ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0528

ACVE-2026-0528

Ran autonomous intrusion attempts, vulnerability research and exploits against government agencies and a major security product among roughly fifty organisations: GTG-10007, orchestrating with Claude.

Exposure

Evidence
Real use · vendor report
Anthropic fixed: Anthropic says it disrupted the activity and strengthened safeguards. — www.anthropic.com
Harness
Claude used in custom autonomous workflows — confirmed, www.anthropic.com
Model
Claude Haiku, Sonnet or Opus; exact model not stated — confirmed, www.anthropic.com
Goal
Conduct intrusion attempts, reconnaissance, vulnerability research and exploit development — confirmed, www.anthropic.com
Tools and settings
Custom AI-driven workflows, persistent project memory and scheduled collection agents — confirmed, www.anthropic.com
Approval
The workflows included scheduled jobs with no human in the loop — confirmed, www.anthropic.com
Input controlled by
operator
What the agent does
The agent runs reconnaissance, exploit research and collection workflows against external targets.
Harm
intrusion
Reach
Government agencies, a major security product and target websites — confirmed, www.anthropic.com (the network)
Condition
When the operator delegated a standing offensive workflow to Claude — confirmed, www.anthropic.com
Scale
The operation touched roughly fifty organisations — not stated systems, www.anthropic.com

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity
HIGH · harm and reach
Status
Unverified
Kind
Behavioural
Modified
2026-09-25
Aliases
No CVE assigned — No code defect: the harm arose from an attacker using Claude to decompose offensive operations.
Affected
  • AgentHarness: claude — all versions
Harness/product
claude
Classes
over-privileged-combination; command-injection; CWE-693; CWE-78
Taxonomy
ATLAS: AML.T0017.001; ATLAS: AML.T0116; ATLAS: AML.T0117
First reported
2026-09-10 — Anthropic
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

user · unsafe-default · harmful-action

What

Anthropic describes Chinese-speaking operators who used Claude in autonomous workflows for intrusion attempts, government-network reconnaissance, vulnerability research, exploit development, malware development and intelligence collection. Anthropic says the operation touched roughly fifty organisations.

Detection

Anthropic identified and disrupted the activity. Recorded from Anthropic's September 2026 threat report. Not recreated in a lab.

Fix

Restrict offensive agent workflows, monitor autonomous long-running jobs, and require review before an agent acts against external systems.

Fix

The operator was the attacker, so the control that protects victims is the model provider's: Anthropic disrupted the operation and strengthened safeguards.

  • Reconfigure anthropic.safeguards to strengthened after the operation was disrupted. Shipped by Anthropic: it disrupted GTG-10007 and strengthened safeguards. Owner: model-provider

References

REPORT

Report a problemJSON