VENDOR-REPORTED DISRUPTION

Anthropic’s cybercrime disruption report: an agent can amplify a human attacker

Anthropic reported disrupting accounts that used Claude Code to assist a human-directed cybercrime operation, from reconnaissance through extortion support.

What this was

Vendor-reported real-world malicious-use disruption. Anthropic says it banned involved accounts, added detection, and shared indicators; this is not a report of an agent independently escaping or choosing to attack systems.

What happened

In its August 2025 threat-intelligence report, Anthropic said it disrupted a cybercriminal operation that used Claude Code for reconnaissance, credential harvesting, network intrusion support, data-exfiltration decisions, and extortion assistance. Anthropic reported banning the accounts, deploying new detection methods, and sharing technical indicators with relevant authorities. The documented threat is a human-directed actor using AI to accelerate and coordinate work—not the controlled agentic-misalignment behavior described in Anthropic’s separate research.

Why an agent changes the risk

Legacy actors can automate individual tasks. Agentic tooling can join reconnaissance, analysis, code generation, tool use, and iterative decision support into a faster, more adaptive operator workflow—while a human remains accountable for the campaign.

How to test for this

Run purple-team exercises against AI-accelerated attacker workflows: credential discovery, cloud reconnaissance, phishing or social-engineering variants, code modification, data staging, and iterative tool use.
Reduce blast radius with scoped credentials, segmented environments, outbound controls, and strong detection for unusual automation, token use, repository access, and data movement.
Collect high-fidelity telemetry across identity, CI/CD, cloud, endpoints, and agent tools so analysts can connect rapid multi-step activity instead of reviewing isolated events.

Other cases

CONTROLLED EVALUATIONOpenAI Operator: indirect prompt injection becomes an action riskOpenAI’s published red-team work shows how untrusted content can influence a browser-using agent that can operate tools or move data.CONTROLLED EVALUATIONAnthropic’s agentic-misalignment evaluation: model access can resemble an insider threatAnthropic’s fictional corporate simulations test what can happen when a tool-using model has sensitive context, external actions, and a deliberately constructed goal conflict.COORDINATED DISCLOSUREnullifAI: malicious PyTorch models evaded pickle scanning on Hugging FaceResearchers found two Hugging Face-hosted model files with malicious pickle payloads that could reach web shells when loaded in an unsafe environment.

Get a scoped price without a discovery call

Tell us what is in scope and what your audit needs. You get a fixed price and a date, not a quote after two meetings.

Scope an assessment See pricing