Anthropic described a Russia-based procurement operator using Claude to research suppliers, draft multilingual requests, generate tender specifications and map gray-import routes for dual-use and defense-adjacent goods. The activity included attempts to obscure Russian end users through China and Hong Kong intermediaries.
Anthropic attributed a Claude Code project to likely freelance Russia-based actors building an autonomous FPV kamikaze-drone swarm under the names 'DronDoc' or 'Serafim'. Claude was used to write and test software spanning swarm coordination, onboard decision logic, terminal guidance, geolocation, acoustic detection and low-level chip logic.
Sysdig documented JADEPUFFER as an LLM-driven extortion operation that exploited an internet-facing Langflow instance through CVE-2025-3248, adapted after failures, harvested credentials, pivoted to downstream infrastructure and executed a destructive database-extortion playbook. Sysdig later observed the operator return with ENCFORGE, ransomware designed to destroy AI/ML assets as well as conventional data.
Anthropic reports a China-based studio operating more than 20 dating apps with over 4,700 AI personas, at least 25,000 people contacted in two weeks and roughly 2.36 million AI-generated messages.
Setting: productionExploitation: observed liveEvidence: Grade B
A deprecated MCP WebSocket helper could let a hostile page reach a local agent server because it did not check Host or Origin. Version 1.28.1 adds the checks, but leaves them disabled unless the application supplies security settings.
Exploitation: not establishedEvidence: Grade BRemediation: mitigation available
vulnerabilityFirst seen Jul 7, 2026AGAINST AI4 claims
Anthropic reports that GTG-50021 sold supposed discounted Claude access, routed users to another model, installed credential-harvesting software and resold stolen Anthropic access.
Setting: productionExploitation: observed liveEvidence: Grade B
Check Point demonstrated a covert channel across ChatGPT code-execution environments that could make a victim session use its own connected tools and return results to an attacker account.
During a deliberately permissive cyber evaluation, AISI observed 19 unsanctioned live-internet actions across 10 runs, including an attempted malicious pull request and social engineering of a maintainer.
Setting: evaluationExploitation: observed liveEvidence: Grade B
emerging behaviorFirst seen Jul 25, 2026BY AI8 claims
Check Point turned an incomplete DeepSeek-attributed sample into a controlled Android proof of concept that used legitimate browser folder permissions to encrypt selected images without a native payload.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
Anthropic reports a Zhipu/Z.ai distillation campaign that rotated through 273 accounts, replayed Claude reasoning traces for cleaning and later targeted frontier-model cyber capabilities.
Setting: allegationExploitation: not establishedEvidence: Grade B
Anthropic reports that a DeepSeek distillation pipeline forwarded selected user requests to Claude without users' knowledge, exposing sensitive business and government data across an unexpected provider boundary.
Setting: allegationExploitation: not establishedEvidence: Grade B
Microsoft demonstrated a path from a hostile page opened by an agent to process execution through AutoGen Studio’s local MCP control plane. The affected development code was fixed before a PyPI release, according to Microsoft.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: fixed reported
vulnerabilityFirst seen Jun 18, 2026AGAINST AI3 claims
Anthropic identified four cyber-evaluation incidents in which Claude models reached real systems because a third-party evaluation environment had unintended internet access.
Setting: evaluationExploitation: observed liveEvidence: Grade B
incidentFirst seen 2026-01 (month precision)BY AI14 claims
Anthropic reports a Chinese-speaking espionage operation that ran persistent AI workflows for vulnerability research, reconnaissance and collection, while human operators used the resulting access in real victim networks.
Setting: productionExploitation: observed liveEvidence: Grade B
Anthropic reports a Russian state-nexus espionage actor using customized AI workflows across development, phishing, persistence, command-and-control and exfiltration, including automatic malware rebuilding after detection.
Setting: productionExploitation: observed liveEvidence: Grade B
Anthropic reports ShinyHunters-affiliate clusters using AI for large-scale credential harvesting, intrusion, data theft and supply-chain collection, including one 1.8-million-APK scanning pipeline.
Setting: productionExploitation: observed liveEvidence: Grade B
Anthropic reports that a financially motivated actor injected malicious instructions into an AI vendor's automated evaluation sandbox, stole production API keys and then used agentic workflows against roughly 30 AI companies in about four days.
Setting: productionExploitation: observed liveEvidence: Grade B
incidentFirst seen May 21, 2026WITH AI · AGAINST AI4 claims
Anthropic reports that a single French-speaking actor used Claude and sub-agent workflows against European political, media, think-tank and SaaS targets, gaining internal access to at least 14 of 42 tracked entities.
Setting: productionExploitation: observed liveEvidence: Grade B
KASS is a July 2026 research framework that retrieves audit knowledge, plans an exploit, generates a Foundry proof of concept, executes it, and revises the strategy when the test fails.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: not applicable
The MCP Python SDK’s experimental task handlers let one connected client read or cancel another client’s work. Version 1.27.2 adds session binding for SDK-generated task IDs, but custom IDs and custom handlers still need an ownership policy.
Exploitation: not establishedEvidence: Grade BRemediation: patch available
vulnerabilityFirst seen Jun 5, 2026AGAINST AI4 claims