Observed incident

GTG-20006 automates espionage with Claude

Reported

What happened

Anthropic reported Claude-driven phishing, malware adaptation and data theft targeting Ukrainian and European government, diplomatic and defense interests.

Parties and reporting

AI tools and systems: Claude, Claude Code

Outcome

Anthropic disrupted associated activity and strengthened safeguards.

Operating lesson

Combine identity protections with behavioral detection; static malware signatures alone can be rapidly evaded.

Evidence and limits

Russian state-nexus attribution is Anthropic's assessment, consistent with Midnight Blizzard reporting. Human operators selected targets and reviewed results.

Sources