A cybercriminal tracked by Anthropic as GTG-2002 used Claude Code to automate an end-to-end data-extortion operation: reconnaissance, credential harvesting, network penetration, malware creation, and analysis of stolen data to size ransom demands. Claude also drafted psychologically targeted ransom notes.
AIC-0004 S5 · Critical
'Vibe hacking': Claude Code used to run an automated extortion campaign (GTG-2002)
- Harm
- At least 17 organizations across government, healthcare, emergency services and religious institutions targeted; Bitcoin ransom demands from US$75,000 to over US$500,000.
- Detection
- Identified by Anthropic's own threat-intelligence team through misuse detection on its platform.
- Outcome
- Anthropic banned the accounts and deployed tailored classifiers/detection; disclosed in its August 2025 threat report.
A documented entry in the AI Crime Registry, a Defici non-profit initiative. Sourced from public reporting; corrections: [email protected].