Anthropic Warns AI Agents Can Now Automate the Entire Cyber Kill Chain

Artificial intelligence is changing how cybersecurity teams detect threats—and how attackers conduct cyber operations. Anthropic has warned that AI agents are increasingly capable of automating multiple stages of the cyber kill chain, from reconnaissance and credential theft to lateral movement and data exfiltration.

According to Anthropic’s September 2026 threat intelligence report, activity disrupted between December 2025 and August 2026 involved suspected state-backed groups, cybercriminals and individual hacktivists using Claude models, including Haiku, Sonnet and Opus.

The report describes AI systems moving beyond simple code generation to support coordinated attack workflows. Although human operators continued to make important decisions, AI agents increasingly handled repetitive technical tasks between those decisions.

How AI Agents Are Changing Cyberattacks

Traditional cyber operations often require attackers to move through several stages, including identifying targets, finding vulnerabilities, obtaining credentials, gaining access and collecting sensitive information.

AI agents can connect language models with tools that perform technical tasks and process their results. This allows parts of an operation to be coordinated with less manual intervention.

According to Anthropic, publicly available agent frameworks can support activities across multiple stages of the cyber kill chain. However, increased automation does not necessarily mean every operation succeeds or that human involvement has disappeared.

The report highlights a growing concern for defenders: attackers may be able to conduct more complex investigations and repeat technical tasks faster than before.

Suspected State-Backed Activity Targeted European Organisations

One case involved a group tracked as GTG-20006. Anthropic said the group’s activity was consistent with public reporting about Midnight Blizzard.

The reported targets included government, military, diplomatic and defence organisations in Ukraine and Europe. The group also showed particular interest in drone technology and its suppliers.

According to Anthropic, AI-assisted workflows supported activities such as phishing infrastructure preparation, credential theft, command-and-control operations and data collection.

The report also described workflows that monitored whether security products detected deployed malware. When detection occurred, agents helped modify and rebuild tools before testing them again.

This feedback loop illustrates a potential challenge for defenders. Security controls based primarily on known malware signatures may be less effective when attackers can rapidly change their tools. Behavioural detection, endpoint monitoring and timely threat intelligence therefore remain important.

Criminal Groups Used AI to Process Stolen Data

Anthropic also described activity tracked as GTG-50014, involving suspected affiliates of the ShinyHunters cybercrime ecosystem.

In one reported case, an operator used a credential-harvesting workflow across 10 AWS EC2 workers. The operation reportedly downloaded 1.8 million Android application packages and searched them for exposed secrets. Verified findings were then sent to Telegram for further use.

In another incident, attackers reportedly collected more than 2,100 Azure Active Directory token sets across over 40 corporate tenants in approximately 34 hours.

Anthropic said AI agents performed nearly all the work in that case. These examples demonstrate how automated processing can help attackers search large datasets for credentials and expand the potential impact of compromised access.

Stolen credentials, API keys and access tokens can create significant risks because they may provide access to cloud services, internal applications and sensitive business information.

AI Automation Does Not Eliminate Human Involvement

Despite the growing capabilities of AI agents, Anthropic emphasised that people remained involved in important parts of the reported operations.

Human operators continued to select targets, review collected information and make decisions connected to monetisation or further activity.

Automation should therefore not be confused with complete autonomy. An AI agent may perform many technical tasks, but its output still depends on the tools, permissions, instructions and environment available to it.

The potential impact also varies between campaigns. More automation can increase speed and scale, but it does not guarantee successful exploitation or greater damage in every situation.

Security Risks for Organisations

The reported activity highlights several areas that organisations should prioritise.

Credential protection: Use multifactor authentication, protect privileged accounts and rotate exposed credentials promptly.

API key security: Store secrets in managed secret-storage systems rather than source code or public repositories. Apply least-privilege permissions and monitor unusual usage.

Endpoint monitoring: Use endpoint detection and response tools to identify suspicious processes, unexpected script execution and unusual access patterns.

Cloud security: Monitor authentication events, token usage, workload activity and access across cloud tenants.

Phishing defence: Strengthen email security, train employees to recognise suspicious messages and investigate unusual authentication behaviour.

Threat intelligence: Combine indicators of compromise with behavioural analytics. An attacker may change infrastructure or malware, making detection based on a single indicator insufficient.

How Security Teams Can Respond to AI-Driven Threats

Organisations should evaluate their incident-response procedures against scenarios involving faster reconnaissance, credential theft and automated data collection.

Security teams can use authorised AI tools to support log analysis, alert triage, vulnerability management and incident investigation. These systems should operate with clearly defined permissions and human oversight.

Organisations should also monitor access to AI services and protect API credentials used by internal agents. An improperly secured AI workflow can itself become a route to sensitive data or unauthorised actions.

Testing should take place within authorised environments, with safeguards that prevent automated tools from accessing systems or data outside the approved scope.

Conclusion

Anthropic’s September 2026 threat intelligence report highlights the growing role of AI agents in coordinated cyber operations. The reported campaigns demonstrate how automation can support credential theft, malware modification, large-scale data analysis and access across multiple organisations.

Human operators remain part of these activities, but AI agents may reduce the time and manual effort required to perform technical tasks.

For defenders, the priority is to strengthen identity security, protect credentials, monitor endpoint and cloud activity, and combine automated detection with experienced human analysis.

As AI-assisted attacks evolve, organisations need security programmes capable of detecting suspicious behaviour—not just recognising previously documented malware.

CyberExy — Secure Tomorrow.