AI agent incident

Anthropic reported state and criminal groups running operations through Claude

Reported · 2 sources

What happened

Anthropic said Claude was used by state-sponsored and criminal groups for cyberattacks, weapons design, propaganda and surveillance between December 2025 and August 2026. One disrupted group, the Russian state-sponsored GTG-20006, used Claude to rebuild malware after it was detected.

Why it matters

Rebuilding detected malware is maintenance work, and handing it to a model shortens the useful life of every detection you ship. Model API traffic is a place defenders now have to look.

Sources

  1. The Hacker News Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
  2. The Hacker News Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

New incidents by email

Get incidents like this one in your inbox

New AI agent incidents are covered in the briefing, with what to check on the agents you already run. At least once a week, free.

You confirm by email. Unsubscribe in one click.

Background reading

Coding agent The glossary definition, in plain English.

Cite or correct this record

“Anthropic reported state and criminal groups running operations through Claude.” The Permission Layer AI Agent Incident Database, https://thepermissionlayer.com/incidents/anthropic-threat-intel-claude-misuse/. Database updated October 22, 2026.

Every record traces to the dated sources above. If something here is wrong or missing, email [email protected] and it gets fixed. See this record in the full list.

The Permission Layer

Get the briefing by email

At least one email a week on AI agent identity, permissions, security and spend, written for the people who approve agent access. Five-minute read, free.

You confirm by email. Unsubscribe in one click.