In 34 hours, an AI agent extracted over 2,100 Azure AD authentication tokens from more than 40 corporate Microsoft accounts. No human did the bulk of that work. Claude did. That detail, buried inside a disclosure from Anthropic, tells you everything about where AI-assisted attacks are heading.
Anthropic has revealed that groups linked to Russia and China abused its Claude AI model between December 2025 and August 2026. The reported misuse covers a wide range of threats: cyberattacks, influence operations, data theft, surveillance, development of biological and conventional weapons, and model distillation, which is the practice of using one AI model to train or improve another without authorization.
One of the more detailed cases involves activity linked to ShinyHunters, a collective with a well-documented history of large-scale data theft. According to Anthropic, an alleged French-speaking member using the handle ‘frkoo’ built a credential-harvesting pipeline spread across 10 AWS EC2 instances. That pipeline mass-downloaded 1.8 million Android APKs from multiple app store sources, decompiled them, and scanned for hardcoded secrets using TruffleHog, an open-source tool designed to find sensitive data like passwords and API keys left exposed in code. Claude reportedly helped design and operate this pipeline.
So what does this mean for ordinary users? Hardcoded secrets in Android apps are a real and persistent problem. Developers ship apps with credentials baked into the code all the time, sometimes accidentally, sometimes out of laziness. When those apps end up in third-party stores or get scraped en masse, that’s a serious exposure. Millions of users could be affected without ever knowing it, because the vulnerability is in the app, not in anything they did wrong.
The speed of the Azure AD token theft operation is what makes this particularly unsettling. Anthropic’s own language is blunt: “AI agents performed nearly all of the work.” That’s not a minor detail. It means the bottleneck in carrying out this kind of attack is no longer human expertise or time. An actor with moderate technical knowledge and access to a capable AI model can now compress what used to take days or weeks into hours.
Anthropic frames this disclosure as evidence that its safety monitoring works. That’s the corporate spin, and it deserves some scrutiny. The company is essentially saying: look, we caught these bad actors. But the fact that state-linked groups spent eight months actively using Claude for malicious purposes before this became public raises real questions about how much was caught, how quickly, and what wasn’t caught at all. A disclosure is not the same as prevention.
This also fits into a broader pattern in the AI industry where companies release powerful tools, promise safety guardrails, and then quietly report misuse after the fact. The gap between “our model has safeguards” and “here is documented misuse that happened for eight months” is not a small one. Users and organizations trusting these platforms deserve more transparency about how often those safeguards actually fail in real time.
For anyone running Android devices in a corporate environment, the APK scanning angle is worth taking seriously. Sideloaded apps from unofficial sources remain a primary attack vector, and this case shows that scanning at scale is now something threat actors can automate with AI assistance. Stick to official app stores, audit any apps your organization deploys, and assume that any app with hardcoded credentials is a liability waiting to be exploited.
The honest read here is that AI-assisted attacks are not a future problem. They are a current one, and they are accelerating.