Russian hackers used Claude AI to rebuild detected malware
Anthropic, the company behind the AI model Claude, says it disrupted a cyber-espionage campaign run by a Russian state-backed hacking group. According to the company, the group used Claude to quickly modify and redeploy its malware whenever security tools detected it.
Anthropic's threat report, covering December 2025 to August 2026, says the campaign targeted more than 20 government, intelligence, diplomatic and defense organizations. The activity was linked to Midnight Blizzard, also known as APT29 or Cozy Bear, a group Western intelligence agencies attribute to Russia's foreign intelligence service, the SVR.
According to Anthropic, the attackers compromised hotel Wi-Fi providers and changed DNS records to redirect travelers to servers they controlled. Targets repeatedly included members of the Ukrainian government, military and diplomatic staff, as well as companies in the military drone supply chain.
The hackers reportedly took over mailboxes at two drone-component manufacturers and used that access to steal a complete software development kit for a drone vision system. Anthropic says they then used Claude to reverse-engineer the system, uncovering hardware details, suppliers and information about an unannounced product.
Notably, when the group's malware was flagged by security products, Anthropic says Claude helped identify, modify and redeploy the affected code. The report warns this could let capable attackers bypass new detection methods faster than defenders can build them.
The Five Eyes intelligence alliance had already warned in June that powerful AI models could reshape offensive and defensive cybersecurity within months, according to the report. Anthropic's report also describes other misuse cases, including a criminal group that used AI to steal credentials and extort victims.
It remains unclear how widespread this kind of AI-assisted hacking really is, since Anthropic did not share overall figures on the scale of misuse. The company also stresses that traditional attack methods, such as phishing, stolen credentials and unpatched software, remain the main cause of successful breaches.
WHY IT MATTERS
This case shows AI tools can help state-backed hackers bypass security defenses faster, which affects the cybersecurity of many organizations.
WHAT YOU CAN DO NOW
- Keep your software updated Install updates for your phone, computer and apps as soon as they're available. Outdated programs often have security gaps that attackers can exploit.
- Stay cautious with emails and links Don't click links or attachments right away if you get an unexpected message. Instead, contact the company or person directly to check if it's real.
- Use strong, unique passwords Create a separate, long password for each important account. A password manager can help you keep track of them without memorizing every one.
- Be careful on public Wi-Fi Avoid entering sensitive information, like online banking, on hotel or public Wi-Fi. Use a secure connection or your own mobile data when possible.