{"schema_version":"0.10.0","id":"LR-2026-0752","record_version":1,"title":"Russia-linked cyberespionage group used Claude to reverse-engineer military drone firmware","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":49.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: escudodigital.com · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: escudodigital.com · subject to change"}]},"sources_hash":"c589338590deac0836ce0ecb990c8fc6f2383eb077003df2e6925cc151f2686e"},"system":{"model_name":"Claude","model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-15","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A Russia-linked cyberespionage group, which Anthropic links to Storm-2945, a subgroup of Midnight Blizzard, used Anthropic's Claude assistant in a hacking campaign. The company's threat report covers the period from December last year to August and says the actors targeted more than 20 government, intelligence, diplomatic and defence organisations. The group accessed the email accounts of two manufacturers of drone components, targeted a military drone manufacturer and stole a software development kit for a drone vision system. The group then used Claude to reverse-engineer that vision system. It also used AI to test whether security software could detect its tools and to modify and redeploy detected components. Anthropic said it disrupted the activity, used what it learned to strengthen its safeguards, and shared intelligence with authorities and industry partners.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07","secondary_risks":["RK04"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","harm_class":["third_party_security"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.escudodigital.com/en/cybersecurity/russian-intelligence-uses-claude-reverse-engineer-military-drones-evade-cyber-defences.html","publisher":"Escudo Digital","date":"2026-09-15","type":"press","title":"Russian intelligence uses Claude to reverse-engineer military drones and evade cyber defences - Escudo Digital","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.model_name":"C","event.incident_class":"C","impact.harm_class":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Generative artificial intelligence company Anthropic has taken action against a Russian cyberespionage group that had been using its Claude assistant in a hacking campaign."}],"system.model_name":[{"source_index":0,"quote":"Generative artificial intelligence company Anthropic has taken action against a Russian cyberespionage group that had been using its Claude assistant in a hacking campaign."}],"event.incident_class":[{"source_index":0,"quote":"Generative artificial intelligence company Anthropic has taken action against a Russian cyberespionage group that had been using its Claude assistant in a hacking campaign."}],"impact.harm_class":[{"source_index":0,"quote":"The Kremlin-linked threat actors accessed the email accounts of two manufacturers of unmanned aerial vehicle components, targeted a military drone manufacturer and stole a complete proprietary software development kit for a drone vision system."}],"impact.severity":[{"source_index":0,"quote":"According to a threat report published by the company –covering the period from December last year to August–, the threat actors targeted more than 20 government, intelligence, diplomatic and defence organisations."}],"event.summary":[{"source_index":0,"quote":"Generative artificial intelligence company Anthropic has taken action against a Russian cyberespionage group that had been using its Claude assistant in a hacking campaign."},{"source_index":0,"quote":"According to a threat report published by the company –covering the period from December last year to August–, the threat actors targeted more than 20 government, intelligence, diplomatic and defence organisations."},{"source_index":0,"quote":"In this case, Anthropic links the campaign to Storm-2945, a subgroup of Midnight Blizzard."},{"source_index":0,"quote":"The Kremlin-linked threat actors accessed the email accounts of two manufacturers of unmanned aerial vehicle components, targeted a military drone manufacturer and stole a complete proprietary software development kit for a drone vision system."},{"source_index":0,"quote":"They then used Claude to reverse-engineer the drone's vision system, allowing them to reconstruct its product architecture, hardware bill of materials and supplier dependencies, as well as uncover details of an unannounced product."},{"source_index":0,"quote":"To make matters worse, the APT used artificial intelligence (AI) to determine whether security software could detect its hacking tools."},{"source_index":0,"quote":"When it did, the attackers used Anthropic's large language model (LLM) to systematically identify, modify and redeploy the detected components."},{"source_index":0,"quote":"In each case, we disrupted the activity, used what we learned to strengthen our safeguards, and shared intelligence with authorities and industry partners, where appropriate,"}]},"notes_on_gaps":"Single press source (Escudo Digital); Anthropic's threat report itself was not provided. The source gives no exact occurrence dates; the stated period is December (previous year) to August with no year, so date_occurred is omitted. The article date 2026-09-15 is used only as a timeline entry, not as a disclosure date. Not stated: how the activity was detected, root cause, trigger, whether an autonomous agent was involved (agent fields omitted), system tools, autonomy, deployment context, country and industry of the incident, and which controls held or failed; links is therefore empty. Judgements: severity 'major' applied because the source states a count of more than 20 targeted organisations; the remediation control mapping (D7 for disrupting accounts, F6 for sharing with authorities) is my interpretation of a general statement that names no control. Attribution to Midnight Blizzard and Storm-2945 is as stated by the company via the press; impact.reversibility and data categories are omitted as unstated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: escudodigital.com · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"A Russian cyberespionage group used Claude's assistant in a hacking campaign.","quote":"Generative artificial intelligence company Anthropic has taken action against a Russian cyberespionage group that had been using its Claude assistant in a hacking campaign.","source_index":0,"grade":"C"},{"step":"reached","text":"The group accessed email accounts of two drone-component manufacturers and stole a software development kit for a drone vision system.","quote":"The Kremlin-linked threat actors accessed the email accounts of two manufacturers of unmanned aerial vehicle components, targeted a military drone manufacturer and stole a complete proprietary software development kit for a drone vision system.","source_index":0,"grade":"C"},{"step":"caught","text":"Anthropic states it disrupted the activity and shared intelligence with authorities and industry partners.","quote":"In each case, we disrupted the activity, used what we learned to strengthen our safeguards, and shared intelligence with authorities and industry partners, where appropriate,","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.escudodigital.com/en/cybersecurity/russian-intelligence-uses-claude-reverse-engineer-military-drones-evade-cyber-defences.html"]},"analysis":{"sections":{"timeline":[{"text":"Period covered by Anthropic's threat report, during which the threat actors targeted more than 20 organisations.","quote":"According to a threat report published by the company –covering the period from December last year to August–, the threat actors targeted more than 20 government, intelligence, diplomatic and defence organisations.","source_index":0,"when":"December last year to August"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.escudodigital.com/en/cybersecurity/russian-intelligence-uses-claude-reverse-engineer-military-drones-evade-cyber-defences.html"]}}