Russian espionage, dissident monitoring and AI cyberattacks: What Anthropic’s report says

The report covered activity across seven harm areas such as cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. Anthropic said that its models Claude Haiku, Sonnet, and Opus were used to carry out these activities. However, it asserted that none of the cases involved its most advanced models like Claude Fable or Mythos, except for an instance of an illicit distillation case.

The report highlights how AI is changing the way cyberattacks are carried out. It shows that instead of using a chatbot to write malicious code or answer technical questions, attackers are increasingly using AI agents to carry out multiple stages of an attack with minimal to limited human involvement. The Dario Amodei-led company also said that the cases highlighted in the report are not necessarily representative of everyday misuse. Instead, they are some of the most novel examples its team identified.

One of the key observations is how attackers use AI during cyber operations. Earlier, a hacker would ask an AI model to write a piece of malware, explain a vulnerability or help in composing a phishing email. Later, the output would be used by the human to proceed with the attack. This model is changing now.

According to Anthropic, a majority of the cyber operations highlighted in its report involved AI being used for direct orchestration. In simple words, AI was not merely offering advice. Multi-agent systems were deployed to perform tasks like reconnaissance, exploitation and data theft, while humans largely remained responsible for setting targets and reviewing the outcomes. This is critical since AI systems can perform repetitive tasks much faster than humans, and they can also coordinate several activities simultaneously.

Sophisticated attackers not needed

Another major discovery, according to the report, is that AI is reducing the skills and resources that were traditionally needed to execute a sophisticated cyber attack. Anthropic said that it has seen state-sponsored groups, financially motivated criminals, and individual operators execute campaigns that would earlier require a team of highly skilled specialists. It shows AI can now assist with reconnaissance, tool development, data processing, exfiltration, etc. All of this adds to the problems of cybersecurity teams. This is because the sophistication of an attack may no longer show investigators much about the sophistication of the person behind it.

It goes on to show that someone with relatively limited technical expertise can likely use AI-powered tools and publicly available agent frameworks to carry out operations that would earlier require significant expertise. In this direction, Anthropic also pointed to the growing availability of offensive AI frameworks. These systems can link different stages of a cyberattack, effectively automating parts of the cyber kill chain, which is essentially the steps from finding a target to gaining access, maintaining control and stealing information.

Further, the report offers a detailed insight into a threat actor that Anthropic calls GTG-20006. The AI startup said that its assessment is consistent with public reporting linking the group with the Russian-linked Midnight Blizzard. The group targeted military intelligence organisations, government agencies, diplomatic organisations, and defence-related firms in Ukraine, Europe, and select targets elsewhere. Anthropic said that AI was used across much of the operation. The attackers carried out reconnaissance, built phishing infrastructure, maintained access to compromised systems, extracted data and modified malware. Automated malware modification has been flagged as particularly concerning. The attackers used AI agents to monitor whether their malware had been detected by security products. In case of detection, the agents would modify and rebuild the malware in an attempt to evade those defences. The process could then be repeated.

Scaling up attacks

According to the report, another major advantage for attackers is that, with AI, they can scale up. The group studied by Anthropic’s team targeted over 20 organisations and used AI to automate activities ranging from researching targets to running phishing infrastructure and processing stolen information. One of the cases showed attackers using AI to organise hundreds of gigabytes of exfiltrated data. This shows that AI need not necessarily invent an entirely new type of attack to be lethal. Making existing attacks faster, cheaper, and easier to repeat could be enough, and this could significantly increase their impact.

Anthropic argues that because of this, the biggest risk may stem from AI being used throughout the entire attack process instead of from a single breakthrough such as detecting a new software vulnerability.

While cyberattacks were one part of the report, Anthropic said that it also identified misuse involving surveillance, scams and frauds, influence operations, biological risks, conventional weapons, and attempts to extract capabilities from AI models. The actors detected included suspected state-sponsored groups, criminals, commercial spyware vendors, state propaganda organisations, politically motivated individuals, etc.

One instance outside traditional hacking involved a network of fake dating apps designed to defraud users, while another involved surveillance systems deployed to identify and monitor dissidents. The underlying factor here is that increasingly capable AI can reduce the cost of activities that earlier required considerable human effort, technical experts or organisational resources.

What does it all mean?

The report seems to suggest that traditional cybersecurity approaches will have to adapt. Anthropic argues that defenders will need to use AI themselves, not just to respond to attacks, but to find vulnerabilities, detect suspicious activity and strengthen their systems before anyone can exploit them.

It needs to be noted that the Anthropic report is not in any way suggesting that AI has made cyberattacks autonomous. Humans are still involved in many of the instances described. However, the role of the human is shifting. Instead of manually performing every step, an attacker can set a goal, provide instructions, and allow AI-powered systems to handle a large part of the work.

With these systems becoming more advanced, the distinction between a highly skilled attacker and a novice operator could become less important. The biggest advantage may lie with someone who has access to the best AI tools and, most importantly, knows how to orchestrate them.