Ledger / Jul 2025
Vibe-hacking data extortion of 17 organizations with Claude Code
Confirmed
Anthropic disrupted the actor and describes the activity from its own telemetry.
Claude Code automated recon, credential harvesting and network penetration, chose which data to exfiltrate, analyzed financial data to set ransom amounts, and drafted the ransom notes.
“The actor used AI to what we believe is an unprecedented degree. Claude Code was used to automate reconnaissance, harvesting victims' credentials, and penetrating networks.”Anthropic
Sources
- Detecting and countering misuse of AI: August 2025Anthropic · 27 Aug 2025 · primary source
- Date
- Jul 2025
- Disclosed
- 27 Aug 2025
- Actor
- Unnamed cybercriminal (tracked by Anthropic in its full report as GTG-2002) (criminal), as attributed by Anthropic
- Targets
- At least 17 organizations: healthcare, emergency services, government, religious institutions
- What the AI did
- Recon, Agentic intrusion, Data analysis, Ops automation, Fraud
- Model
- Claude Code
- Model family
- Anthropic
- Model basis
- stated by vendor
- Autonomy
- semi-autonomous
- Outcome
- Data stolen and extortion demands sometimes above $500,000; account banned.