In the wild
Realized harm
GTG-50014: suspected ShinyHunters affiliates ran agentic credential-harvesting, SaaS supply-chain theft and pay-or-leak extortion, with AI agents doing nearly all of the work
AIR-2026-0234 AIR record · 2026-09-anthropic-gtg-50014-shinyhunters-affiliates
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
spanning more than 40 corporate tenants in about 34 hours. AI agents performed nearly all of the work.www-cdn.anthropic.com
The record
Disclosed
2026-09-10
Vendor
Anthropic
Product
Claude
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
Agent acted (contested) — agentic harvesting and bulk-export automation executed intrusions; human operators directed targets
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Harvested and exposed credentials
Impact type
Data exfiltration, Credential theft, Extortion, Unauthorized access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
multiple financially motivated clusters; one SaaS supply-chain breach reached data of roughly 200 downstream customer organizations plus a session dump of over 2,100 Azure AD token sets across 40+ tenants; a technology provider lost more than a terabyte including hundreds of thousands of national identifiers and millions of payment-card records; an airline's systems held tens of millions of passenger records
Capability abused
Defense & remediation
Recorded defense
Anthropic Usage Policy safeguards and misuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
Anthropic detected and banned associated accounts, deployed disruption measures and engaged authorities, partners and victims (September 2026)
Taxonomy & references
Curator notes
Anthropic September 2026 report (PDF). Multiple disparate operators assessed to be affiliates of the ShinyHunters collective; one French-speaking operator (aliases MeowSHA/frkoo/blazespider) ran a 10-worker EC2 credential-harvesting pipeline over 1.8M Android APKs. Operators also stole victims' AI API keys and switched their own attack workloads onto them. Report emphasises breaches completed in two to three hours and dozens of victims handled in parallel. Unit-of-record: one campaign cluster, not weighted by victim count per CURATION. Verified_quote begins mid-sentence because the PDF inserts a running page footer inside the sentence about the ~200 downstream customer organizations and the 2,100 Azure AD token sets.
Supporting sources
Cite as
Enkrypt AI. "GTG-50014: suspected ShinyHunters affiliates ran agentic credential-harvesting, SaaS supply-chain theft and pay-or-leak extortion, with AI agents doing nearly all of the work". AIR, AIR-2026-0234. https://agentincident.vercel.app/i/AIR-2026-0234/ (accessed 2026-10-19).