Anthropic Reports AI-Assisted Attacks Scanned 1.8M Android Apps for Exposed Secrets

Anthropic disclosed in September 2026 that threat actors misused its Claude AI to conduct large-scale cyberattacks with heavy automation. In one case, a French-speaking operator deployed 10 AWS EC2 workers to decompile 1.8 million Android APKs and extract secrets using tools like TruffleHog, with findings sorted and sent to Telegram. Separate incidents involved state-sponsored and financially motivated groups using AI to automate malware rebuilding for detection evasion, credential harvesting, lateral movement, and bulk data exfiltration from SaaS and cloud environments. Initial access methods included device code phishing, hotel Wi-Fi DNS hijacking, and ClickFix lures, while post-compromise persistence was maintained by registering attacker-controlled devices. Anthropic noted that while humans set the attack objectives, AI agents drove execution, retried failed steps, and in some cases expanded access to downstream customer environments, resulting in data theft and extortion.