Russian- and Chinese-speaking operators used Anthropic’s Claude to automate cyberattacks, the company said in a Thursday report.

A Russian-speaking operator known as “JackPoterz” used customized, AI-driven workflows to automate large parts of the attack chain. The operator targeted more than 20 organizations, including government ministries and intelligence bodies, as well as embassies and diplomatic missions in Ukraine and Europe.

Chinese-speaking operators used Claude as an engineering and orchestration layer for vulnerability research. In one month, a single workflow produced more than a dozen possible zero-day findings in network-appliance firmware.

Anthropic said AI is changing the economics of cyberattacks by allowing individual operators to complete breaches in two to three hours and manage dozens of victims in parallel. The reported cases therefore involved Claude in different roles, from supporting offensive workflows and vulnerability research to providing software design and engineering assistance for a separate surveillance system.

Separately, a likely Bamako-based independent consultant working with Mali’s state intelligence service used Claude as the primary engineering workforce to build a population-scale domestic surveillance system. The system monitors roughly 25 million SIM cards across all three of Mali’s national mobile operators.

The deployed platform operated on-premises using local models, while Claude provided software design and engineering support. It was designed to generate intelligence dossiers on phone numbers without requiring a court order. This distinction means Claude supported the system’s development, while local models operated the deployed platform.

Source: Cointelegraph