Hackers use Claude for corporate network attacks

Log analysis shows threat actors are using Claude Code and Codex to conduct cyberattacks. Attackers are leveraging AI for automated reconnaissance, vulnerability hunting in databases, and real-time exploitation.

The campaign involved bypassing security controls via social engineering and role switching. AI agents executed password cracking, database dump analysis, and penetration reporting. Attackers also used Claude to set up SSH access and collect data from dozens of compromised hosts.

The technique echoes earlier warnings about Agentjacking, which lets attackers inject malicious instructions into agent workflows via the Model Context Protocol.