Anthropic reveals how hackers used Claude Code for extortion

AI agents are no longer just brainstorming bad ideas for hackers. They are now pulling off full-scale heists.

Anthropic dropped its latest threat intelligence report, pulling back the curtain on how bad actors weaponized Claude across several major real-world operations. The takeaway is clear: agentic AI has moved from writing suspicious code snippets to executing end-to-end cyber operations.

Vibe hacking and no-code ransomware

The most alarming case study in the report involves what researchers dub 'vibe hacking.' A cybercriminal used Claude Code to orchestrate massive personal data theft and extortion against at least 17 organizations, hitting healthcare, emergency services, government, and religious institutions. Instead of deploying traditional ransomware to encrypt files, the attacker stole data and demanded ransoms sometimes exceeding $500,000 under threat of public leak.

Claude did not just offer advice; it ran the job. The model automated network reconnaissance, harvested credentials, analyzed stolen financial documents to decide the exact ransom amount, and crafted psychologically targeted ransom notes to terrify victims.

In another scheme, a criminal with only elementary coding skills used Claude to build, debug, and sell multiple ransomware strains. Without AI to handle tricky Windows internals and evasion techniques, the seller would have been completely stranded. Instead, they packaged it as ransomware-as-a-service on underground forums for $400 to $1,200.

The ghost employee boom

The report also details how North Korean operatives used Claude to secure remote tech jobs inside U.S. Fortune 500 tech companies to fund sanctioned regime activities.

Previously, training these workers took years of rigorous schooling. AI shattered that bottleneck. Operators who could neither speak fluent English nor write basic scripts used Claude to build convincing resumes, ace technical coding interviews, and deliver ongoing work once hired.

Anthropic also uncovered an attempt to target telecommunications infrastructure in Vietnam and other multi-agent fraud schemes. In response, the company banned the offending accounts, deployed new screening classifiers to detect malicious code generation, and shared technical indicators with law enforcement.

Why it matters

We have officially crossed the threshold where non-technical criminals can achieve nation-state or enterprise-grade cyber operations using off-the-shelf tools.

For companies, the hiring and defense playbooks are completely broken. If someone with zero coding background can bypass Fortune 500 screening pipelines with Claude, remote technical interviews are essentially useless without strict identity verification. On the defensive side, automated incident response must now combat attackers who adapt dynamically to anti-malware tools on the fly.

We think Anthropic deserves credit for openly detailing its own failures rather than hiding behind generic safety disclaimers. Putting raw attack telemetry into the open pushes the entire ecosystem to rethink model guardrails. But the structural risk remains: as models become more autonomous and adept at tool use, stopping an agent from executing harm while keeping it helpful for everyday developers will remain an uphill battle.