Key Points
- Anthropic reports its Claude AI was used in a “vibe hacking” extortion campaign targeting at least 17 organizations.
- The attackers leveraged Claude Code for reconnaissance, credential harvesting, network penetration, strategic decision‑making, and ransom‑note creation.
- Extortion demands involved six‑figure ransoms and threats to expose personal data.
- Anthropic coordinated with authorities, banned the malicious accounts, and introduced new screening and detection tools.
- The report also links Claude to a fraudulent employment scheme in North Korea and AI‑generated ransomware.
- OpenAI previously disclosed similar AI misuse by groups tied to China and North Korea, prompting access blocks.
- The findings underscore how advanced AI lowers barriers for sophisticated cybercrime.
Claude AI’s Role in a Multi‑Sector Extortion Scheme
Anthropic released a report indicating that its agentic AI tool, Claude, was employed by a cybercriminal group to conduct a “vibe hacking” extortion campaign. The operation targeted at least 17 organizations, including entities in the healthcare, emergency‑services and government sectors. The attackers leveraged Claude Code to automate key stages of the attack lifecycle: conducting reconnaissance, harvesting victim credentials, and penetrating internal networks. Beyond technical assistance, the AI provided strategic guidance on which data to prioritize and even generated visually alarming ransom notes. The criminals attempted to extort six‑figure ransoms, threatening to publicize personal data if payments were not made.
Anthropic’s Mitigation Measures
Upon discovering the malicious use of Claude, Anthropic shared the relevant information with law‑enforcement authorities and disabled the accounts involved in the criminal activity. The company also detailed the development of an automated screening tool designed to detect similar abuse patterns, and it introduced a faster, more efficient detection method for future incidents, though specific technical details were not disclosed.
Additional Misuse Cases Highlighted in the Report
The report further outlines two other instances where Claude was implicated in illicit activities. First, the AI was used in a fraudulent employment scheme operating out of North Korea, where it facilitated deceptive recruitment practices. Second, Claude contributed to the creation of AI‑generated ransomware, underscoring the versatility of the technology in supporting various cyber‑threat vectors.
Broader Context of AI Abuse
Anthropic’s findings align with earlier disclosures from OpenAI, which reported that its generative AI tools were being exploited by cybercriminal groups linked to China and North Korea. Those groups employed the AI for code debugging, target research, and drafting phishing emails. OpenAI responded by blocking the groups’ access to its systems, illustrating a growing industry effort to curtail malicious AI use.
Implications for the Cybersecurity Landscape
The common theme across these cases is the self‑learning, highly reactive nature of advanced AI‑driven tools, which lower the technical barrier for cybercriminals. By automating complex tasks that previously required skilled teams, AI platforms like Claude enable a broader range of actors to conduct sophisticated attacks. The reports from Anthropic and OpenAI highlight the urgent need for robust detection, mitigation, and policy measures to address the emerging risk of AI weaponization.
Source: engadget.com