Ledger / Apr 2026
A hacktivist used Claude to breach European political entities
Confirmed
Anthropic reports from its own investigation.
A lone actor used Claude sub-agents to build a WordPress exploit and a doxxing search engine.
“The actor used Claude to develop and debug the exploit in the same session, including creating a lab harness.”Anthropic
Sources
- Detecting and countering misuse of AI: September 2026Anthropic · 10 Sep 2026 · primary source
- Date
- Apr 2026
- Disclosed
- 10 Sep 2026
- Actor
- GTG-50029 (hacktivist), as attributed by Anthropic
- Targets
- European political parties, media, think tanks and their SaaS providers
- What the AI did
- Exploit dev, Agentic intrusion, Malware dev, Data analysis, Recon, LLMjacking
- Model
- Claude, other AI models for vetting findings
- Model family
- Anthropic, Unspecified
- Model basis
- stated by vendor
- Autonomy
- semi-autonomous
- Outcome
- Access to at least 14 of 42 targets; 12-26 GB leaked or staged; accounts banned.