The AI was able to automate reconnaissance, harvest victims’ credentials, and penetrate networks.
At least 17 companies have been compromised and extorted as part of a ransomware attack campaign that involved the exploitation of Anthropic's Claude artificial intelligence chatbot.
According to NBC News, those extorted include several healthcare providers, a financial entity, and a defence contractor. Attackers leveraged Anthropic's Claude Code chatbot for "vibe coding" to create illicit programs to determine vulnerable organisations and exfiltrate their data before organising such information for subsequent extortion activities, according to a report from Anthropic.
In its statement, Anthropic said it disrupted a “sophisticated cyber-criminal that used Claude Code to commit large-scale theft and extortion of personal data.” In the incident, rather than encrypt the stolen information with traditional ransomware, the actor threatened to expose the data publicly in order to attempt to extort victims into paying ransoms that sometimes exceeded $500,000.
The actor used Claude Code to automate reconnaissance, harvesting victims’ credentials, and penetrating networks. Anthropic said Claude was allowed to make both tactical and strategic decisions, such as deciding which data to exfiltrate, and how to craft psychologically targeted extortion demands.
Information pilfered by the threat actors included individuals' bank details and Social Security numbers, as well as International Traffic in Arms Regulations-related data.
"We have robust safeguards and multiple layers of defence for detecting this kind of misuse, but determined actors sometimes attempt to evade our systems through sophisticated techniques," said Anthropic head of threat intelligence Jacob Klein.
Written by
Dan Raywood is a B2B journalist with 25 years of experience, including covering cybersecurity for the past 17 years. He has extensively covered topics from Advanced Persistent Threats and nation-state hackers to major data breaches and regulatory changes.
He has spoken at events including 44CON, Infosecurity Europe, RANT Forum, BSides Scotland, Steelcon and the National Cyber Security Show, and served as editor of SC Media UK, Infosecurity Magazine and IT Security Guru. He was also an analyst with 451 Research and a product marketing lead at Tenable.
