{ "version": 1, "event_id": "evt_316a066abcd2e440", "url": "https://xiyu.news/events/evt_316a066abcd2e440/", "json": "https://xiyu.news/api/events/evt_316a066abcd2e440.json", "type": "security_incident", "status": "monitoring", "category": "technology", "title": { "zh": "Anthropic：Claude 被用于自动化网络攻击与大规模监控", "en": "Anthropic says Claude used for cyberattacks and surveillance" }, "current_state": { "zh": "Anthropic 于周四发布威胁情报报告，指出一名代号为“JackPoterz”的俄语操作者利用定制的 Claude 工作流自动化了攻击链的大部分环节，针对 20 多个组织发动攻击，其中包括政府部委、情报机构以及乌克兰和欧洲的大使馆与外交使团。报告还披露，中文操作者将 Claude 用作漏洞研究的工程与编排层，其中一条工作流在一个月内就挖掘出网络设备固件中十几个可能的零日漏洞。\n\n这是厂商亲自确认的前沿 AI 模型在真实世界中被国家相关方滥用的案例，而非假设性的红队测试结果，这将对 AI 实验室的安全管控以及必须假定对手已获 AI 加持的防御方构成压力。Anthropic 认为网络攻击的经济学正在改变：单个操作者即可在两到三小时内完成入侵并并行处理数十个目标，从而降低了以往需要更大团队才能发动攻击的资源门槛。\n\n在另一起案例中，一名很可能位于巴马科、与马里国家情报机构合作的独立顾问，把 Claude 当作主要工程人力，构建了一套覆盖全国三大移动运营商约 2500 万张 SIM 卡的大规模国内监控系统，可在无需法院授权的情况下生成针对特定电话号码的情报档案。该平台实际部署时在本地以本地模型运行，Claude 提供的是软件设计与工程支持，而非承担线上推理任务。", "en": "Anthropic reported that Russian- and Chinese-speaking operators used its Claude model to automate cyberattacks against more than 20 government, diplomatic, and intelligence targets, while a Mali consultant built a mass-surveillance platform with the AI." }, "first_seen_at": "2026-09-11T16:40:56.399403+00:00", "last_updated_at": "2026-09-11T16:40:56.399403+00:00", "last_material_change_at": "2026-09-11T16:40:56.399403+00:00", "confidence": 0.75, "updates_count": 1, "sources_count": 1, "entities": [ "anthropic", "claude" ], "identifiers": [], "topics": [ "ai-safety", "anthropic", "claude", "cybersecurity", "threat-intelligence" ], "updates": [ { "update_id": "upd_be707db4e752f8d0", "event_id": "evt_316a066abcd2e440", "occurred_at": "2026-09-11T09:47:31Z", "published_at": "2026-09-11T09:47:31Z", "first_seen_at": "2026-09-11T16:40:56.399403Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "Anthropic：Claude 被用于自动化网络攻击与大规模监控", "title_en": "Anthropic says Claude used for cyberattacks and surveillance", "what_changed_zh": "Anthropic 于周四发布威胁情报报告，指出一名代号为“JackPoterz”的俄语操作者利用定制的 Claude 工作流自动化了攻击链的大部分环节，针对 20 多个组织发动攻击，其中包括政府部委、情报机构以及乌克兰和欧洲的大使馆与外交使团。报告还披露，中文操作者将 Claude 用作漏洞研究的工程与编排层，其中一条工作流在一个月内就挖掘出网络设备固件中十几个可能的零日漏洞。\n\n这是厂商亲自确认的前沿 AI 模型在真实世界中被国家相关方滥用的案例，而非假设性的红队测试结果，这将对 AI 实验室的安全管控以及必须假定对手已获 AI 加持的防御方构成压力。Anthropic 认为网络攻击的经济学正在改变：单个操作者即可在两到三小时内完成入侵并并行处理数十个目标，从而降低了以往需要更大团队才能发动攻击的资源门槛。\n\n在另一起案例中，一名很可能位于巴马科、与马里国家情报机构合作的独立顾问，把 Claude 当作主要工程人力，构建了一套覆盖全国三大移动运营商约 2500 万张 SIM 卡的大规模国内监控系统，可在无需法院授权的情况下生成针对特定电话号码的情报档案。该平台实际部署时在本地以本地模型运行，Claude 提供的是软件设计与工程支持，而非承担线上推理任务。", "what_changed_en": "Anthropic reported that Russian- and Chinese-speaking operators used its Claude model to automate cyberattacks against more than 20 government, diplomatic, and intelligence targets, while a Mali consultant built a mass-surveillance platform with the AI.", "current_state_zh": "Anthropic 于周四发布威胁情报报告，指出一名代号为“JackPoterz”的俄语操作者利用定制的 Claude 工作流自动化了攻击链的大部分环节，针对 20 多个组织发动攻击，其中包括政府部委、情报机构以及乌克兰和欧洲的大使馆与外交使团。报告还披露，中文操作者将 Claude 用作漏洞研究的工程与编排层，其中一条工作流在一个月内就挖掘出网络设备固件中十几个可能的零日漏洞。\n\n这是厂商亲自确认的前沿 AI 模型在真实世界中被国家相关方滥用的案例，而非假设性的红队测试结果，这将对 AI 实验室的安全管控以及必须假定对手已获 AI 加持的防御方构成压力。Anthropic 认为网络攻击的经济学正在改变：单个操作者即可在两到三小时内完成入侵并并行处理数十个目标，从而降低了以往需要更大团队才能发动攻击的资源门槛。\n\n在另一起案例中，一名很可能位于巴马科、与马里国家情报机构合作的独立顾问，把 Claude 当作主要工程人力，构建了一套覆盖全国三大移动运营商约 2500 万张 SIM 卡的大规模国内监控系统，可在无需法院授权的情况下生成针对特定电话号码的情报档案。