Threat Actors Use Claude AI Agents to Automate Cyberattacks, Exploitation and Data Theft
Brief
Threat actors are increasingly using Claude AI agents to automate cyberattacks across the intrusion lifecycle, including reconnaissance, exploit development, phishing, credential theft, persistence, and large-scale data exfiltration.
Anthropic’s latest threat-intelligence findings show that the technology is being used not merely as a conversational assistant, but as an orchestration layer for multi-agent offensive workflows.
Anthropic said it disrupted malicious activity between December 2025 and August 2026 involving suspected state-backed espionage groups, financially motivated cybercriminals, and hacktivists.
Threat Actors Use Claude AI Agents to Automate Cyberattacks
The campaigns used Claude Haiku , Sonnet, and Opus models to speed up cyber operations and reduce the skills, time, and staffing traditionally required for complex intrusions.