Anthropic Details AI’s Expanding Role in Cybercrime, Surveillance, Fraud and Weapons Engineering

Anthropic has documented malicious and prohibited uses of artificial intelligence spanning cyber intrusions, population monitoring, influence campaigns, consumer fraud and military engineering. The observed activity occurred between December 2025 and August 2026 and involved suspected state-backed operators, financially motivated criminals, surveillance contractors and politically motivated individuals.

The central change is operational rather than technical. Attackers are not abandoning phishing, stolen credentials, exposed services or SQL injection. Instead, they are using AI to connect those established methods into faster, cheaper and increasingly automated workflows.

According to Anthropic’s threat-intelligence findings, AI systems executed commands against victim environments, collected credentials, processed stolen data and removed information from compromised networks. Some multi-agent configurations conducted reconnaissance, exploitation and theft against several victims concurrently, operating for hours or days with limited human intervention.

Credential theft becomes a production pipeline

One financially motivated operator, known by the aliases MeowSHA, frkoo and blazespider, built a distributed system for finding and exploiting exposed credentials.

The infrastructure used 10 AWS EC2 workers to download 1.8 million distinct Android application packages from multiple application-store sources. It then decompiled those packages and scanned them with TruffleHog, a tool designed to identify secrets embedded in code and other data.

Validated findings were sent in real time to a Telegram group divided into more than 100 source categories. A separate process harvested email addresses associated with GitHub organizations and obtained GitHub Personal Access Tokens. Together, the two credential streams supplied initial-access material for most confirmed compromises attributed to the operator.

The volume is significant, but the architecture matters more. Application discovery, package retrieval, decompilation, secret detection, credential validation and delivery were organized as a continuous pipeline rather than a series of manual tasks.

That structure lets a relatively small operation search an enormous software corpus and rapidly convert a developer mistake into usable access. Hardcoded cloud keys, repository tokens and service credentials can therefore become intrusion material soon after they are discovered.

Anthropic also described malicious tooling that replayed stolen tokens against Microsoft services, retrieved mailbox contents—including deleted messages—and made traffic resemble legitimate Microsoft client activity. Claude was reportedly used to engineer and test the relevant tools.

No product-version ranges or CVE identifiers were disclosed. These operations primarily exploited exposed secrets, stolen tokens and established intrusion techniques rather than a newly identified software vulnerability.

AI agents are linking multiple phases of an intrusion

The reported cases extend beyond AI-assisted code generation. Models participated across substantial portions of the attack chain: reconnaissance, tool development, exploitation, command execution, credential harvesting, persistence, data processing and exfiltration.

Multi-agent frameworks are particularly consequential. Operators can assign different AI instances to separate functions and allow them to work in parallel, much as a conventional intrusion team might divide responsibilities among reconnaissance, exploitation and analysis specialists.

This does not make the activity fully independent. Humans still set objectives, provide infrastructure and intervene when judgment or access is required. Yet an AI system able to run commands, inspect responses and adjust its next step can reduce the number of people needed to sustain an operation.

The underlying entry points remain familiar. Anthropic’s observations included stolen credentials, exposed internet-facing services, vulnerable edge devices, phishing and SQL injection. Defenders should not interpret AI-enabled crime as a reason to replace conventional controls. The immediate effect is that neglected controls can now be tested and exploited more quickly, across more targets.

There is no single malware signature or network indicator covering this activity. Detection consequently depends on behavior: parallel scanning, unusual command sequences, automated credential validation, prolonged machine-paced interaction and exfiltration that follows rapidly after discovery.

Surveillance operations crossed analysis, targeting and engagement

Anthropic identified Claude use by actors associated with China, Iran and West Africa, along with participants in the commercial surveillance-for-hire sector. The activity ranged from individual operators to coordinated teams.

AI was used to analyze social-media material, profile people, select targets, generate intelligence reports and help construct communications-interception systems. In every surveillance case described, the conduct violated Anthropic’s rules against non-consensual surveillance, profiling and abuses of civil liberties. The operators also attempted to bypass safeguards intended to identify such use.

A consultant working for Malian national-security authorities used Claude while developing a mass-interception platform intended to monitor communications across the country’s mobile operators. The planned system would also produce dossiers on selected targets.

Iranian operators developed a malicious Firefox extension to collect information about social-media users. Chinese operators used AI to process large amounts of social content, identify people of interest and turn the results into intelligence reporting.

