Anthropic’s report reveals that Russian-linked hackers used its Claude AI model to carry out cyber-espionage against over 20 organizations, primarily targeting Ukraine but also including drone suppliers and other government entities. The same AI was employed in disinformation campaigns in Central African Republic (CAR) and Moldova, where a single operator ran pro-Kremlin content for Radio Lengo Songo in coordination with Russian state media outlets. Anthropic has since blocked these malicious activities and enhanced its security measures based on the findings.
Written by the local model on 2026-09-16,
using this article's own text rather than the other coverage of the
same event (that is the story summary below).
Story summary
In a report published on September 12, 2026, Anthropic, an AI firm behind the Claude chatbot, revealed that it had uncovered a sophisticated influence operation linked to the UAE government. This campaign targeted UN experts and members of the Muslim Brotherhood using its AI model to generate reports, advocacy materials, social media content, and testimony aimed at undermining criticism of Abu Dhabi's role in Sudan's conflict. Since April 2023, Sudan has been embroiled in a war between the army and the paramilitary Rapid Support Forces (RSF), which the UN describes as one of the world’s worst humanitarian crises. The UAE has faced accusations from UN experts and others of supporting the RSF, allegations it denies. Anthropic traced this operation with high confidence to UAE government officials, who allegedly used around 300 fake social-media accounts, created a front NGO, and compiled files on European lawmakers, journalists, and UN officials.
Written for “AI Misuse And Threats” on 2026-09-17,
grounded in this article and the 3 other(s) covering the same event.
Anthropic's latest report on the abuse of its AI model found that a Russian-linked hacking group used Claude to automate attacks on more than 20 organisations, including Ukrainian defence ministries and drone suppliers, while separate operators ran pro-Kremlin disinformation in Africa and Moldova.
asserted
operators → find → Africa
Russia used Anthropic's Claude AI model to accelerate cyber-espionage operations against Ukrainian and European government targets, run disinformation campaigns in Africa and Moldova, and develop targeting software for autonomous kamikaze drone swarms, the US company said in a report published this month.
asserted
company → use → report
Anthropic said it had blocked all malicious activity identified in the report, used the findings to strengthen its security systems, and shared the information with government bodies and industry partners.
asserted
it → say → bodies
In one major case, a hacking group designated GTG-20006 used Claude to automate operations against more than 20 organisations, including government ministries, defence and intelligence agencies, embassies, think tanks and defence-industrial companies, Anthropic said.
asserted
Anthropic → designate → ministries
Ukraine was the primary target, with suppliers of military drone technology and their supply chains also among those attacked.
asserted
Ukraine → attack → those
The group also targeted Middle Eastern and Asian government departments with links to maritime activity.
asserted
group → target → activity
Anthropic said GTG-20006 is linked to Midnight Blizzard, a hacking group Western intelligence assessments attribute to Russia's foreign intelligence service SVR.
asserted
assessments → say → service
The group used Claude across a range of operational modes: as an engineering assistant for writing malware, phishing kits and surveillance tools, as an executor of commands on victims' networks, including collecting credentials and extracting data under human direction, and in fully autonomous operations with minimal human oversight.
asserted
group → use → oversight
Disinformation in the CAR and Moldova
Working alongside investigators from the All Eyes On Wagner project, Anthropic identified and removed an account operated by a Russian-speaking individual in Bangui who was running a disinformation operation for Radio Lengo Songo, a station set up and financed in 2017 by the Kremlin-run mercenary Wagner group.
asserted
who → work → group
The operator prepared daily pro-Russian content for the station in coordination with Russian state outlets RT, Sputnik Afrique and TASS, and with the local "Russian House" cultural centre — part of a network Russia uses as a political and influence hub abroad.
asserted
Russia → prepare → hub
Content consistently promoted the CAR government and Wagner, and attacked France and domestic opposition figures, according to the All Eyes On Wagner investigation.
uncertain
Content → promote → investigation
The operation was designed to appear locally run, with one person coordinating output while contracts, scripts and publications were presented as the work of a Bangui-based radio station.
asserted
contracts → design → station
Anthropic investigators identified the individual through invoices for a Claude subscription issued in central Madrid.
asserted
investigators → identify → Madrid
The operator was linked to Africa Politology, aka "The Company," the information and political technology arm of the African Corps — the successor to Wagner in Africa — which is reportedly controlled by the SVR.
uncertain
which → link → SVR
In Moldova, a former regional head of the Russian state-run Sputnik media network used Claude as a content-production tool, adapting news, polling data, and opposition material to fit pro-Kremlin narratives, Anthropic said.
asserted
Anthropic → run → narratives
Autonomous swarm drone warfare
Anthropic identified and shut down a group of Russia-linked developers who used its Claude Code tool to write software for kamikaze drones, including an autonomous targeting system tested on real hardware.
asserted
who → identify → hardware
The developers trained AI models on footage from combat operations in Ukraine and used a fixed location in the Donetsk region as a demonstration strike target.
asserted
developers → train → target
The project's stated goal was a fully autonomous swarm of FPV kamikaze drones.
asserted
goal → state → drones
Anthropic linked nine accounts involved in the project to a regional Russian university and a federal research centre connected to the Russian Academy of Sciences, without naming either institution.
asserted
Anthropic → link → institution
Claude is officially unavailable in Russia, with access to Anthropic's website and API blocked and Russian bank cards not accepted for payment.
asserted
cards → block → payment
The developers bypassed these restrictions by routing traffic through commercial virtual private servers (VPNs).
asserted
developers → bypass → servers
The Aporia
