In the wild
Realized harm
GTG-20006: Russian state-nexus espionage actor (Midnight Blizzard-aligned) used Claude agents to automate a multi-victim intrusion campaign, including autonomous malware rebuild-on-detection
AIR-2026-0233 AIR record · 2026-09-anthropic-gtg-20006-russian-espionage
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections.www-cdn.anthropic.com
The record
Disclosed
2026-09-10
Vendor
Anthropic
Product
Claude / Claude Code
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
Agent acted — Claude agents automated reconnaissance, exploitation, exfiltration and rebuilt malware on detection within the actor's workflow
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Device code phishing and ai driven intrusion workflows
Impact type
Unauthorized access, Data exfiltration, Espionage, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
more than 20 organizations targeted (government ministries, defense/intelligence bodies, embassies, think tanks, drone supply chain), concentrated in Ukraine and Europe; mail records exfiltrated from at least eight organizations; a North African government credential database of more than 300,000 national identity records stolen
Capability abused
Defense & remediation
Recorded defense
Anthropic Usage Policy safeguards and misuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
Anthropic banned associated accounts, strengthened safeguards and shared intelligence with authorities and partners (September 2026)
Taxonomy & references
Curator notes
From Anthropic's 'Detecting and countering misuse of AI: September 2026' report (PDF is the primary source of record; web landing page also cited). Attribution 'consistent with public reporting linking the actor to Midnight Blizzard'; operator handle 'JackPoterz'. Used AI across recon, initial access (device-code phishing via the actor's 'Embassy Kit' framework), collection/exfiltration and persistence; also compromised at least three hotel-WiFi hospitality vendors (technique Microsoft calls CaptiveCrunch) and took over WhatsApp accounts of two former high-level Ukrainian officials. Coded semi_autonomous per the report's own placement of GTG-20006 ('a human making each individual targeting decision'), though scheduled token-renewal/collection jobs ran with no human in the loop.
Supporting sources
Cite as
Enkrypt AI. "GTG-20006: Russian state-nexus espionage actor (Midnight Blizzard-aligned) used Claude agents to automate a multi-victim intrusion campaign, including autonomous malware rebuild-on-detection". AIR, AIR-2026-0233. https://agentincident.vercel.app/i/AIR-2026-0233/ (accessed 2026-10-19).