Anthropic released a threat intelligence report detailing the misuse of its Claude models between December and August. The company observed that individual hackers now utilize AI to conduct complex cyberattacks that previously required large, state-sponsored teams. These operations often result in breaches completed within two to three hours.
The report identifies seven Chinese AI labs, including Alibaba, Moonshot AI, and DeepSeek, for allegedly distilling Claude’s capabilities to train their own models. One campaign involving Alibaba-affiliated operators reached nearly 3 million exchanges per day, totaling over 151 million interactions between May and July.
Specific threat actors were tracked, such as GTG-20006, linked to the Russian group Midnight Blizzard, which targeted Ukrainian government and military staff. Another group, GTG-10007, utilized agent swarms to identify over a dozen zero-day vulnerabilities in a single month, while GTG-50020 targeted approximately 30 AI companies.
Anthropic also documented the use of Claude in a surveillance platform monitoring 25 million SIM cards in Mali. Additionally, the company disrupted six weapons development cases, including an attempt to build an autonomous kamikaze drone swarm. Anthropic has since implemented identity verification for unsupported regions.
