Cases › security breach › LR-2026-0752
Russia-linked cyberespionage group used Claude to reverse-engineer military drone firmware
Preliminary Why: 1 report: escudodigital.com · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, agent tool, could do, deployer, industry.
A Russia-linked cyberespionage group, which Anthropic links to Storm-2945, a subgroup of Midnight Blizzard, used Anthropic's Claude assistant in a hacking campaign. The company's threat report covers the period from December last year to August and says the actors targeted more than 20 government, intelligence, diplomatic and defence organisations. The group accessed the email accounts of two manufacturers of drone components, targeted a military drone manufacturer and stole a software development kit for a drone vision system. The group then used Claude to reverse-engineer that vision system. It also used AI to test whether security software could detect its tools and to modify and redeploy detected components. Anthropic said it disrupted the activity, used what it learned to strengthen its safeguards, and shared intelligence with authorities and industry partners.
What happened
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Similar incidents
Evidence
No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 1 items from the primary sources
What happened, in order
- December last year to August Period covered by Anthropic's threat report, during which the threat actors targeted more than 20 organisations.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The article date 2026-09-15 is used only as a timeline entry, not as a disclosure date.
LR-2026-0752 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON