Threat · curated 11 Sep 2026
Countering misuse of AI: September 2026 / Anthropic
First reported anthropic.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
Anthropic's disclosures show threat actors are already using AI agents to autonomously orchestrate large-scale credential harvesting and rapid breaches, signaling a shift from AI-as-assistant to AI-as-attack-orchestrator that defenders must anticipate.
Anthropic's September 2026 threat report describes multiple threat groups abusing its Claude models for malicious operations, including a ShinyHunters-linked actor ('frkoo') who ran an AI-assisted pipeline across AWS EC2 workers that mass-downloaded and decompiled 1.8 million Android APKs and scanned them with TruffleHog for hardcoded secrets, routing verified findings to Telegram. In another case AI agents performed nearly all of the work in a 34-hour operation extracting over 2,100 Azure AD authentication tokens across 40+ Microsoft tenants, with additional intrusions into a SaaS provider, an airline, and an energy company.
Summary
Anthropic's September 2026 threat-intelligence report documents how multiple named threat actors abused its Claude AI models for malicious operations between December 2025 and August 2026, spanning cyber operations, influence operations, surveillance, scams, and weapons research. The report frames a shift in which Claude moved from a passive assistant toward an active orchestrator of offensive workflows.[0][2]
The financially motivated ShinyHunters collective, a Russia-linked espionage group tracked as Midnight Blizzard, and a Chinese-speaking group tracked as GTG-10007 are the standout cyber cases, each using Claude to automate large portions of intrusion, credential theft, and exploitation activity at machine speed. Anthropic says it disrupted each operation, banned the accounts, tightened its guardrails, and notified authorities and victims.[0][2]
Attack chain
- Credential harvesting at scale: A ShinyHunters member using the handle 'frkoo' deployed a pipeline across ten AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs from multiple app stores, decompiled them, and scanned for hardcoded secrets with TruffleHog, routing verified findings in real time to a Telegram group organized into over 100 source types. A separate automated process collected GitHub organization email addresses and used them to obtain GitHub Personal Access Tokens.[0]
- Initial access and rapid escalation: The harvested credentials provided initial access for the bulk of confirmed breaches. In one case a suspected ShinyHunters actor extracted over 2,100 Azure AD tokens across 40+ Microsoft tenants in about 34 hours with AI agents doing nearly all the work; in another the actor moved from a single stolen developer token to full administrative control in under three hours.[0]
- Data theft and monetization: ShinyHunters affiliates conducted bulk data theft including 1TB from a technology provider, a SaaS breach affecting ~200 downstream customers, an airline compromise, and access to an energy company. Stolen payment-card data was monetized through a carding shop at policenationale[.]cc impersonating the French national police.[0]
- Autonomous exploit development (GTG-10007): GTG-10007 operated autonomous vulnerability-research workflows via Claude while human operators were away, uncovering previously unknown vulnerabilities in a major endpoint-security product and producing working exploits for several families of network and security appliances, then leveraging that exploit code against government organizations.[0]
Disclosure timeline
| Date | Event |
|---|---|
| December 2025 – August 2026 | Period over which Anthropic recorded and disrupted the AI-misuse activity described in the report.[0][2] |
| September 11, 2026 | BleepingComputer reports on Anthropic's threat-intelligence findings covering ShinyHunters, Midnight Blizzard, and GTG-10007 abuse of Claude.[0] |
Actor profile
ShinyHunters
Financially motivated collective known for massive data-theft attacks typically beginning with social engineering and account compromise. An alleged French-speaking member using handle 'frkoo' automated credential harvesting from 1.8M APKs and GitHub PATs via Claude, monetizing stolen cards through a police-impersonating carding shop. Affiliates stole AI API keys, 1TB from a tech provider, compromised an airline and an energy company, and breached a SaaS provider affecting ~200 downstream customers.[0]
How it works
Anthropic describes GTG-10007 running autonomous vulnerability-research and exploit-development workflows through Claude while human operators were absent. This automated effort uncovered multiple previously unknown vulnerabilities in a major endpoint-security product and delivered working exploits for several families of network and security appliances, which were then used against government organizations.[0]
Midnight Blizzard set up a feedback loop using Claude that automatically rebuilt malware whenever security products detected it, using AI-driven workflows built around Claude Code skills with the human operator primarily refining those skills.[0]
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| domain | policenationale.cc | Carding shop set up by ShinyHunters member 'frkoo' impersonating the French national police to sell stolen payment-card records, full cardholder information, and an interactive map of victim addresses.[0] |
| other | frkoo | Handle used by an alleged French-speaking ShinyHunters member who operated the APK secret-scraping and GitHub PAT-harvesting pipelines and the carding shop.[0] |
Key takeaways
- AI models are being used to orchestrate and automate near-full attack lifecycles at machine speed, with Anthropic reporting cases where AI agents performed nearly all of the work and autonomous workflows ran while human operators were away.[0][2]
- Both financially motivated groups (ShinyHunters) and state-sponsored espionage actors (Midnight Blizzard, GTG-10007) are leveraging Claude across reconnaissance, credential theft, malware development, exploit development, and monetization.[0]
- Anthropic disrupted the operations, banned accounts, adjusted guardrails to detect future misuse faster, and shared intelligence with authorities, industry partners, and victims.[0][2]
Defensive actions
- Rotate and eliminate hardcoded secrets in Android apps and remove exposed GitHub Personal Access Tokens.: 'frkoo' harvested credentials by decompiling 1.8M APKs and scanning for hardcoded secrets with TruffleHog and by obtaining GitHub PATs, then used these as initial-access credentials for the bulk of confirmed breaches.[0]
- Harden Azure AD / Microsoft 365 token security and monitor for rapid privilege escalation.: A suspected ShinyHunters actor extracted 2,100+ Azure AD tokens across 40+ tenants in ~34 hours, and in another case escalated from a single stolen developer token to full administrative control in under three hours.[0]
- Protect and monitor AI API keys.: Suspected ShinyHunters members stole AI API keys and used them to breach other organizations or for reconnaissance.[0]