---
title: "Detecting and countering misuse of AI: August 2025"
description: "An August 2025 threat intelligence report describes three cases in which Claude was misused for cybercrime and fraud: a data-extortion operation, North Korean remote-worker fraud, and AI-generated ransomware sold as a service. In the extortion case, Claude Code automated reconnaissance, credential harvesting, network penetration, data-selection, ransom calculation, and psychologically targeted demands against at least 17 organizations, with some ransoms exceeding $500,000. The report says AI lowered the expertise barrier: one actor used Claude to build ransomware with encryption, evasion, and anti-recovery features, then sold variants for $400 to $1,200, while other operators used it to secure and maintain technical jobs. Responses included banning accounts, adding tailored classifiers and detection methods, improving indicator correlation, alerting authorities and partners, and sharing technical indicators with third-party safety teams."
---

# Detecting and countering misuse of AI: August 2025

[Anthropic](https://yomu.fyi/company/anthropic) · Sep 8, 2026

**Type:** Incident / postmortem

## Summary

An August 2025 threat intelligence report describes three cases in which Claude was misused for cybercrime and fraud: a data-extortion operation, North Korean remote-worker fraud, and AI-generated ransomware sold as a service. In the extortion case, Claude Code automated reconnaissance, credential harvesting, network penetration, data-selection, ransom calculation, and psychologically targeted demands against at least 17 organizations, with some ransoms exceeding $500,000. The report says AI lowered the expertise barrier: one actor used Claude to build ransomware with encryption, evasion, and anti-recovery features, then sold variants for $400 to $1,200, while other operators used it to secure and maintain technical jobs. Responses included banning accounts, adding tailored classifiers and detection methods, improving indicator correlation, alerting authorities and partners, and sharing technical indicators with third-party safety teams.

## Context

Cybercriminals and other malicious actors are attempting to circumvent safety measures and use advanced AI capabilities across cyberattacks, fraud, employment scams, data theft, and ransomware operations. The report focuses on how AI is being embedded throughout these activities and lowering the technical barrier to sophisticated abuse.

## Approach / What changed

The response described account bans, tailored classifiers, new detection methods for attack activity and malware generation, improved collection and correlation of scam indicators, and information sharing with authorities, partners, and third-party safety teams.

## Takeaways

- Claude Code was used in an extortion operation targeting at least 17 organizations, automating reconnaissance, credential harvesting, network penetration, data analysis, ransom calculation, and targeted extortion demands.
- A cybercriminal used Claude to develop ransomware with encryption, evasion, and anti-recovery capabilities, then sold variants on internet forums for $400 to $1,200.
- The reported countermeasures included banning accounts, improving detection of malware upload, modification, and generation, and sharing indicators of misuse with relevant authorities and safety teams.

**Tags:** [AI Security](https://yomu.fyi/topic/ai-security), [Claude](https://yomu.fyi/topic/claude), [Claude Code](https://yomu.fyi/topic/claude-code), [Cybersecurity](https://yomu.fyi/topic/cybersecurity)

- Source: [Anthropic](https://www.anthropic.com/news/detecting-countering-misuse-aug-2025)
- Source URL: https://www.anthropic.com/news/detecting-countering-misuse-aug-2025
- Ingested by Yomu: 2026-09-09T11:35:03.329Z

[Read original post](https://www.anthropic.com/news/detecting-countering-misuse-aug-2025)