Anthropic Disrupts AI-Powered Cyberattacks Automating Theft and Extortion

Anthropic said it disrupted a large-scale theft and extortion operation that used its Claude chatbot, with the activity occurring in July 2025. The unknown threat actor, codenamed GTG-2002, used Claude Code to automate reconnaissance, credential harvesting and network penetration, targeting at least 17 organizations including healthcare, emergency services, government and religious institutions. Rather than encrypting data, the actor threatened to publish stolen information to extort ransoms that sometimes exceeded $500,000. Anthropic said it developed a custom classifier to screen for similar behavior and shared technical indicators with key partners.