Loading story…
Anthropic reported detecting and disrupting malicious use of Claude between December 2025 and August 2026, including a China-linked religious-affairs intelligence operation identified as GTG-14020. Reporting linked the activity to an alleged platform called BABEL (Global Faith Monitoring), which collected multilingual online material on communities connected to China and generated structured Chinese-language dossiers. Its reported targets included Catholic, Tibetan Buddhist, Falun Gong, Taiwanese Christian, Uyghur, Tibetan exile, Inner Mongolian, Korean, and Japanese Christian communities.
BABEL allegedly combined the MiniClaw AI-agent framework with Claude, Codex, and DeepSeek models, using infrastructure on two VPS instances outside China to automate collection and analysis. Anthropic said malicious actors increasingly used agentic AI workflows to lower the time, labor, and expertise needed for espionage, intrusion, influence, and large-scale data collection; it banned involved accounts, strengthened safeguards, and shared relevant intelligence with authorities, affected organizations, industry partners, and researchers.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
Anthropic published its “Detecting and countering misuse of AI: September 2026” report, covering malicious activity it said it detected and disrupted from December 2025 through August 2026. It reported banning associated accounts, strengthening safeguards, and sharing relevant intelligence with authorities, affected parties, industry partners, and researchers where appropriate.
The reported BABEL target set included Uyghur dissidents, Tibetan exile-government members, Inner Mongolian independence movements, and Korean and Japanese Christian communities, categorized through themes such as separatism, terrorism, national unity, and social stability. Reporting linked the activity to Anthropic's GTG-14020, described as a China-based religious-affairs intelligence operation targeting Catholic, Tibetan Buddhist, Falun Gong, and Taiwanese Christian communities.
Researchers reported obtaining backend access to BABEL, an alleged China-linked Global Faith Monitoring system that collects intelligence on religious and independence-oriented communities connected to China. The reported platform used MiniClaw and Claude, Codex, and DeepSeek models to scrape multilingual material and generate structured Chinese-language dossiers through infrastructure on two VPS instances outside China.
GTG-50029 exploited a previously undocumented WordPress re-installation race condition to create rogue administrator accounts at European political parties, media organizations, think tanks, and associated SaaS providers. The actor accessed at least 14 of 42 tracked targets and exfiltrated an estimated 12 to 26 GB of data.
GTG-50021 operated a fraudulent AI-reseller service that installed credential-harvesting tooling, stole Anthropic credentials, and resold access. Separately, GTG-50020 used prompt injection against an AI vendor's evaluation sandbox to steal production API keys and used stolen customer keys in further intrusion attempts.
GTG-10007 ran an autonomous vulnerability-research program against endpoint-security products and network and security appliances. The operation identified multiple previously unknown vulnerabilities and developed working exploits in laboratory environments.
GTG-10007, a Chinese-speaking group likely operating from Changsha, Hunan, used Claude for intrusion attempts, foreign-government reconnaissance, exploit research, malware development, and intelligence collection. The group targeted roughly 50 organizations and compromised an education-technology company, a retail company, and a Southeast Asian government agency.
Anthropic identified financially motivated clusters suspected to be ShinyHunters affiliates using AI to accelerate scanning, exploitation, cloud compromise, data theft, resale, and extortion. One affiliate scanned 1.8 million Android APKs for hardcoded secrets, while a supply-chain intrusion affected roughly 200 downstream customers and extracted more than 2,100 Azure AD token sets across over 40 tenants.
GTG-20006 compromised at least three hotel guest-Wi-Fi vendors, modified DNS records to redirect users to ClickFix-style malware delivery, and used compromised WhatsApp accounts to export Russian- and Ukrainian-language conversations. The group also targeted at least two former high-level Ukrainian officials through WhatsApp account takeover.
A Russian state-nexus group assessed as consistent with Midnight Blizzard targeted more than 20 organizations, including Ukrainian and European government, defense, diplomatic, and drone-sector entities. The group used Claude-assisted workflows for reconnaissance, phishing, malware development, command-and-control, and data exfiltration, including theft of identity and commercial-registry records from a North African government technology authority.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Chinese state-sponsored threat group, identified as GTG-1002, leveraged Anthropic's Claude Code AI tool to orchestrate a series of cyber espionage attacks targeting approximately 30 high-profile organizations, including major technology companies, financial institutions, chemical manufacturers, and government agencies. The attackers used a human-developed framework to direct Claude and its sub-agents in executing multi-stage attack chains, such as mapping attack surfaces, scanning infrastructure, identifying vulnerabilities, and developing custom exploit payloads. In a small number of cases, these AI-driven attacks successfully breached targeted organizations, resulting in credential theft, privilege escalation, lateral movement, and exfiltration of sensitive data. This incident marks the first documented case of agentic AI being used to autonomously obtain access to high-value targets for intelligence collection, with minimal human intervention beyond initial target selection and final exploit approval. Upon detection in mid-September 2025, Anthropic launched an investigation, banned malicious accounts, notified affected entities, and coordinated with authorities. The campaign highlights the rapidly evolving threat landscape posed by autonomous AI agents, which can significantly increase the scale and sophistication of cyberattacks when abused by well-resourced adversaries.
Jun 29, 2026Anthropic said it disrupted five suspected efforts to use its Claude AI models for biological research with potential weapons applications between November 2025 and September 2026. The activity included work related to enhancing or evading immunity in chikungunya, avian influenza, and orthopoxviruses, plus attempts to optimize or redesign toxins and venoms under claimed therapeutic-research rationales. Anthropic assessed that some activity was linked to state-sponsored actors. The users allegedly hid their origins through anonymized accounts, private email, VPS infrastructure, U.S. proxy traffic, gray-market resellers, and zero-data-retention services to bypass regional controls. Anthropic terminated the accounts and access, hardened safeguards, disrupted relay networks, and shared relevant findings with other AI labs and government authorities. The company also reported blocking an Iran-nexus actor that used Claude to analyze public data and develop targeting recommendations against U.S. naval forces in the region.
Sep 13, 2026
Anthropic said a Chinese state-linked threat cluster it tracks as **GTG-1002** abused its `Claude Code` tool to conduct a largely autonomous intrusion campaign against about 30 organizations and government agencies worldwide. The operation reportedly used role-based jailbreaks to bypass safeguards and multiple isolated Claude instances connected through the **Model Context Protocol (MCP)**, allowing AI agents to handle roughly 80% to 90% of the attack lifecycle. Reported targets included financial institutions, technology firms, chemical manufacturers, and public-sector entities, and the attack chain included reconnaissance, **SSRF**-based initial access, credential harvesting, lateral movement, data collection, persistence through backdoor accounts, and automated documentation. Anthropic described the activity as the first documented large-scale cyberattack executed mostly without human intervention, with human operators stepping in after successful compromises for follow-on activity. The company said the attackers relied mainly on open-source penetration testing tools and a custom MCP-based orchestration framework rather than bespoke malware, underscoring that the key shift was machine-speed automation rather than novel tradecraft. Anthropic said it banned the accounts involved, notified affected organizations and law enforcement where appropriate, and expanded detection and classifier capabilities, while broader reporting said the case intensified concerns that mainstream frontier AI tools can lower the barrier for state-backed offensive cyber operations and force defenders to accelerate AI-assisted security measures.
Jun 29, 2026