Case anthropic-novice-malware-builderAI-assisted malwareWorldwide
Novice coder grows doxing toolkit and evasive malware builder with Claude's help
An individual with little coding skill used Claude to grow a basic toolkit into a suite with facial recognition and dark-web scanning, and a batch-script generator into a GUI malware builder with evasion and persistence.
MediumAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 23, 2025
- Location
- Worldwide
- Target
- Individuals targeted by doxing and remote-access malware
- Severity
- Medium
- Triggered by
- Unknown individual
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
An individual with little coding skill used Claude to grow a basic toolkit into a suite with facial recognition and dark-web scanning, and a batch-script generator into a GUI malware builder with evasion and persistence.
Impact: Demonstrated capability uplift for an unskilled actor; real-world deployment not confirmed.
Who triggered it
Actor: Unknown individual
Attribution: Anthropic Threat Intelligence; single low-skill actor, not named.
Motive: Doxing and remote access to victims' machines
How it happened
Attack vector: Iterative code generation requests to Claude to add capabilities to doxing tools and a payload builder
Root cause: AI coding assistance lowered the skill barrier for building security-evading payloads
Timeline
- Anthropic detects and bans the actor
- Case published in Anthropic's misuse report
Response
Actor banned; Anthropic highlighted the case as an example of AI lowering the barrier to malware development.
Current status: Contained
Sources (open in a new tab)
- Anthropic March 2025 misuse report anthropic.com
- OpenAI June 2025 report (cites the Anthropic report) cdn.openai.com
Cite this case
Novice coder grows doxing toolkit and evasive malware builder with Claude's help. AI Threat Watch, case anthropic-novice-malware-builder, Apr 23, 2025. https://aithreat.io/cases/anthropic-novice-malware-builder/
Permanent link: https://aithreat.io/cases/anthropic-novice-malware-builder/