CyberNew CyberNew
Defensive Security & Blue Team The Record 1 month ago

Anthropic caught Russia-linked spies using Claude in hacking operations

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Defensive Security & Blue Team

Analyst Takeaway

"Image: Brecht Corbeel via Unsplash Anthropic caught Russia-linked spies using Claude in hacking operations Anthropic detected and disrupted a Russia-linked cyber-espionage group that used its AI tool Claude in a hacking campaign targeting more than 20 government, intelligence, diplomatic and defense organizations, the company said Thursday. In a threat report covering activity between December..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Anthropic Claude
Image: Brecht Corbeel via Unsplash

Anthropic caught Russia-linked spies using Claude in hacking operations

Anthropic detected and disrupted a Russia-linked cyber-espionage group that used its AI tool Claude in a hacking campaign targeting more than 20 government, intelligence, diplomatic and defense organizations, the company said Thursday.

In a threat report covering activity between December 2025 and August 2026, Anthropic said it had observed “state-backed hackers, criminal groups and individual hacktivists” attempting to misuse its tools for cyber operations. 

“In each case, we disrupted the activity, used what we learned to strengthen our safeguards, and shared intelligence with authorities and industry partners, where appropriate,” said the company.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →