Russian and Chinese Operators Used Claude to Automate Cyberattacks, Anthropic Says

Russian- and Chinese-speaking operators used Anthropic’s Claude to automate cyberattacks, the company said in a Thursday report.

Russian-speaking operator “JackPoterz” used customized AI-driven workflows to automate large parts of the attack chain, targeting more than 20 organizations, including government ministries and intelligence bodies. The actor also targeted embassies and diplomatic missions in Ukraine and Europe.

Chinese-speaking operators also used Claude as an engineering and orchestration layer for vulnerability research, with one workflow producing more than a dozen possible zero-day findings in network-appliance firmware in one month.

Anthropic said AI is changing the economics of cyberattacks, allowing individual operators to complete breaches in two to three hours and handle dozens of victims in parallel.

Separately, a likely Bamako-based independent consultant working with Mali’s state intelligence service used Claude as the primary engineering workforce to build a population-scale domestic surveillance system that monitors roughly 25 million SIM cards across all three of the country’s national mobile operators.

The deployed platform ran on-premises using local models, with Claude providing software design and engineering support. It was designed to generate intelligence dossiers on phone numbers without requiring a court order.