Case anthropic-dprk-remote-workersState actor AI opsUnited States
North Korean operatives used Claude to pass interviews and hold jobs at Fortune 500 firms
Anthropic found DPRK IT workers using Claude to fabricate professional identities, complete coding assessments and perform day-to-day technical work after being hired, generating sanctioned revenue for the regime.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 27, 2025
- Location
- United States
- Target
- US Fortune 500 technology companies
- Severity
- High
- Triggered by
- North Korean remote IT worker network
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Anthropic found DPRK IT workers using Claude to fabricate professional identities, complete coding assessments and perform day-to-day technical work after being hired, generating sanctioned revenue for the regime.
Impact: Fraudulent hires inside major US technology companies; salaries diverted to the DPRK in violation of sanctions.
Who triggered it
Actor: North Korean remote IT worker network
Attribution: Anthropic attributed the activity to North Korean operatives with high confidence, consistent with FBI reporting on the DPRK IT-worker scheme.
Motive: Sanctions-evading revenue generation for the North Korean regime
How it happened
Attack vector: Claude used to build false identities, answer technical interviews and deliver work product that operators could not produce themselves
Root cause: AI removed the English-language and coding bottleneck that previously limited the scale of the fraudulent employment scheme
Timeline
- Anthropic bans accounts tied to DPRK IT workers
- Case published in Anthropic's August 2025 threat report
Response
Accounts banned, indicator-correlation tooling improved, findings shared with authorities.
Current status: Ongoing
Sources (open in a new tab)
- Anthropic August 2025 threat report anthropic.com
- heise coverage heise.de
Cite this case
North Korean operatives used Claude to pass interviews and hold jobs at Fortune 500 firms. AI Threat Watch, case anthropic-dprk-remote-workers, Aug 27, 2025. https://aithreat.io/cases/anthropic-dprk-remote-workers/
Permanent link: https://aithreat.io/cases/anthropic-dprk-remote-workers/