claude to do harm, sorted into seven areas. I’m taking one area per piece and picking three cases from each, because nobody needs all 154 pages retold.

Hacking comes first. A good hack used to tell you something about who did it. If the tools were custom and the campaign ran for months across twenty organisations, it was a government, and if it was sloppy and loud it was probably a teenager. The six cases in this section are the story of how that rule stopped working.

One caveat before the alarming parts. The Register opened its coverage by calling this the latest instalment of “my AI model is more dangerous than yours”, and that’s a fair jab, because a company telling you its product worries governments isn’t a neutral narrator. But this report publishes the attackers’ server addresses and says plainly where its own safeguards didn’t hold, so I’m reading it as evidence and not as an advert. I also write code with Claude most days, which means I can’t treat it as somebody else’s problem.

Skill used to be the fingerprint. Now a spy agency, an extortion crew and two students all leave the same one.

The first case is a Russian espionage group whose malware repairs itself. Anthropic tracks it as GTG-20006 and says its attribution matches public reporting on Midnight Blizzard, a name the US government has tied to Russia’s foreign intelligence service. The old cat-and-mouse went like this: attackers write a tool, defenders learn to spot it, and the attackers lose weeks writing a new one. This group had AI agents watching whether security products had started catching their tools. When one got flagged, the agents rewrote and rebuilt it until nothing flagged it any more, then put it back to work, while the human mostly edited the instructions. They also got into at least three companies that run hotel guest WiFi and pointed guests’ traffic at their own servers, with a particular interest in anyone connected to Ukraine. More than 20 organisations were targeted, and one North African government body lost over 300,000 national identity records. The Russian embassy in Washington didn’t respond when Reuters asked about it.

The second is a crew that read 1.8 million Android apps looking for passwords. Anthropic links several clusters of activity to affiliates of ShinyHunters, the collective known for stealing data and then demanding payment not to leak it. One French-speaking operator ran ten rented servers that downloaded 1.8 million Android app files, unpacked them, and searched for the keys developers had left inside. Anything that worked was posted to a Telegram group automatically. After that the breaches were quick. In one, a single stolen developer token became full control of a company’s cloud in about three hours. In another they pulled more than 2,100 sets of login tokens from over 40 companies in roughly 34 hours, and the report’s line on that one is “AI agents performed nearly all of the work.” When they found a victim’s AI API keys, they moved their own attacks onto those keys, so the victim paid for the computing and the activity showed up under the victim’s name.

The third is two undergraduates running a factory for new exploits. GTG-10007 is a Chinese-speaking group that Anthropic places in Changsha. Two of its operators were identified as undergraduates at a university in Hunan, and one was interviewing for an offensive security job at the time. They pointed Claude at the software inside network security appliances, the boxes companies buy to keep intruders out, and had it hunt for flaws nobody had reported yet, write the attack code, and test it against lab copies until it worked. One of those loops turned up more than a dozen possible unreported flaws in a single month. A separate fleet of thirteen agents collected publicly posted military and government material on a schedule, with nobody at the keyboard, and the group went after around fifty organisations in total.

What I didn’t expect is how ordinary the methods are. The report says “None of the operations in this report depended on some entirely novel technique that defenders have never seen.” It’s stolen passwords, unpatched boxes and phishing, the list every security team already knows. The difference is that the slow, skilled labour in the middle got handed to a model that doesn’t sleep and can run many copies of itself at once. People still chose the targets and decided what to do with the loot, so this isn’t a story about machines going rogue.

If you ship software, read the second case as a to-do list. That crew wasn’t breaking encryption, it was reading what developers left lying around. Search your repos, your app builds and your Docker images for keys this week, and treat an AI API key like a production password, because a stolen one buys an attacker free computing under your name. And don’t buy “discounted Claude” from a reseller you can’t trace. One group in the report sold exactly that, quietly served its customers a different model, and installed a tool that stole their real Anthropic logins and sold them on.

The cyber section of the report is here, with the full list of attacker domains if you run a network, and BleepingComputer has a tighter writeup of the Android app case. Part two is surveillance.