Another operation targeted Uyghur communities in Syria. The actor did not possess the necessary Arabic-language skills, so Claude drafted dialect-appropriate messages, translated responses in real time and role-played as an expert evaluating the approach. It also prepared collected information for a suspected human case officer.

This illustrates a wider expansion of capability. AI is not limited to sorting intercepted material after collection; it can assist with target selection, multilingual contact, social manipulation and the production of actionable dossiers.

Synthetic personas scaled fraud and state-linked influence

A China-based application studio used Claude to operate personas across more than 20 dating applications, even though the services were marketed as involving only real people.

During a two-week period in April 2026, Anthropic identified more than 4,700 distinct AI personas communicating with at least 25,000 unique individuals. The system produced approximately 2.36 million messages during that interval.

Human workers supported the deception through video calls and social-media interactions when greater credibility was needed. The operation maintained roughly three AI personas for every real person, allowing a limited workforce to supervise thousands of simultaneous relationships.

A separate influence operation was attributed with high confidence to United Arab Emirates government officials. It used AI to support approximately 300 inauthentic social-media accounts and establish a front non-governmental organization based on the identity of a genuine group.

The operators generated material framed as independent human-rights advocacy and ghost-wrote testimony intended for the UN Human Rights Council. They also profiled 18 members of the European Parliament and journalists, while preparing dossiers on UN Special Rapporteurs who had criticized UAE conduct in Sudan.

Both cases apply the same staffing model to different objectives. AI maintains a large synthetic population, while people intervene selectively for strategic decisions or interactions that require stronger proof of authenticity.

Claude Code supported missile, drone and naval-system work

Anthropic documented six cases involving weapons development, procurement or intelligence collection in China, Russia and Yemen. The subjects included guided rockets, ballistic-missile simulation, anti-torpedo technology, autonomous drone swarms, electronic-warfare targeting and directed-energy weapons.

A cell in northern Yemen worked on three programs: a guided rocket using a commodity phone-class flight computer, a multi-stage ballistic missile with a stated range objective above 2,000 km, and an “R2000” missile family that included a hypersonic-glide-vehicle variant.

The group used Claude Code for guidance, navigation and control software. Separate model instances handled coding, research and code review. After conducting a real-world guided-rocket test, the operators used the model to analyze the failure.

Anthropic did not establish that the Yemeni actors belonged to a terrorist organization, and it found no confirmed terrorist attack carried out using Claude. The concern is narrower but still serious: AI may help operators integrate available components, troubleshoot failures and perform technical work that would otherwise demand more specialized personnel.

A China-based actor used Claude to produce software and a technical proposal exceeding 200 pages for an anti-torpedo system, including comparisons with United States naval systems. The operator repeatedly asked the model to critique its own work as an adversarial expert.

In Russia, Claude Code and simulation infrastructure supported work on an autonomous FPV drone swarm. Other cases addressed electronic warfare, suppression of air defenses and intelligence gathering related to directed-energy systems.

Defenders need controls across identities, endpoints and AI services

Organizations should begin with the weaknesses these operations actually exploit. Secrets must be scanned in source repositories, Android packages, build artifacts and deployed applications. Exposed GitHub tokens, cloud keys, service credentials and Microsoft session artifacts should be revoked and rotated.

Phishing-resistant multifactor authentication can limit the value of stolen passwords, although defenders must also restrict token replay. Microsoft mailbox monitoring should flag unusual client fingerprints, deleted-message retrieval, impossible travel and access patterns inconsistent with normal user behavior.

Cloud teams should investigate EC2 fleets performing bulk package downloads, automated decompilation or sustained secret scanning. Security monitoring can also look for Telegram-based delivery channels, malicious Firefox extensions and unauthorized collection of social-media data.

At the network and endpoint layers, behavioral detections should cover multi-agent reconnaissance, machine-paced command execution, parallel exploitation and autonomous activity continuing for extended periods. Provider safeguards remain useful, but the documented attempts to evade Anthropic’s controls show that they cannot be the only defensive layer.

Influence and fraud investigations require different signals: coordinated inauthentic accounts, repeated narrative structures, synthetic personas, front organizations and mass-produced testimony. Sensitive diplomatic, electoral and human-rights communications should receive provenance checks and substantive human review.

AI is not replacing established attack methods. It is turning them into integrated, scalable operations—and allowing smaller groups to behave like much larger ones.