Adversary Intelligence — 2026-09-14

Anthropic September 2026 Threat Report Reveals SVR-Linked Hackers Used AI Agents to Steal Ukrainian Military Drone Technology

BLUFAgentic AI-driven malware that self-corrects against live defenses compresses the attacker's iteration cycle beyond what signature-based detection can match, forcing a structural shift in how networks are defended.

Anthropic reported on September 10 that Russia-linked hackers, consistent with the SVR's Midnight Blizzard operation, used Claude-based AI agents to automate espionage against Ukraine and Europe 123. The Insider reported the group targeted more than 20 Ukrainian and European organizations, including government ministries, defense agencies, embassies, and drone manufacturers, and stole an SDK for a military drone computer-vision system after breaching two drone-component makers 1. After the theft, the hackers reportedly used Claude for days to reverse-engineer the stolen SDK's codebase, reconstructing hardware specifications and undisclosed supplier dependencies 12. The operator, using the handle JackPoterz, also breached at least three hotel Wi-Fi providers to target officials and drone-industry personnel connected to Ukraine, and hijacked WhatsApp accounts belonging to at least two former senior Ukrainian officials 13. Anthropic said it had disrupted the operation over the past six months, according to Kyiv Post 3.

Analysis
This disclosure marks the first documented case of a state-linked actor using agentic AI to self-correct malware against live detection, collapsing the rebuild cycle defenders rely on to regain the advantage. The campaign may equally reflect AI-accelerated execution of already-documented Midnight Blizzard tradecraft, since Microsoft separately described the same hotel Wi-Fi technique as CaptiveCrunch in July. Theft of the drone computer-vision SDK gives Russian intelligence architecture-level insight into a system not yet publicly fielded, narrowing Ukraine's technical edge where marginal gains matter most. The JackPoterz handle and six-month disruption timeline point to a sustained, individually attributable operation rather than one-off experimentation, and confirmed WhatsApp hijackings of former senior officials extend it into personal communications intelligence, pressuring defenders toward behavioral and infrastructure monitoring since the toolkit now updates faster than patches can be issued. Reporting rests solely on Anthropic's own account, uncorroborated by independent detail.
4 sources
  1. Russia-linked hackers used Claude agents to target Ukraine and steal military drone technology, Anthropic report finds - The Insider
  2. Anthropic caught Russia-linked spies using Claude in hacking operations - The Record from Recorded Future News
  3. Russian SVR Hackers Used Claude AI in Cyber Strikes - Kyiv Post
  4. Countering misuse of AI: September 2026 - Anthropic

View in full brief →

UNCLASSIFIED // OPEN SOURCE