Skip to content
HACKTECH
AI securityReported Published 2 sources

Anthropic report details AI-orchestrated intrusions it disrupted over eight months

Anthropic's September 2026 threat report describes misuse of its Claude models that the company disrupted between December 2025 and August 2026 across seven harm areas, including cyber operations, influence operations, and scams and fraud. It states that a majority of the operations described were enabled by AI via direct execution or orchestration, with multi-agent frameworks executing reconnaissance, exploitation and data exfiltration while humans set targets and reviewed exfiltration. Cases include suspected ShinyHunters affiliates whose session-store dump yielded over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours, and an actor that attacked roughly thirty AI companies in about four days. Anthropic says it disrupted each operation, strengthened its safeguards and shared intelligence with authorities and industry partners where appropriate.

  • Anthropic
  • threat intelligence
  • agentic AI
  • token theft
  • hardcoded secrets
  • API keys

What the sources report

  • In the ShinyHunters-linked cluster (GTG-50014), one compromise escalated from a single stolen developer token to full administrative control of a victim's cloud environment in roughly three hours; for the token-dump case Anthropic states that AI agents performed nearly all of the work.
  • One operator among the suspected ShinyHunters affiliates ran a pipeline across 10 AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs, decompiled them and scanned them for hardcoded secrets with TruffleHog.
  • GTG-50020 took an AI vendor's production API keys after injecting instructions into its automated evaluation sandbox, then repeated one successful attack path against roughly thirty AI companies in about four days; Anthropic says the keys were stolen from customers' environments and its own systems were not compromised.
  • Espionage actor GTG-20006 used an AI-assisted workflow that automatically rebuilt and redeployed its toolkit when security products detected it; Anthropic's investigation identified more than 20 distinct organisations targeted, concentrated in Ukraine and Europe.
  • GTG-10007 targeted roughly fifty organisations, and one of its AI workflows iterating continuously on network appliances yielded more than a dozen possible zero-day findings in a single month.
  • Anthropic summarises the results as breaches completed in two to three hours and dozens of victims handled in parallel by individual operators.

What it means for your organisation

None of the operations Anthropic describes depended on an entirely novel technique; they used stolen credentials, unpatched edge devices, exposed services, SQL injection and phishing, with reconnaissance, exploitation, tool development and data processing delegated to AI models running at machine speed and in parallel. Anthropic puts the result at breaches completed in two to three hours and dozens of victims handled in parallel by single operators, which leaves little room for response measured in days. Playbooks should assume token theft and fast escalation, and revoking credentials should take minutes.

What we check

  • Scan Android and iOS release builds for hardcoded API keys, cloud credentials and tokens, and confirm any exposed secret is revoked rather than only removed from code.
  • Review Entra ID session and refresh token lifetimes, token protection policies and how quickly sessions can be revoked across tenants and connected SaaS apps.
  • Map what one stolen developer token can reach across CI/CD, cloud and SaaS admin paths, and test whether alerts fire well inside a three-hour window.
  • Inventory AI provider API keys, including where they are stored, how they are scoped and rotated, and whether unusual usage triggers alerts.
  • Run an incident response exercise that assumes an automated intruder and measures time to detect, contain and revoke credentials.

Sources

Services that cover these checks

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Mobile application testing

    iOS and Android testing of the binary, on-device storage and transport, and of the backend API the app calls, replaying the app's own tokens to check whether one user can read another's data. On the device we check what the keychain or keystore stores, whether certificate pinning survives a bypass attempt and what deep links can trigger.

    Duration: 6 to 10 working days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

  • AI & LLM application testing

    Adversarial testing of features built on large language models: chat assistants, retrieval-augmented search, agents with tool access, and generated output that reaches users or other systems. We test whether the model can be steered into leaking data, taking actions it should not, or passing untrusted output into the rest of your stack.

    Duration: 4 to 10 working days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works