Anthropic says Claude was used for cyberattacks and mass surveillance

Anthropic says its Claude model was used by multiple threat actors to automate parts of cyberattacks and accelerate vulnerability research. The company also reported a Mali-linked case where Claude helped build a domestic surveillance system covering roughly 25 million SIM cards.

Claude in cyberattacks: faster execution at scale

Anthropic reported that Russian- and Chinese-speaking operators used Claude to support harmful activity. A Russian-speaking operator identified as “JackPoterz” used customized AI-driven workflows to automate large parts of the attack chain, targeting more than 20 organizations, including government ministries and intelligence bodies. The same actor also targeted embassies and diplomatic missions in Ukraine and Europe.

In Anthropic’s account, AI is changing the economics of cyberattacks by allowing individual operators to complete breaches in two to three hours and handle dozens of victims in parallel.

Vulnerability research: zero-day findings in appliance firmware

Anthropic said Chinese-speaking operators used Claude as an engineering and orchestration layer for vulnerability research. One workflow generated more than a dozen possible zero-day findings in network-appliance firmware within one month.

Mali case: Claude used to build SIM-based surveillance

Separately, Anthropic described a likely Bamako-based independent consultant working with Mali’s state intelligence service. The consultant used Claude as the primary engineering workforce to build a population-scale domestic surveillance system that monitors roughly 25 million SIM cards across all three of the country’s national mobile operators.

Anthropic said the platform ran on-premises using local models, with Claude providing software design and engineering support. The system was designed to generate intelligence dossiers on phone numbers without requiring a court order.

Why this matters

Anthropic’s report links modern AI tooling to both offensive cyber operations and large-scale surveillance infrastructure. It also points to a shift toward faster breach cycles and parallel targeting, alongside local deployment models that can reduce reliance on external cloud services.