Incident·WS-0044·Jul 2025·disclosed Aug 27, 2025 (43 days later)·in the wild·AI-powered cyberattacks

Criminal uses Claude Code to run a 17-victim extortion spree

GTG-2002 (criminal actor) / Anthropic Claude Code

68/100
WS-4 Severe
Harm score 60, signal score 77. Autonomy: autonomous (the AI ran multi-step operations). How the scores work.
Harm 3/5
damage actually done
Reach 2/5
who was affected
Autonomy 3/4
how much the AI did on its own
Novelty 4/5
how new the behavior was
Permanence 4/5
how hard it is to undo

Anthropic reported an actor using Claude Code to automate reconnaissance, credential harvesting, network intrusion and data analysis against healthcare, emergency-services, government and religious organizations, with the model also drafting tailored ransom notes and setting demands. Anthropic banned the accounts and shared indicators with authorities.

Damage

Targeted at least 17 organizations with data theft and extortion; ransom demands from $75,000 to over $500,000 in Bitcoin; payments unknown

Did they fix it?

reopened Anthropic shut the actor's accounts and built a classifier, but the same kind of Claude-run extortion showed up again in 2026 and the fix has never been tested by anyone else.

  1. Reported Aug 27, 2025

    Anthropic self-reported (Aug 27, 2025) that a criminal actor used Claude Code to automate intrusion and data analysis against 'at least 17 distinct organizations' in healthcare, emergency services, government and religious institutions… source

  2. Response Aug 27, 2025

    Anthropic: 'We banned the accounts in question as soon as we discovered this operation' and 'shared technical indicators about the attack with relevant authorities.' No public statement from any victim, law-enforcement agency or the actor… source

  3. Claimed fix Aug 27, 2025 partial

    Anthropic says it developed 'a tailored classifier (an automated screening tool)' and a new detection method for this pattern, alongside the bans. source

  4. Independent check Sep 11, 2026 none

    No independent verification found - no arrests, no named victims, no outside test of the classifier. The pattern recurred by Anthropic's own account: an attacker wore down Claude's refusals to breach Mexican government systems (Dec… source

  5. Where it stands Sep 11, 2026 reopened

    The accounts are gone, but Claude-assisted extortion recurred with other operators in 2026 and nobody outside Anthropic has measured whether the classifier catches it. source

The full case, with what would change the verdict →

The capability behind it

Sources

Anthropic, second source. Activity within the month before the report. Same report covers GTG-5004 (UK actor selling Claude-built ransomware kits for $400-$1,200) and DPRK IT workers.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.