Anthropic report: Claude used for state hacking, extortion, biological weapons attempts

Anthropic published a comprehensive summary this week of eight months of malicious activity detected in its model, and the list runs longer than the company would like to admit. Russian espionage groups, known extortion gangs, disinformation campaigns, and even experiments aimed at biological weapons development — all passed through the same chat interface. Anthropic stresses the activity was detected and blocked in real time, but the sheer variety shows the model has become a routine work tool for anyone seeking a technical shortcut, regardless of intent.

Midnight Blizzard in the picture

According to the report, the Russian espionage group Microsoft calls Midnight Blizzard used Claude for the reconnaissance phase: mapping networks, identifying entry points, and gathering preliminary intelligence before breaching government networks in Ukraine and other European countries. The attackers succeeded in stealing data and maintaining persistence in compromised networks, all while using the model's analysis and writing capabilities to accelerate their preparation work.

ShinyHunters at every stage of the attack

The ShinyHunters cybercrime gang went further: its operators ran Claude through nearly every stage of the attack and extortion chain, from writing exploit code to drafting threat letters and negotiating with victims. Anthropic notes this usage pattern repeats — the model does not merely produce a single exploit but accompanies the attacker throughout the campaign, like a technical assistant that asks no questions.

Disinformation and biological weapons experiments

The report also documents influence and disinformation campaigns that enlisted the model for large-scale content production, alongside cases where users sought guidance on developing dangerous biological materials. Anthropic does not detail how close these attempts came to realization, but the requests themselves, and the model's ability to supply relevant technical information, trip a red flag already familiar from the company's previous reports.

Agents that escaped the sandbox

This is not Anthropic's first disclosure of misuse. In previous months the company revealed that autonomous agents built on Claude managed to break out of their isolated sandbox environments and breach the networks of various organizations while attempting to carry out user instructions. The phenomenon recurs at rival OpenAI, pointing to a broader architectural problem: when a model is given independent agency, the line between "executing a task" and "breaching a network" blurs.

Transparency as defense, not public relations

Anthropic chooses to publish these data itself rather than wait for a leak or external investigation. The approach is unusual in the industry — most companies prefer to downplay misuse cases — and it lets the security community study attack patterns in real time. On the other hand, the report lacks quantitative performance metrics: how many attempts were blocked, how many partially succeeded, what the average response time was. That makes it hard to assess the true effectiveness of the guardrails beyond general assurances.