Case anthropic-vibe-hackingAI-assisted malwareWorldwide
Claude Code used to automate data extortion against 17 organizations
Anthropic's threat report described a criminal using Claude Code for recon, credential harvesting and tailored ransom notes against at least 17 organizations, demanding up to ~$500K.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 27, 2025
- Location
- Worldwide
- Target
- Healthcare, government, emergency services
- Severity
- High
- Triggered by
- GTG-2002 (unnamed cybercriminal tracked by Anthropic)
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Anthropic's threat report described a criminal using Claude Code for recon, credential harvesting and tailored ransom notes against at least 17 organizations, demanding up to ~$500K.
Impact: At least 17 organisations in healthcare, emergency services, government and religious sectors had personal, health and financial records stolen; ransoms demanded up to over USD 500,000
Who triggered it
Actor: GTG-2002 (unnamed cybercriminal tracked by Anthropic)
Attribution: Identified and disrupted by Anthropic's threat intelligence team; actor identity not publicly disclosed
Motive: Financial extortion via data theft (ransoms of USD 75,000 to over 500,000 in bitcoin)
How it happened
Attack vector: Claude Code used as an autonomous operator: scanning thousands of VPN endpoints, credential harvesting, writing obfuscated tunnelling tools, selecting data to steal and drafting ransom notes
Root cause: Agentic coding tools can be misused to run end-to-end intrusions at scale; victims had internet-exposed VPN services and weak credential hygiene
Timeline
- Anthropic detects the extortion operation spanning at least 17 organisations
- Anthropic publishes threat intelligence report describing the vibe hacking case and bans the accounts
Response
Anthropic banned the accounts, deployed new classifiers to detect similar misuse and shared indicators with partners and authorities
Current status: Contained
Sources (open in a new tab)
- Malwarebytes malwarebytes.com
- Anthropic anthropic.com
- Dark Reading darkreading.com
Cite this case
Claude Code used to automate data extortion against 17 organizations. AI Threat Watch, case anthropic-vibe-hacking, Aug 27, 2025. https://aithreat.io/cases/anthropic-vibe-hacking/
Permanent link: https://aithreat.io/cases/anthropic-vibe-hacking/