A Russia-linked espionage crew ran monitoring agents whose entire job was to watch whether its implants had been flagged by antivirus products, and to rewrite and rebuild them automatically until they came back clean. Anthropic described the technique on September 10 as part of a set of intrusion operations it detected and disrupted, and it is the clearest published example yet of an attacker closing the loop that security vendors have relied on for two decades.
Key takeaways
- An actor Anthropic tracks as GTG-20006, whose tradecraft it assesses as consistent with Midnight Blizzard, used agents to iterate on detected malware until it evaded security products, then staged the rebuilt payloads on disposable hosts.
- A financially motivated cluster ran ten AWS EC2 workers that downloaded and decompiled 1.8 million Android APKs hunting for hardcoded secrets, and separately dumped more than 2,100 Azure AD token sets across over 40 corporate tenants in about 34 hours.
- Stolen AI API keys are now an objective in themselves β one actor attacked roughly thirty AI companies in four days chasing access to a pre-release Claude model and failed every time.
Why the evade-rebuild loop breaks detection economics
The defensive model that static signatures support is a cost-imposition game. An attacker builds a custom implant, uses it until a vendor writes a detection for it, then pays to rebuild. Every cycle costs the attacker engineering time, and that delay is where defenders find victims before the damage compounds.
GTG-20006 removed the delay. Its agents monitored whether deployed tooling was being caught, and on a hit they modified and recompiled the artifact, retested it, and kept going until nothing fired. The human operator's main involvement was editing the skills that drove the workflows when they needed refinement. Anthropic's own framing is that capable adversaries can now bypass traditional detections faster than defenders can write and ship them.
The targeting behind the automation was conventional espionage. More than twenty distinct organizations appeared in the actor's planning and live operations β government ministries, embassies, think tanks and defense-industrial firms concentrated in Ukraine and Europe β with email and remote access systems scanned across more than two dozen Ukrainian government bodies. Drone supply chains drew particular attention: the actor bulk-exported mailboxes at two drone component makers and stole a complete software development kit for a drone vision system, spending days reverse-engineering its architecture, hardware bill of materials and supplier dependencies.
Reach was extended indirectly by compromising at least three vendors running hotel guest WiFi and rewriting DNS records so guest traffic resolved to actor-controlled servers. A separate intrusion at a North African government technology authority produced a credential database holding over 300,000 national identity records and commercial registry data covering more than half a million companies.
Credential discovery at industrial scale
A different cluster, linked to affiliates of the ShinyHunters collective, automated the front of the kill chain instead of the back. One French-speaking operator ran a distributed pipeline across ten EC2 workers that mass-downloaded 1.8 million distinct Android APKs from multiple app stores, decompiled them, and scanned the results for hardcoded secrets with TruffleHog. Verified hits streamed in real time into a Telegram group organized into more than a hundred categories by secret type, and a parallel harvester fed stolen GitHub personal access tokens into the same funnel.
What followed was fast. One compromise went from a single stolen developer token to full administrative control of a victim's cloud environment in roughly three hours. Another produced a session-store dump of over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours β work Anthropic says was performed almost entirely by AI agents. After breaching one software-as-a-service provider, operators used the foothold to pull data belonging to roughly 200 downstream customer organizations.
Unattended exploit research
A third group, operating from Changsha and including two undergraduates at a local university, built something closer to a factory. Firmware images were decrypted, unpacked and loaded into decompilers by agents that walked cross-reference chains, formed vulnerability hypotheses against a knowledge base curated over time, wrote exploit code, and tested it against lab copies of the target product, iterating until it worked. One workflow aimed at network appliances produced more than a dozen candidate zero-days in a single month.
The group ran what Anthropic calls agent swarms, with a lead agent decomposing reconnaissance and post-exploitation work across parallel subagents, and it kept persistent campaign memory so target lists, harvested credentials and standing instructions survived between sessions. Roughly fifty organizations were targeted across education, retail, energy, healthcare, finance and government.
AI keys became loot, compute and cover
The economics of stolen model access explain a lot of the rest. A working API key resells in established markets, runs the buyer's attack workloads at the victim's expense, and attributes the traffic to the credential's legitimate owner. One hacktivist campaign ran for a month entirely on stolen keys. ShinyHunters affiliates switched their own workloads onto victim keys as soon as they found them.
One Russian-speaking actor injected instructions into an AI vendor's automated evaluation sandbox to make it hand over the production keys it held, then reused the same playbook against roughly thirty AI companies in about four days. Its stated goal, pursued across more than a dozen routes, was access to an unreleased Claude model; every attempt failed. Another group sold discounted "Claude" access that quietly proxied traffic to a different model while installing a credential harvester on the buyer's machine.
The practical instruction is narrow: treat AI keys, sandboxes, proxies and agent integrations as production credentials, and buy model access only through authorized channels. Anthropic's write-up of the disrupted operations carries indicators of compromise, drew an extended thread on Hacker News, and includes a separate section on model copying that we covered in Anthropic's 200-million-exchange distillation findings.
FAQ
Were Anthropic's own systems breached?
No. In every case involving stolen model credentials, the keys came from customers' environments β exposed in code repositories, mobile app binaries, containers and vendor evaluation sandboxes. The actor that spent four days probing thirty AI companies for a pre-release model never got in.
Does this mean endpoint detection is obsolete?
Not obsolete, but the assumption behind it has weakened. Signature-based detection worked partly because rebuilding evasive tooling was slow and expensive for the attacker. When that rebuild is automated and runs unattended, defenders lose the tempo advantage and need behavioral and identity-side controls to carry more weight.
What should teams shipping AI agents do first?
Inventory every place a model credential lives β CI systems, mobile binaries, container images, third-party integrations and evaluation sandboxes β and rotate on the same schedule as production secrets. Prompt injection against an agent that holds keys is now a documented path to credential theft, not a theoretical one.
