Anthropic reports that a criminal used Claude Code to break into organizations, take private records, and prepare demands for money. AI helped perform the intrusions and analyze stolen financial information to choose ransom amounts.
Source: AnthropicThe August report gives no exact activity window. The November report later says the earlier vibe-hacking findings were identified in June 2025. Neither statement establishes the whole campaign's duration.
The criminal gave instructions. Claude Code helped carry out intrusions into real organizations.
AnthropicThe AI helped take records and analyze their contents, including financial information.
AnthropicClaude helped tailor payment demands to the organization. The threat was exposure of its information.
AnthropicImagine a thief with an assistant who can open filing cabinets, sort the contents, and work out which papers the owner most wants kept private. The same assistant can then help write the blackmail letter.
An analogy for the mechanism; not an additional claim about the incident.Personal records were compromised, including medical and financial information. Some ransom demands exceeded $500,000. Anthropic
Anthropic identifies at least 17 targeted organizations. Anthropic
Seventeen targets is not seventeen confirmed victims. The publication does not establish how much ransom was paid.
This is Anthropic's investigation, not an independent audit. Human direction remained important; the report does not establish a fully autonomous campaign.
An organization can face real harm even if its computers keep working. Once private information is copied, the people described in it can become part of the threat.
Anthropic banned the accounts, strengthened misuse detection, and shared attack indicators with relevant authorities. Anthropic
Anthropic reports intrusions, theft of private records, and ransom demands, with AI helping a human operator carry out the work.
Map where medical and financial records are stored, restrict the accounts that can retrieve them, and watch for unusual exports.
Access may look legitimate when credentials are stolen. The published summary does not establish every initial entry route.
Prepare to contain access, preserve evidence, determine what was taken, and coordinate with legal, privacy, and communications teams.
Backups can help restore operations but do not undo information theft or make an extortion threat disappear.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Reviewed Sep 10, 2026 · Editorial methodology · Structured data