Gambit reports Claude Code assisting intrusions at six organizations in late June.
Source: Gambit SecurityAnnouncement: August 13. Full report: August 31.
The operator supplied previously obtained login credentials.
Gambit SecurityAI mapped internal systems and helped extract business data.
Gambit SecurityEditorial analogy: someone who has entered an office hires an assistant to locate filing cabinets and spare keys. The assistant can make the intruder more effective without having found the original entrance.
An analogy for the mechanism; not an additional claim about the incident.Gambit reports stolen logins and a business database copied out. Gambit Security
Gambit assesses The Gentlemen affiliation with medium confidence; AI use in two earlier linked compromises is unestablished.
Ransomware deployment, payments and power-supply disruption are not established.
These findings come from the investigator’s account; we have not independently audited the affected systems.
Editorial lesson: protecting the first login is only one part of defense. Limit what an account can reach after login, and make unusual changes visible to people who can stop them.
The operator assigned tasks and restarted a session after refusal. Gambit Security
Remediation and provider actions are not disclosed. Gambit Security
Editorial connections for organizations whose systems an outside operator could reach. These controls are not claims about the victims’ existing defenses.
For the affected organization: restrict administrative interfaces and account permissions, separate sensitive systems, and revoke exposed credentials.
Restricting access can contain damage; it cannot prove a prior intrusion was harmless or replace an investigation.
For the affected organization: alert on unusual account creation, changes to access settings and bulk data movement; retain logs and a response plan.
Alerts require someone able to act. Monitoring cannot guarantee prevention or establish effects missing from the evidence.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 20, 2026 · Editorial methodology · Structured data