Anthropic report links Claude to theft of 2,100 cloud tokens in 34 hours

An Anthropic threat intelligence report describes cybercriminals and state-sponsored groups using commercial AI to automate network intrusions, evade endpoint security and seize corporate cloud environments. In one incident, suspected affiliates of the cybercrime syndicate ShinyHunters used Claude in an operation that extracted more than 2,100 Azure AD authentication tokens across more than 40 corporate cloud environments in approximately 34 hours, the 154-page report says.

The raid compromised sensitive data belonging to roughly 200 customers of a software provider. AI agents carried out nearly all the operational tasks, according to Anthropic.

Azure AD, now part of Microsoft Entra ID, uses temporary cryptographic credentials that let users access cloud services without entering passwords again. Attackers who harvest the tokens can bypass multi-factor authentication (MFA) and gain persistent, legitimate access to downstream corporate databases.

ShinyHunters has previously claimed responsibility for major breaches at multinational companies including Ticketmaster and Santander Bank, and for breaching a portal associated with the FBI’s law enforcement sharing network.

The report describes “vibe hacking” as an approach in which attackers give Claude high-level objectives rather than manually coding an intrusion. The model then writes, runs and troubleshoots scripts in a continuous loop until it exploits a vulnerability. Software coordinating multiple AI agents across different stages of a breach has helped take this approach beyond isolated use by elite state actors and into the broader cybercrime ecosystem, Anthropic says.

In another case, an attacker with a stolen developer token gained full administrative control of a company’s cloud infrastructure in approximately three hours. Claude helped map the unfamiliar corporate directory, locate high-value data repositories and write custom code to exploit system vulnerabilities.

Anthropic’s findings point to a sharp drop in the cost and technical barriers to cyberattacks. Sophisticated intrusions have historically required specialized human expertise, leading advanced persistent threat (APT) groups to focus on wealthy, high-value enterprises to justify their costs. The report says autonomous AI agents have pushed the marginal cost of attacks and the technical barrier to near zero, increasing risks for mid-sized and smaller businesses.

Russian state-sponsored espionage groups, meanwhile, used AI agents in a campaign to alter custom malware when endpoint security products blocked it. The agents monitored whether the software detected the malware, then modified and recompiled the code, repeating the process until the payload evaded detection, the report says.

The automated changes resemble polymorphic malware and echo warnings from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI about machine learning being integrated into foreign cyber-espionage operations, notably by groups originating from Russia, China and North Korea.

AI-assisted operations also enabled attackers to run multiple campaigns at once. Anthropic documented a Russian-speaking cybercriminal, previously known for targeting financial technology and hotel-booking platforms, who used parallel AI agents to scout potential victims and test external entry points. The attacker took approximately 26 gigabytes of proprietary data from a victim, then demanded between $1.5 million and $2.5 million, threatening to sell the data on the dark web if the ransom was not paid. Immediately afterward, the same infrastructure was used to probe roughly 30 AI companies over four days.

The report also details AI-enabled consumer fraud. Anthropic disrupted a China-based application developer that used Claude to run an automated social-engineering network, deploying more than 4,700 distinct AI personas on multiple dating applications. Over two weeks, the personas held highly personalized, long-term conversations with at least 25,000 users.

To appear authentic and evade platforms’ detection algorithms, the operators hired gig-economy workers to conduct manual checks, including handling live video calls and managing associated social media profiles. Victims were pressured to buy in-app currency to keep communicating with the AI-driven personas.

Federal law enforcement agencies report that global victims lose billions of dollars annually to “pig-butchering” and romance scam networks. Using large language models to maintain thousands of emotionally manipulative relationships at once lets fraud syndicates expand their operations while reducing labor costs, the report says.

The disclosure comes as safety protocols at major frontier AI laboratories, including Anthropic, OpenAI and Google, face intense scrutiny. Under its self-imposed Responsible Scaling Policy, Anthropic must monitor how its models are deployed and put safeguards in place to prevent their use in severe cyberwarfare, biological research or weapons development.

Anthropic said it terminated the malicious accounts identified in the report and used operational data collected from the intrusions to refine Claude’s safety classifiers. The updated classifiers are intended to better detect and block requests involving network reconnaissance, exploit generation and automated social engineering.