Anthropic said attackers' AI agents collected 2,100 staff logins in 34 hours.
On 10 September 2026, The Register covered Anthropic's own threat intelligence report, which covers December 2025 to August 2026.
One case involved more than 2,100 sets of Azure AD tokens taken across more than 40 corporate tenants in 34 hours.
Anthropic wrote of the group it tracks as GTG-20006: "We observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration." It added: "AI agents performed nearly all of the work."
The group targeted more than 20 organisations. Targets included embassies and think tanks, as well as defence firms across Ukraine, Europe, the Middle East, Asia and North Africa.
Anthropic said its own controls did not hold every time: "Our safeguards blocked many of their requests, but not all of them." It banned the accounts involved and shared what it found with public and private partners.
The number worth writing down is 34 hours. That is faster than most access reviews run. The attackers targeted tokens rather than passwords.
When did you last check which of your tokens are still valid, and who is holding them?
Sources
Our file on Anthropic
- 5 Nov
Revolut says self-hosted AI models cut its AI coding costs by roughly 90%. It dropped Anthropic's Claude Code as its default.
- 4 Nov
Half of Slack messages are no longer from people, Salesforce says. It counts a billion messages a day.
- 3 Nov
Claude maker Anthropic disclosed about $895 billion of computing deals in its IPO filing. That is 27 times its nine-month revenue.
- 3 Nov
Oracle NetSuite user Brennan Industries says AI builds up to five ERP apps a day. ERP architects maintain that code.
- 31 Oct
Anthropic's backer Blackstone now expects a junk credit rating for the Claude maker, the FT reported. Blackstone had predicted investment grade.
For your next steering committee
- 1Ask which AI tools already touch your ERP or finance data, including the ones nobody approved.
- 2Ask what each tool is allowed to change, and who reviews what it changed.
- 3Ask how the result is measured, and who decides to switch a tool off.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01
