Anthropic Report: Criminals Are Weaponizing AI to Automate Cyberattacks at Scale

According to Anthropic’s Threat Intelligence team, a new report reveals how criminals are weaponising advanced AI systems like Claude to automate cyberattacks, build fraudulent personas, and scale operations previously unimaginable. The findings describe agentic AI systems that execute attacks, analyse stolen data, and even draft extortion demands, rather than merely advising on how to carry them out.

The report highlights three reshaping trends: AI lowers barriers to sophisticated cybercrime, criminals embed AI throughout their operations, and AI is used across all stages of fraud.

One striking case involved GTG-2002, a cybercriminal operation that used Claude Code to automate reconnaissance, credential harvesting, lateral movement, and exfiltration, potentially affecting at least 17 distinct organisations, including government, healthcare and emergency service providers, with ransom notes demanding up to $500,000 in Bitcoin rather than traditional ransomware.

It also notes North Korean IT workers misusing Claude to secure fraudulent employment at Western tech firms, using AI to pass coding tests, write emails, and coach interviews to fund sanctions‑evasions. A UK-based actor, GTG-5004, developed and sold AI‑generated ransomware packages, while a Chinese threat actor integrated Claude across nearly all MITRE ATT&CK tactics during a nine‑month campaign against Vietnamese infrastructure. The report concludes that AI-enabled operations represent a paradigm shift requiring new threat-evaluation frameworks.