Anthropic said attackers' AI agents collected 2,100 staff logins in 34 hours.
On 10 September 2026, The Register covered Anthropic's own threat intelligence report, which covers December 2025 to August 2026.
One case involved more than 2,100 sets of Azure AD tokens taken across more than 40 corporate tenants in 34 hours.
Anthropic wrote of the group it tracks as GTG-20006: "We observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration." It added: "AI agents performed nearly all of the work."
The group targeted more than 20 organisations. Targets included embassies and think tanks, as well as defence firms across Ukraine, Europe, the Middle East, Asia and North Africa.
Anthropic said its own controls did not hold every time: "Our safeguards blocked many of their requests, but not all of them." It banned the accounts involved and shared what it found with public and private partners.
The number worth writing down is 34 hours. That is faster than most access reviews run. The attackers targeted tokens rather than passwords.
When did you last check which of your tokens are still valid, and who is holding them?
Sources
Our file on Anthropic
- 21 Sept
Anthropic let Accenture safety-test its AI from inside. Both expect to invest $1 billion.
- 20 Sept
OpenAI's agent platform was installed at 75 firms. 69% made it their main one.
- 20 Sept
Anthropic's AI led none of its own research in February. Now it leads 26%.
- 19 Sept
Anthropic's Claude helped researchers reach OpenAI staff accounts in three days.
- 19 Sept
Anthropic ordered $44.6 billion of computing from a company earning $140 million.
For your next steering committee
- 1Ask which AI tools already touch your ERP or finance data, including the ones nobody approved.
- 2Ask what each tool is allowed to change, and who reviews what it changed.
- 3Ask how the result is measured, and who decides to switch a tool off.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01