Ledger / Jan 2025
Low-skill actor sold Claude-built ransomware for $400-$1200
Confirmed
Anthropic states the actor could not build the malware without Claude.
The actor used Claude to develop ransomware with encryption, evasion and anti-recovery features and sold variants on forums.
“This actor appears to have been dependent on AI to develop functional malware.”Anthropic
Sources
- Detecting and countering misuse of AI: August 2025Anthropic · 27 Aug 2025 · primary source
- Date
- Jan 2025
- Disclosed
- 27 Aug 2025
- Actor
- Unnamed cybercriminal (tracked by Anthropic in its full report as GTG-5004) (criminal), as attributed by Anthropic
- Targets
- Buyers on cybercrime forums
- What the AI did
- Malware dev, Evasion
- Model
- Claude
- Model family
- Anthropic
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Account banned; ransomware sold on forums from January 2025.