Ledger / 10 Sep 2026
ShinyHunters affiliates used Claude for mass smash-and-grab breaches
Confirmed
Anthropic describes disrupted clusters from its telemetry.
Claude helped scan, exploit and exfiltrate, including a three-hour jump from one developer token to cloud admin.
“wherein operators direct AI to achieve general goals”Anthropic
Sources
- Detecting and countering misuse of AI: September 2026Anthropic · 10 Sep 2026 · primary source
- Disclosed
- 10 Sep 2026
- Activity
- 2026
- Actor
- GTG-50014 (suspected ShinyHunters affiliates) (criminal), as attributed by Anthropic
- Targets
- SaaS vendors, an airline, a technology provider and others
- What the AI did
- Agentic intrusion, Exploit dev, Data analysis, Ops automation, Recon
- Model
- Claude
- Model family
- Anthropic
- Model basis
- stated by vendor
- Autonomy
- semi-autonomous
- Outcome
- 1TB+ stolen from one provider; data of about 200 downstream customers taken; accounts banned.