AI THREAT TRACKER / AI-014 · Incident

Claude-assisted intrusions expose student and citizen data

Human-directed intrusions reach production systems.

Model labAnthropic

TopicsUnauthorized access

OCCURREDMarch–June 2026 (exact dates unknown)

PUBLIC ACCOUNT10 Sept 2026

EVIDENCEFirst-party account

About these dates

Campaign window; individual breach dates remain unknown.

What happened

Anthropic reports that GTG-10007 used Claude to coordinate intrusions and continuing vulnerability research. Attackers stole student and citizen records and accessed a retailer's internal systems. Anthropic ↗

Anthropic banned associated accounts. Specific intrusion dates and victims' recovery are not independently verified here. Anthropic ↗

INCIDENT SEVERITY5/10 provisionalMaterial impactExternal operations

Operational intrusions exposed personal data. This meets level 5; internal access and data volume alone do not establish the shared control or serious recovery burden needed for level 6.

Rating criteria →

Sources & attribution

First-party report 10 Sept 2026
Detecting and countering misuse of AI: September 2026 ↗
Anthropic. The developer is an interested party. Claims and attributions require their stated qualifications.
Full report (PDF) ↗.