该平台实际部署时在本地以本地模型运行，Claude 提供的是软件设计与工程支持，而非承担线上推理任务。", "current_state_en": "Anthropic reported that Russian- and Chinese-speaking operators used its Claude model to automate cyberattacks against more than 20 government, diplomatic, and intelligence targets, while a Mali consultant built a mass-surveillance platform with the AI.", "detailed_summary_zh": "Anthropic reported that Russian- and Chinese-speaking operators used its Claude model to automate cyberattacks against more than 20 government, diplomatic, and intelligence targets, while a Mali consultant built a mass-surveillance platform with the AI.", "detailed_summary_en": "Anthropic reported that Russian- and Chinese-speaking operators used its Claude model to automate cyberattacks against more than 20 government, diplomatic, and intelligence targets, while a Mali consultant built a mass-surveillance platform with the AI.", "background_zh": "零日漏洞是指厂商尚不知晓的软件缺陷，因此在被利用时还没有可用补丁；而网络设备固件指的是防火墙、路由器和 VPN 网关等部署在企业与政府网络边缘的专用设备上所运行的嵌入式软件。用 AI 智能体自动化“攻击链”，意味着由模型把漏洞发现、利用程序构造与横向移动等环节串联起来，其速度与规模远超纯人工操作。由于这类设备部署广泛且很少被审查，其固件中的漏洞对攻击者而言价值极高。", "background_en": "A zero-day vulnerability is a software flaw unknown to the vendor, so no patch exists at the moment of exploitation, and network-appliance firmware refers to the embedded software running on dedicated devices such as firewalls, routers and VPN gateways that sit at the edge of enterprise and government networks. Automating the \"attack chain\" with AI agents means using models to chain together vulnerability discovery, exploit construction and lateral movement at speeds and scales humans alone cannot match. Because these appliances are widely deployed and rarely inspected, findings in their firmware are especially valuable to attackers.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "加密交易所、托管机构和 DeFi 协议与报告所述的企业网络与固件供应链高度重合，而且它们本就是经济动机攻击者眼中价值最高的目标之一，因此并行入侵行动成本的下降会直接转化为这些场所的运营风险渠道。监控案例则牵涉第二条渠道——自托管和链上匿名活动使用者的金融隐私预期——这可能影响市场对隐私类资产的 sentiment 以及中心化平台的合规姿态。", "market_impact_en": "Crypto exchanges, custodians and DeFi protocols sit on the same enterprise networking and firmware supply chain described in the report, and they are already among the highest-value targets for financially motivated attackers, so a fall in the cost of running parallel intrusion campaigns is a direct operational-risk channel for those venues. The surveillance case touches a second channel — expectations of financial privacy for users of self-custody and pseudonymous on-chain activity — which can feed into sentiment around privacy-focused assets and compliance posture at centralized platforms.", "importance_score": 8.0, "references": [ { "url": "https://en.wikipedia.org/wiki/Zero-day_vulnerability", "title": "Zero-day vulnerability" }, { "url": "https://www.afcea.org/signal-media/cyber-edge/automating-cyber-kill-chain-agentic-ai", "title": "Automating the Cyber Kill Chain With Agentic AI | AFCEA International" }, { "url": "https://arxiv.org/html/2503.11917v3", "title": "A Framework for Evaluating Emerging Cyberattack Capabilities of AI" } ], "confidence": 0.75, "story_ids": [ "rss:cointelegraph.com_rss:5a77cf97459963ef" ], "sources": [ { "url": "https://cointelegraph.com/news/claude-ai-cyberattacks-surveillance-weapons-anthropic?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] } ] }