Anthropic Threat Report: Claude Used to Automate Cyberattacks and Build a 25 Million SIM Surveillance System

A new Anthropic threat report details how Russian, Chinese and state-surveillance operators weaponized Claude — and why “sophistication no longer signals sponsorship”

Anthropic’s latest threat intelligence report, published Thursday, documents eight months of disrupted operations in which threat actors used its Claude models to automate cyberattacks, build population-scale surveillance systems and run influence campaigns. The findings stretch from a Russian-speaking espionage operator targeting more than 20 government and defense organizations to a Mali-linked consultant who used Claude as the primary engineering workforce behind a platform monitoring roughly 25 million SIM cards.

The report covers activity disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and model distillation. Claude Haiku, Sonnet and Opus were used in the cases; notably, none of the documented misuse involved Claude Fable or Mythos-class models, which carry additional safeguards that Anthropic says sharply reduce harmful cyber capability.

The headline trend: AI as orchestrator, not assistant

The most consequential shift Anthropic describes is structural. A majority of the disrupted operations used AI not as a chatbot answering questions but as an orchestration layer — multi-agent frameworks executing reconnaissance, exploitation and data exfiltration end to end. Humans remained in the loop mainly to pick targets and review stolen data.

The report’s central warning is that “sophisticated attacks no longer require sophisticated attackers.” AI has collapsed the labor and tooling gap that once separated well-resourced state operations from lone individuals. A hacktivist with stolen API keys, scattered financially motivated criminals and a suspected state espionage operator each sustained multi-victim campaigns that a year earlier would have demanded teams of skilled specialists. For defenders, the report concludes, sophistication has stopped being a reliable signal of who is behind an operation.

GTG-20006: the Russian operator who automated his own malware lab

The flagship case study, designated GTG-20006, involves a Russian speaker using the handle “JackPoterz” whose tradecraft Anthropic assesses as consistent with Russian state-nexus espionage and public reporting on the group known as Midnight Blizzard. The operator ran customized AI-driven workflows that automated much of the attack chain — development, infrastructure acquisition, phishing, persistence, command-and-control and data exfiltration.

The toolkit included two families of Windows implants, a mobile exploitation kit, a credential stealer targeting browser password stores, a phishing platform built to mimic government organizations, and an administrative console for managing compromised accounts. Most striking was the self-healing loop: monitoring agents watched for signs that deployed malware had been flagged by security products, then autonomously modified and rebuilt the malware, iterating until it passed undetected before staging it on disposable hosting servers for phishing, ClickFix and DNS-hijacking campaigns.

Targets identified in the operator’s planning and live operations numbered more than 20 organizations — government ministries, defense and intelligence bodies, embassies, think tanks and defense-industrial firms — concentrated in Ukraine and Europe, with a thematic focus on military drone technology and its supply chains. Chinese-speaking operators, separately, used Claude as an engineering and orchestration layer for vulnerability research, with one workflow producing more than a dozen candidate zero-day findings in network-appliance firmware within a single month.

The economics of breach have collapsed

Anthropic frames the danger through a concept it calls uplift — the speed, scale and depth an actor gains with AI versus without. The numbers are stark: individual operators can now complete breaches in two to three hours and manage dozens of victims in parallel. The November 2025 autonomous-attack operating model has proliferated across every actor class the company investigated, aided by publicly available offensive agent frameworks that reproduce the same scaffolding for anyone who downloads them.

From cybercrime to surveillance state

The surveillance cases may be the report’s most chilling. A likely Bamako-based independent consultant working with Mali’s state intelligence service used Claude as the primary engineering workforce to build a domestic surveillance system covering roughly 25 million SIM cards across all three of Mali’s national mobile operators. The deployed platform ran on-premises with local models, with Claude supplying software design and engineering support — and it was built to generate intelligence dossiers on phone numbers without requiring a court order. Other disrupted cases included commercial spyware vendors, state propaganda institutions and networks of fake dating apps engineered for fraud.

Why this matters for crypto

For the crypto sector, the report reads as a confirmation of an uncomfortable trend line. The industry has spent 2026 absorbing an accelerating wave of social-engineering attacks — forged government data requests, breach-enabled phishing of hardware wallet customers, AI-generated fake applications stealing from browser-extension wallets. Anthropic’s finding that AI-driven phishing infrastructure can now be researched, registered, configured and monitored end to end by autonomous agents explains much of that escalation. When the report states that every layer of offensive operations has been uplifted — reconnaissance, tooling, data processing, exploitation — seed-phrase holders are squarely in the blast radius.

Anthropic says it disrupted every operation described, hardened safeguards in response and shared intelligence with authorities and industry partners where appropriate. The company published the report on the theory that disclosure helps other developers recognize similar patterns and gives governments a clearer view of emerging threats — a stance that at least puts the defensive community on notice.

The sobering takeaway is not that a frontier model went rogue; it is that ordinary access, in the wrong hands, now substitutes for a team. As models grow more capable, Anthropic warns, risks rise with them unless developers and society’s defenders act together. In the interim, the assumption that a sloppy attack implies a sloppy — or unsponsored — attacker is officially obsolete.