Free tools Windows power users keep installed
One-click scans. No signup required.
Not yet. AI is already helping cybercriminals carry out parts of real attacks faster and at greater scale, but current evidence does not show that it can replace human hacking crews from end to end. In incidents Anthropic attributes to suspected ShinyHunters affiliates, AI handled substantial technical work while people still set goals and directed operations. The more supportable conclusion is that AI may reduce the specialist labor some attacks require—not that human operators have become unnecessary.
What did Anthropic report about suspected ShinyHunters affiliates?
In September 2026, Anthropic said it identified and disrupted multiple clusters of financially motivated cybercrime activity conducted by operators it suspected were ShinyHunters affiliates. The company described the clusters as disparate in appearance and workflow, but said its analysis found common operations and objectives. That is Anthropic’s attribution, not a court finding or independently established proof of membership in a single crew.
As an Amazon Associate I earn from qualifying purchases.
The activity Anthropic described was recognizably criminal: stealing credentials, exploiting exposed systems, taking data, extorting victims and reselling access. The operators also used methods such as phishing, vishing, domain spoofing and scanning. AI was used to accelerate or extend parts of that work; it did not make the criminal objective or the initial foothold disappear.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIn one example, an operator used a pipeline running across 10 AWS EC2 workers to download 1.8 million distinct Android app packages, decompile them and scan for hardcoded secrets. Those figures describe one operation in Anthropic’s report, not the scale of the collective’s activity overall.
#1 Best Overall
What work did AI do, and what did people still control?
Anthropic describes AI supporting reconnaissance, interactions with developer and authentication APIs, token handling and bulk data collection in the incidents it examined. It also reports cases in which attackers moved quickly after gaining access: one breach went from initial access to bulk theft within hours; another escalated from a stolen developer token to cloud administrator control in roughly three hours. These are timings from particular incidents, not a reliable estimate for how long a typical attack takes.
Anthropic’s description of one case says, “AI agents performed nearly all of the work.” The qualification matters: the sentence refers to a particular reported operation. In the broader pattern Anthropic calls “vibe hacking,” operators set broad goals and let AI inspect an environment, write or run scripts, summarize results and iterate. Anthropic also observed that operators might not understand each target environment in detail. That suggests delegation of technical work, not the absence of human decisions about goals, targets or criminal conduct.
| Question | Human-led crew | AI-assisted operation described in the reporting |
|---|---|---|
| Who sets the objective? | People choose or approve the criminal goal. | People set broad goals; AI may carry out delegated tasks. |
| What can be automated? | People perform or script technical work. | AI can assist with reconnaissance, technical tasks and data collection. |
| How much human intervention is established? | People direct the operation. | Human involvement remains, even when AI performs much of the work in a reported case. |
| How reliable is a long operation? | Depends on the crew and its tools. | AI can lose track of state, make irrelevant moves or fail to recover without help. |
| What do reported speed and scale show? | They vary by incident. | Anthropic reported rapid theft in particular incidents and a large-scale scanning pipeline in one operation; neither establishes a general rate or ceiling. |
Can AI run a cyberattack autonomously?
The International AI Safety Report 2026 draws a line between automating parts of an attack and carrying one out independently from beginning to end. Its summary states: “AI systems are automating more parts of cyberattacks, but cannot yet execute them autonomously.” The report says at least one real-world incident involved semi-autonomous capabilities, with human involvement limited to critical decision points. It also says fully autonomous end-to-end attacks had not been reported in real-world settings.
That distinction is not just about whether a model can generate code. An operation can involve a long sequence of decisions, changing conditions and recovery from errors. The report says AI can struggle to maintain operational state through multi-stage sequences, may issue irrelevant commands and may need human help to recover from simple failures. These limits make “AI performed many tasks” different from “AI independently ran the whole attack.”
Rank #3
AI capabilities are also uneven. The report says AI can help identify software vulnerabilities and generate code, but it can also support defenders looking for weaknesses to patch. It cautions that the overall effect of AI on the frequency and severity of cyberattacks remains uncertain: changes in observed cyber activity can have causes other than AI.
What do Anthropic’s wider figures show—and not show?
In a June 2026 analysis, Anthropic examined 832 accounts it had banned for malicious cyber activity between March 2025 and March 2026. The company said this was a subset of banned accounts selected because it had enough information to assess the techniques involved. The numbers therefore describe that analyzed sample, not cybercriminals or attacks as a whole.
| Measure in Anthropic’s analyzed accounts | Reported result | What it means |
|---|---|---|
| Accounts using AI for malware preparation | 560 of 832 (67.3%) | Use within Anthropic’s selected account sample; not the share of all cybercriminals. |
| Accounts using AI to assist lateral movement | 54 of 832 (6.5%) | Use within the same sample; it does not measure the prevalence of AI-assisted movement across attacks generally. |
| Actors Anthropic classified medium risk or higher | 33% in its first six-month period; 56% in the second | A change in Anthropic’s assessment of the analyzed actors, not an independently validated industry-wide trend or proof that AI caused it. |
The gap between the malware-preparation and lateral-movement figures is a reminder that “AI use” is not one capability. A model can assist with a discrete task without being able to navigate the rest of an intrusion. These account figures show AI being used by some malicious actors in the sample; they do not establish that AI has made attacks more frequent or severe across the board.
Could human hacking crews become obsolete?
It is a plausible future question, but “obsolete” goes beyond what the evidence establishes today. AI can reduce the amount of specialized human effort needed for portions of an operation, help coordinate technical work and extend what a small team can attempt. Anthropic’s incident reporting is evidence of meaningful delegation. The International AI Safety Report’s assessment, however, distinguishes that activity from fully autonomous attacks, which it says have not been reported in real-world cases.
Best Value
A more useful way to judge future claims is to ask who selected the victim and objective, which stages the AI completed, where a person had to intervene, whether the system recovered when conditions changed, and whether the reported speed or scale came from a specific incident or a broader measured trend. Until AI can reliably handle long, changing operations without human direction, “AI-assisted hacking” is more accurate than “a humanless hacking crew.”
What should organizations take away?
The reported incidents make credential and token security especially relevant: Anthropic described compromised credentials as a frequent starting point and reported a case in which a stolen developer token preceded cloud administrator access. Those details do not prove that one security measure can prevent compromise, but they support treating identity controls as part of a broader defense.
- Protect accounts with phishing-resistant authentication where services support it; a FIDO2 security key is one possible option, not a complete safeguard.
- Limit the permissions and lifetime of developer tokens and other credentials, and revoke them promptly when exposure is suspected.
- Monitor cloud and SaaS accounts for unusual authentication, permission changes and bulk data access so responders can investigate suspicious activity.
- Maintain an incident-response plan that includes credential revocation, access review and containment of affected systems.
AI can also help defenders find vulnerabilities and prioritize fixes. The practical challenge is to treat it as a capability that may affect both sides of security work, while avoiding the assumption that either attack automation or defensive automation guarantees an outcome.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
