ShinyHunters affiliates used Claude agents in breaches including a SaaS supply chain theft
What happened
Anthropic reported that operators tied to ShinyHunters used Claude to speed up breaches of a technology provider, an airline, an energy company, a French retailer and others. In one SaaS supply chain theft, agents did nearly all the work, and stolen tokens reached more than 40 corporate tenants.
Anthropic tracks the cluster as GTG-50014. Listed breaches include a technology provider (over 1 TB, including national identifiers and payment card records), an airline (tens of millions of passenger records), an energy company, a French retail chain, a Web3 identity platform and a nonprofit. The SaaS supply chain attack reached about 200 downstream customer organizations. The actors also scanned 1.8 million Android apps for embedded secrets and reused stolen AI API keys.
How it happened
Manipulated AI: Jailbreak and misuse. An attacker talked an AI model past its safety rules and then used it to carry out the attack.
The AI involved was from Anthropic. The product was Claude, a type of AI agent.
Impact
Data was exposed. Data involved: personal data, financial and credentials. Many organizations were affected.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 10 Sep 2026.
Anthropic says it disrupted the activity, banned associated accounts and strengthened safeguards. It also engaged authorities, industry partners and victims.