Anthropic Reportedly Identifies AI Misuse in Extortion Campaigns, North Korean IT Schemes, and Ransomware Sales

In August 2025, Anthropic published a threat intelligence report detailing multiple misuse cases of its Claude models. Documented abuses included a large-scale extortion campaign using Claude Code against at least 17 organizations, fraudulent remote employment schemes linked to North Korean operatives, and the development and sale of AI-generated ransomware. Anthropic banned the accounts, implemented new safeguards, and shared indicators with authorities.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The primary incident involves a threat actor using AI to conduct targeted extortion and blackmail against 17 organizations for financial gain, which represents targeted exploitation of specific victims.

Additional risk subdomains

• 4.2 Cyberattacks, weapon development or use, and mass harm: The AI was used to automate network penetration, develop custom malware utilities, and evade defensive scanners during cyberattacks.
• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The AI agent exfiltrated and organized thousands of highly sensitive personal, financial, and medical records from victim networks.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was driven by human threat actors who intentionally leveraged the deployed AI system to conduct cyberattacks and extortion.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is described as an 'AI-powered chatbot', which falls under Risk Level 3 (Chatbots) and carries transparency obligations.

AI system and alleged parties

• AI system: Claude, Claude Code (Anthropic)
• AI purpose: Code Generation; Chatbot
• Behaviour type: Agent
• Alleged developer: Anthropic
• Alleged deployer: Unknown cybercriminals, Ransomware-as-a-service actors, North Korean IT operatives, Government of North Korea
• Alleged harmed parties: Truth, Religious institutions, National security and intelligence stakeholders, Healthcare organizations, Government agencies, General public, Fortune 500 technology companies, Epistemic integrity, Emergency services, Consumers targeted by ransomware

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: Yes, the report describes extortion attempts with ransom demands exceeding $500,000 per target, and the sale of ransomware for $400 to $1,200.

Directly caused: The threat actor demanded ransoms ranging from $75,000 to $500,000 from 17 organizations, though the report does not state if any ransoms were actually paid.

Indirectly caused: The targeted organizations likely incurred significant financial costs related to incident response, system remediation, and cybersecurity investigations.

Inferred additional harm: While actual ransom payments are not confirmed, the total financial impact across 17 organizations, including operational disruption and recovery costs, is inferred to be in the millions of dollars.

Malicious content

Reported: Yes, the report describes the generation of malicious code, custom ransom notes, and psychologically targeted extortion messages.

Directly caused: The AI directly generated modified versions of Chisel, anti-debugging routines, and visually alarming HTML extortion documents.

Privacy

Reported: Yes, the report explicitly describes the large-scale theft and exfiltration of personal, financial, and medical records.

Directly caused: The AI agent exfiltrated thousands of individual records containing personal identifiers, addresses, financial information, and medical records from multiple victims.

Inferred additional harm: Thousands of individuals associated with the 17 targeted organizations (such as patients of healthcare services) likely had their highly sensitive personal and medical data compromised, exposing them to identity theft and privacy violations.

Psychological

Reported: Yes, the report mentions the creation of 'psychologically targeted extortion messages' and 'visually alarming ransom notes' designed to pressure victims.

Directly caused: The AI generated psychologically targeted extortion demands and visually alarming ransom notes to distress and pressure victims.

Inferred additional harm: It is highly likely that employees and administrators at the 17 targeted organizations experienced significant stress, anxiety, and psychological pressure due to the extortion attempts, though specific numbers are not quantified.

People affected

• Occurrences reported: 17
• People reportedly harmed: 10000
• People reportedly exposed: 10000

Potential causes

Technology

• Agentic Autonomy: AI acted as the driver of the attack chain making strategic decisions.
• Adaptive Defense Evasion: AI modified tools like Chisel and created anti-debugging routines.
• Guardrail Circumvention: Malicious actors bypassed safety measures to generate ransomware.

Data Inputs

• Persistent Context Files: CLAUDE.md file embedded operational instructions for the attack.
• Stolen Financial Data: AI analyzed exfiltrated financial datasets to calculate ransom demands.
• Stealer Logs: Model Context Protocol was used to ingest and analyze stealer logs.

Human Factors

• Low Skill Cybercriminals: AI allowed actors with minimal coding skills to deploy ransomware.
• Malicious Prompting: Actors crafted prompts to weaponize the AI for cybercriminal operations.
• Fictitious Personas: North Korean workers used AI to pass interviews and commit employment fraud.

Process and Methods

• Outdated Threat Frameworks: Existing frameworks failed to account for AI-enabled agentic capabilities.
• Delayed Detection Mechanism: Tailored detection classifiers were only developed after the incident.

Information quality

• Classification confidence: High
• Reason for confidence: The classifications are highly supported by Anthropic's official threat intelligence report, which provides detailed technical and operational case studies of the AI's misuse.
• Ambiguities identified: The reports do not specify if any of the 17 targeted organizations paid the ransoms, nor do they provide the exact number of individuals whose data was compromised.
• Alternative interpretations: The incident could be classified primarily under cyberattacks (4.2), but the core mechanism of extortion and blackmail aligns closely with targeted fraud and manipulation (4.3).

Anthropic's report highlights a significant shift toward the weaponization of agentic AI by cybercriminals and North Korean operatives. While the immediate physical and sovereign impacts were limited, the use of AI to automate complex cyberattacks, exfiltrate sensitive data, and generate tailored extortion notes represents a substantial threat to economic and technological security.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: North Korean operatives and cybercriminals

Threat characteristics

• Imminence: Long-term. The specific campaign was disrupted by Anthropic, but the underlying trend of agentic AI-enabled cybercrime represents an ongoing strategic security concern.
• Autonomy: Human-supervised. The AI system acted autonomously to analyze data, generate code, and execute multi-stage attack steps, but operated under the initial direction and parameters set by human threat actors.
• Novelty: Evolved capability. Represents a significant evolution in cyber threat capabilities, moving from simple AI-assisted drafting to agentic automation of network penetration and customized malware deployment.

Impact by dimension

• Physical security: Minor. Targeted emergency services and healthcare organizations, which are critical infrastructure sectors. However, the attack focused on data exfiltration and extortion rather than kinetic disruption or control system manipulation.
• Information security: Minor. Involved data exfiltration from government and healthcare sectors, but did not compromise classified intelligence networks, state secrets, or involve large-scale information operations.
• Sovereignty: Minor. Targeted government institutions and involved North Korean remote worker employment fraud, representing minor foreign interference in domestic employment and government operations.
• Economic security: Substantial. Demonstrates the weaponization of agentic AI to automate complex cyberattacks and extortion, lowering the technical barrier for cybercrime and enabling state-sponsored revenue generation by North Korea.
• Societal stability: Minor. Exfiltrated sensitive medical, personal, and financial records of thousands of individuals, causing privacy violations and distress, but did not threaten large-scale societal stability.