Anthropic has published a report detailing how state-sponsored hackers, cybercriminals and other bad actors have been misusing its Claude AI models for activities including automated cyberattacks, drone swarm development, mass surveillance and bioweapons research. The report, covering activity disrupted between December 2025 and August 2026, shows a marked escalation from a previous disclosure in November, with a widening range of malicious users now including Russian state hackers and data-extortion gangs such as ShinyHunters, underlining growing concern about how AI tools can accelerate and scale harmful operations even as developers work to detect and shut them down.

The findings span seven "harm areas", including cyber operations, biological misuse, conventional weapons development and influence campaigns. Notably, a Russian espionage group linked to the SVR, tracked as GTG-20006 (also known as Cozy Bear or APT29), used Claude to automate its entire attack chain against more than 20 organisations, including embassies and defence agencies across Europe, Ukraine and the Middle East. Separately, affiliates of ShinyHunters used AI agents to conduct a large-scale data theft from a SaaS provider's customers, stealing over 2,100 Azure AD token sets in roughly 34 hours. Anthropic also flagged five cases of attempted bioweapons-related misuse, including an attempt to use Claude to support grant-writing research into making the chikungunya virus more dangerous, though it said its most advanced models were not implicated except in one case.