Anthropic has released a comprehensive threat intelligence report detailing how actors have attempted to misuse Claude for cyberattacks, influence operations, surveillance, and biological weapon development. A significant finding is the narrowing gap between individual operators and nation-state actors, as agentic tooling now enables automated reconnaissance, exploitation, and data exfiltration comparable to traditional Advanced Persistent Threats (APTs). In surveillance operations, AI has democratized capabilities; for instance, an Iranian unit utilized AI to analyze 155,216 tweets to target 39 opposition accounts, while a PRC-aligned actor successfully conducted recruitment operations in Syria by using Claude for drafting, live translation, and role-playing. The report also highlights vulnerabilities in model safeguards, noting that attackers successfully bypassed restrictions by splitting complex tasks across multiple sessions to generate "stability maintenance" reports or profiling tools. Furthermore, the rise of "living off the land" AI tactics has made the theft of API keys and session tokens a primary objective, allowing attackers to hijack compute resources and misattribute malicious behavior to victims. While some metrics may be inflated by attacker-provided data, the report underscores the necessity for AI developers to share actionable threat indicators with social media platforms and civil-society groups to protect targeted individuals.
Read original
hackernews