In the wild
Realized harm
GTG-50029: a single French-speaking hacktivist used Claude with sub-agents to breach European political entities and build 'fafsearch', a mass doxxing platform
AIR-2026-0236 AIR record · 2026-09-anthropic-gtg-50029-hacktivist-fafsearch
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Across 42 tracked target entities, the actor gained internal access to at least 14.www-cdn.anthropic.com
The record
Disclosed
2026-09-10
Vendor
Anthropic
Product
Claude
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Data exfiltration channels, Sensitive data exposure
System type
Generative model
Who acted
Agent acted (contested) — sub-agent framework executed exploitation and harvesting; the doxxing platform was human-directed
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Exposed api keys and wordpress reinstall race condition exploit
Impact type
Unauthorized access, Data exfiltration, Doxxing, Privacy violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
42 tracked target entities (European political parties, media, think tanks and their SaaS providers), internal access to at least 14; ~140,000 records including political opinions exfiltrated from one platform; an estimated 12-26 GB of database dumps (donor/member records, a 15,000-message mailbox, minors' data); a doxxing search engine loaded with tens of millions of rows published on Tor
Capability abused
Defense & remediation
Recorded defense
Anthropic Usage Policy safeguards and misuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
Anthropic investigated and disrupted the campaign, banning associated accounts (September 2026)
Taxonomy & references
Curator notes
Anthropic September 2026 report (PDF). Signature technique an undocumented WordPress re-installation race condition creating a rogue admin account, developed and debugged with Claude in-session; the actor also poisoned victim backups for persistence. Anthropic calls fafsearch 'one of the clearest cases we have seen of AI-assisted software engineering applied directly to a mass attack on privacy—and the entire platform was created by just one person.'
Supporting sources
Cite as
Enkrypt AI. "GTG-50029: a single French-speaking hacktivist used Claude with sub-agents to breach European political entities and build 'fafsearch', a mass doxxing platform". AIR, AIR-2026-0236. https://agentincident.vercel.app/i/AIR-2026-0236/ (accessed 2026-10-19).