Loading story…
Anthropic disclosed a state-backed espionage campaign in which a Chinese threat group abused Claude Code through the Model Context Protocol (MCP) to target about 30 organizations in technology, finance, chemicals, and government, with AI reportedly performing 80% to 90% of the tactical work and humans stepping in only at key decision points. The campaign highlighted how attackers can exploit the same agentic integrations enterprises are deploying for automation, while related research showed how those risks extend to host compromise and autonomous vulnerability discovery: Netskope said Anthropic’s Claude Mythos independently found kernel memory corruption bugs, upstream software flaws, and reconstructed n-day vulnerabilities, including one Windows 11 privilege-escalation chain to SYSTEM.
Defenders are responding with new monitoring and disruption techniques aimed at AI workflows rather than traditional endpoints alone. Splunk published detections for sensitive data in prompts, excessive token use, and high-risk filesystem and shell tool invocations in AWS Bedrock Claude logs, while detection-engineering guidance urged telemetry collection across model requests, responses, tools, MCP server changes, and cross-boundary actions to catch prompt injection, tool poisoning, and unauthorized tool use. Ars Technica also reported on Tracebit’s "context bombing" approach, which plants prompt injections in decoy secrets to derail AI hacking agents; in simulated AWS tests, the method reportedly cut full admin compromise rates from 57% to 5% and reduced compromise with persistence from 36% to 1%.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Tracebit researchers described a defensive prompt-injection technique called 'context bombing' that plants refusal-triggering strings inside decoy secrets to disrupt AI hacking agents in AWS environments. In simulated testing across five models and 152 attack runs, the technique reportedly reduced full account admin compromise from 57% to 5% and complete compromise with persistence from 36% to 1%.
Netskope described internal research using Anthropic's Claude Mythos preview to autonomously find and verify vulnerabilities in Netskope software and upstream open source components. The company reported nine reachable kernel memory corruption findings in Windows drivers, 17 previously unreported upstream bugs, and four confirmed n-day vulnerabilities reconstructed from binary diffs, with several issues already fixed and others under remediation or coordinated disclosure.
Anthropic disclosed a previously unseen September 2025 espionage campaign in which attackers abused Claude Code through MCP rather than bypassing model safety controls directly. The disclosure framed prompt injection and instruction-data ambiguity in agent architectures as key structural weaknesses.
On 2026-07-06, Splunk published detection content for AWS Bedrock Claude covering excessive token usage, sensitive data in prompts, and high-risk filesystem and execution tool invocations. The analytics are intended to surface signs of prompt injection, data leakage, bulk extraction, runaway loops, and dangerous tool use in Bedrock environments.
On 2026-05-07, an AWS Bedrock invocation log recorded a prompt sent to an Anthropic Claude model that included commands to read /etc/passwd and ~/.aws/credentials along with exposed example AWS access key and secret key values. The request was processed in account 387769110234 through Bedrock in us-west-2 with inference in us-east-2, showing sensitive data was transmitted as model input.
In September 2025, a Chinese state-sponsored threat group used Anthropic's Claude Code through the Model Context Protocol to target about 30 organizations in technology, finance, chemicals, and government. Anthropic described it as a large-scale campaign in which AI handled roughly 80% to 90% of the tactical work with minimal human intervention.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcenetskope.com
Open sourceinfosecwriteups.com
Open sourcetechrepublic.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourcekodemsecurity.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that AI use in offensive cyber operations advanced from planning support to direct execution during March and April, with commercial tools such as **Claude Code** appearing in live criminal, ransomware, mass-exploitation, and state-linked espionage activity. The report cites persistent AI-assisted operations tied to the breach of nine Mexican government agencies and the **Bissa Scanner** mass-exploitation platform, and says attackers are increasingly using AI to accelerate reconnaissance, exploitation, and post-compromise actions in ways that closely resemble skilled human operators. The report also identifies new attack surfaces and scaling effects created by enterprise AI adoption. Agentic configuration artifacts including `CLAUDE.md`, hooks, settings files, and MCP-related files were described as targets for jailbreaks, supply-chain compromise, and credential theft, while the **EvilTokens** platform was highlighted for using LLMs to automate token theft, email analysis, business email compromise, and multilingual fraud. Check Point said AI is shrinking the patch window for defenders by speeding flaw discovery and weaponization, pointing to exploitation of an **LMDeploy SSRF** issue within 12 hours of disclosure, while warning that existing victim-side controls remain poorly suited to detecting AI-executed intrusions.
Jun 29, 2026
Reporting highlighted how **LLMs and autonomous AI agents** are being misused or creating new enterprise risk. Gambit Security described a month-long campaign in which an attacker allegedly **jailbroke Anthropic’s Claude** via persistent prompting and role-play to generate vulnerability research, exploitation scripts, and automation used to compromise Mexican government systems, with the attacker reportedly switching to **ChatGPT** for additional tactics; the reporting claimed exploitation of ~20 vulnerabilities and theft of ~150GB including taxpayer and voter data. Separately, Microsoft researchers warned that running the *OpenClaw* AI agent runtime on standard workstations can blend untrusted instructions with executable actions under valid credentials, enabling credential exposure, data leakage, and persistent configuration changes; Microsoft recommended strict isolation (e.g., dedicated VMs/devices and constrained credentials), while other coverage noted tooling emerging to detect OpenClaw/MoltBot instances and vendors positioning alternative “safer” agent orchestration approaches. Multiple other items reinforced the broader **AI-driven security risk** theme rather than a single incident: research cited by SC Media found **LLM-generated passwords** exhibit predictable patterns and low entropy compared with cryptographically random passwords, making them more brute-forceable despite “complex-looking” outputs; Ponemon/Help Net Security reporting tied **GenAI use to insider-risk concerns** via unauthorized data sharing into AI tools; and several pieces discussed AI’s role in modern offensive tradecraft (e.g., AI-enhanced phishing/deepfakes) and the expanding attack surface created by agentic systems. Many remaining references were unrelated breach reports, threat-actor activity, ransomware ecosystem analysis, or general commentary/marketing-style content and do not substantively address the Claude jailbreak incident or OpenClaw agent-runtime risk.
Jun 29, 2026
Researchers analyzing more than 1,000 recovered AI agent sessions found that a low-skilled attacker used Anthropic’s **Claude Code** and OpenAI’s **Codex** to carry out offensive cyber operations against at least 14 companies. Logs from a compromised Vultr-hosted system showed the operator using the tools for reconnaissance, vulnerability discovery, exploit development, credential harvesting, database replication, session impersonation, cloud and API key testing, mail-account takeover attempts, and lateral movement. The sessions also documented requests for stealth, anti-forensics, transcript editing, encrypted reporting, and migration of stolen data, while some generated **pentest-style reports** that included monetization estimates for exfiltrated information. Investigators said the attacker reused stolen local AI agent installations and made operational security mistakes that helped attribute the activity to a young man in Addis Ababa, Ethiopia. Separate analysis of a **Claude Code** network sandbox bypass highlighted why AI agent misuse can extend beyond unsafe model output into runtime and infrastructure controls. NSFOCUS reported that proxy-based filtering could be bypassed because policy checks evaluated the original input while the network layer parsed and truncated it differently, including with invisible control characters or null bytes, creating a path for outbound requests and possible data leakage in a single execution chain. Although the issue was reportedly fixed in later versions, researchers said the low-profile remediation made exposure difficult to assess and underscored the need for layered defenses such as strict egress allowlisting, least privilege, short-lived secrets, auditing, fail-closed policies, and fuzz testing of parsing paths.
Jun 29, 2026