Anthropic caught Russia-linked spies using Claude in hacking operations

Anthropic says it detected and disrupted multiple campaigns (Dec 2025–Aug 2026) where state-backed and criminal actors abused its Claude model to conduct espionage, credential theft and vulnerability research—most notably a Russia-linked APT that compromised hotel Wi‑Fi, altered DNS to redirect victims, stole drone vendor mailboxes and an SDK, then used Claude to reverse-engineer and evade detections; the report includes IOCs and examples of AI narrowing the gap between advanced and smaller actors.