Anthropic Report Details Claude Misuse in Cyberattacks and Surveillance Operations

Anthropic published a new threat intelligence report this week detailing how it identified and disrupted various attempts to misuse its Claude AI models between December 2025 and August 2026. The report covers seven categories of harmful activity, including cyber operations, surveillance, influence campaigns, scams, biological misuse, weapons development, and unauthorized model replication.

According to the findings, a Russian-speaking operator used customized AI-driven workflows to automate significant portions of a cyberattack chain, targeting more than 20 organizations, including government ministries, intelligence agencies, and diplomatic missions across Ukraine and Europe. Separately, Chinese-speaking operators reportedly used Claude to support vulnerability research, with one operation producing over a dozen potential previously unknown security flaws in network equipment within a single month.

Surveillance Case Involved Mass SIM Card Monitoring

In a separate incident, an independent consultant based in Mali, working alongside the country’s state intelligence service, allegedly used Claude as a primary engineering resource to build a large-scale domestic surveillance system. The platform reportedly monitored roughly 25 million mobile phone numbers across the country’s national carriers, generating intelligence profiles without requiring judicial authorization.

Anthropic said artificial intelligence is changing the economics of cybercrime, enabling individual actors to complete complex breaches within just a few hours while managing multiple targets simultaneously. The company stated that in each documented case, it disrupted the activity, strengthened its safety measures, and shared relevant intelligence with law enforcement and industry partners where appropriate.