ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0525

ACVE-2026-0525

Breached at least four European websites, exfiltrated about 140,000 political-opinion records and targeted credentials and reader sessions: GTG-50029 hacktivists with Claude in an agent framework.

Exposure

Evidence
Real use · vendor report
Anthropic fixed: Anthropic says it disrupted the activity and strengthened safeguards. — www.anthropic.com
Harness
An agent framework using Claude and sub-agents — confirmed, www.anthropic.com
Model
Claude — confirmed, www.anthropic.com
Goal
Target European political, media and affiliated entities — confirmed, www.anthropic.com
Tools and settings
Agent framework with sub-agents for reconnaissance, code review and findings triage — confirmed, www.anthropic.com
Approval
The operator delegated multi-stage campaign work to sub-agents — confirmed, www.anthropic.com
Input controlled by
operator
What the agent does
The agent framework conducts reconnaissance and intrusions and processes data from multiple victims.
Harm
data-exfiltration
Reach
Victim websites, political records and user credentials — confirmed, www.anthropic.com (private repositories, the network, messaging systems)
Condition
When the operator supplied stolen API access to an agent framework that managed sub-agents — confirmed, www.anthropic.com
Scale
About 140,000 records were exfiltrated from one political campaign platform — 140000 records, www.anthropic.com

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity
HIGH · harm and reach
Status
Unverified
Kind
Behavioural
Modified
2026-09-25
Aliases
No CVE assigned — No code defect: the harm arises from the attacker using an agent framework to pursue the campaign.
Affected
  • AgentHarness: claude — all versions
Harness/product
claude
Classes
credential-theft; data-exfiltration; over-privileged-combination; CWE-522; CWE-359; CWE-693
Taxonomy
ATLAS: AML.T0124; ATLAS: AML.T0116; ATLAS: AML.T0049
First reported
2026-09-10 — Anthropic
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

user · unsafe-default · exfiltration

What

Anthropic says a French-speaking actor used Claude and sub-agents to target European political parties, media, think tanks and their service providers. The campaign compromised at least four websites, including a political campaign platform from which about 140,000 records containing political opinions were exfiltrated.

Detection

Anthropic identified and disrupted the campaign. Recorded from Anthropic's September 2026 threat report. Not recreated in a lab.

Fix

Treat agent frameworks and exposed API keys as privileged infrastructure, limit access to political and identity data, and monitor automated multi-site activity.

Fix

The operator was the attacker, so the control that protects victims is the model provider's: Anthropic disrupted the campaign and strengthened safeguards.

  • Reconfigure anthropic.safeguards to strengthened after the campaign was disrupted. Shipped by Anthropic: it disrupted GTG-50029 and strengthened safeguards. Owner: model-provider

References

REPORT

Report a problemJSON