In the wild
Realized harm
Anthropic disclosed Claude misuse for an influence-as-a-service bot network, credential stuffing against cameras, recruitment fraud and novice malware development
AIR-2025-0028 AIR record · 2025-04-anthropic-claude-misuse-report-march
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
This report outlines several case studies on how actors have misused our models, as well as the steps we have taken to detect and counter such misuse.blog.securitybreak.io
The record
Disclosed
2025-04-23
Occurred
2025-03
Vendor
Anthropic
Product
Claude
Risk domain
Access control and permissions › Credential theft
Also touches
Unsafe actuation
System type
Generative model
Who acted
Agent acted (contested) — Claude orchestrated the bot network and tested credentials
Attack surface
Other
Autonomy level
Semi-autonomous
Initial vector
Policy violating use
Impact type
Ecosystem abuse, Credential theft, Financial loss
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
over 100 orchestrated social media bot personas; leaked credentials tested against internet-facing security cameras; recruitment fraud targeting Eastern Europe
Capability abused
Defense & remediation
Recorded defense
Anthropic usage policy enforcement and misuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
accounts banned; detection learnings folded into safeguards
Taxonomy & references
Curator notes
The influence-as-a-service case is the one that matters for this corpus: Claude was not writing posts on demand, it was the orchestration layer deciding which of 100+ personas engaged with what and when. That is an agent running a campaign, not a tool producing text. Anthropic could not confirm downstream deployment of the malware case, so impact_realized rests on the bot network and credential testing. AI Incident Database incident 1054.
Supporting sources
Cite as
Enkrypt AI. "Anthropic disclosed Claude misuse for an influence-as-a-service bot network, credential stuffing against cameras, recruitment fraud and novice malware development". AIR, AIR-2025-0028. https://agentincident.vercel.app/i/AIR-2025-0028/ (accessed 2026-10-19).