New Delhi

Artificial intelligence (AI) is lowering the barriers to sophisticated cyberattacks by allowing individual hackers to automate operations ranging from reconnaissance and phishing to system exploitation and data theft, according to a report by Anthropic.

“Sophisticated attacks no longer require sophisticated attackers,” Anthropic said in the report titled Detecting and countering misuse of AI: September 2026, adding AI use has moved beyond simple chatbot interactions to multi-agent systems capable of carrying out reconnaissance, exploitation and data exfiltration.

The report said Anthropic identified hacktivists, financially motivated criminals and state-linked espionage operators using Claude to run multi-victim campaigns, highlighting how AI is increasingly being used across different stages of cyber operations.

“Over the past six months, our Threat Intelligence team identified and disrupted a series of cyber operations in which threat actors used Claude,” the report noted, adding the actors included suspected “state-sponsored groups,” along with financially motivated criminals, and politically motivated individuals.

According to the report, AI has enhanced offensive cyber capabilities across the entire attack chain, from reconnaissance and tool development to data processing and exploitation.

It further quoted, every layer of offensive operations has been uplifted by AI, from reconnaissance and tool development to data processing and exploitation. 

The report cited GTG-20006 as an example, saying the actor used AI to automate operations and increase the speed of attacks. The group deployed a custom toolkit that included Windows-based implants, a mobile exploitation kit, a credential-stealing tool targeting browser password stores, a phishing platform designed to imitate government organisations and an administrative console for managing compromised accounts.

The tools were managed and modified through AI-assisted workflows, allowing the actor to automatically rebuild and redeploy its toolkit when detected by security products. The actor also used AI to monitor how effectively its tools evaded known security defences.

The actor used AI throughout the attack process, from identifying targets and building phishing infrastructure to executing intrusions, stealing credentials and moving across victim networks. AI was also used to extract and organise hundreds of gigabytes of stolen data and automate efforts to maintain access to compromised accounts and systems, it noted. 

READ MORE:Pezeshkian meets Mirwaiz Umer Farooq, Balkrishna and others

“Our investigation identified more than 20 distinct organizations targeted in the actor’s operational planning, reconnaissance, and live operations. They included government ministries, defense and intelligence bodies, embassies and diplomatic missions, think tanks, and defense-industrial companies, concentrated in Ukraine and Europe but extending to the Middle East and maritime related government agencies in Asia,” it said.