Anthropic Reveals a Russian Spy Unit Running Its Own AI-Automated Hacking Operations

Anthropic’s latest threat-intelligence report, covering cases it disrupted between December 2025 and August 2026, describes a Russian state-linked actor it calls GTG-20006 — attribution consistent with the group publicly known as Midnight Blizzard — building a multi-agent AI workflow that carried out reconnaissance, exploitation and data theft against military-intelligence, diplomatic and defense targets across Ukraine and European governments largely on its own. Humans stayed in the loop only to pick targets and review what was stolen; the system itself rebuilt and redeployed its hacking toolkit automatically whenever security software caught it. One operator, using the handle “JackPoterz”, showed tradecraft consistent with Russian state-nexus espionage rather than a criminal or hobbyist operation. The same report says Anthropic separately disrupted a Chinese state-linked distillation scheme siphoning Claude’s outputs to train rival models, and flags that its systems are edging toward the point where they could meaningfully help with bioweapons guidance and drone-targeting software, without saying that threshold has been crossed. Anthropic frames the disclosure as evidence that AI has moved from an advisory tool to something closer to an autonomous operator inside state cyber campaigns aimed squarely at Europe. For a newsletter written from Warsaw, the detail that lands hardest is who was targeted: European governments, in a spying campaign that ran on autopilot.