Anthropic's threat report documents hackers, governments, scammers and Chinese AI labs using Claude in different ways, including a suspected Russian state-linked group using it across phishing, intrusion, data theft and malware development and targeting more than 20 organizations.
[1]← Week of Oct 25Oct 25 – Oct 31 UTC Every claim links to the posts behind it01 02 03 04 05 06 8 posts on X 2 weeks
Narrative / Rank 13 / Week of Oct 25 – Oct 31 / 2nd week running (was #19)
Anthropic's own threat report: hackers ran AI agents on Claude, Grok and Kimi against 400+ banks, as Claude text gets watermarked from Nov 3
Peak / day15tracked accounts
Peak dayWedOct 28 · busiest day in the panel
Rest of X / peak day380distinct accounts outside the panel
Cited claims6source links retained
Market—no token attached
Attention
Who was talking, day by day
Tracked paneldistinct tracked accounts / day
Rest of Xdistinct other accounts / day
What happened
Posts this week amplify Anthropic's threat report documenting hackers, governments, scammers and Chinese AI labs using Claude: an RT by @_genk__ claims a suspected Russian state-linked group used Claude across phishing, intrusion, data theft and malware development and targeted more than 20 organizations, and RTs by @blockstargram and @daguyoverthere state that in Latin America one gang ran AI agents built on Claude, Grok and Kimi against 400+ targets including banks and payment firms, while in South Korea hackers used a Chinese AI tool to breach at least 16 financial firms and steal 68,000 people's data. A separate @haruki_web3 RT says Anthropic emailed customers that starting Nov 3 Claude text carries an invisible watermark that survives copy-and-paste and some editing, checkable for now only by regulators, journalists, fact-checkers and researchers. In the same window @icplegend1966 RT'd a claim that the Internet Computer is now integrated with Claude, and @minnus RT'd a Binance hack explainer thread written entirely by Claude with the Blockworks MCP.
Why it matters
The report is the first widely circulated vendor document that names Claude as the engine of real-world AI-agent attacks on banks in Latin America and Korea, tying crypto-adjacent accounts into a mainstream security story; the Nov 3 watermark changes how every Claude-written post, thread or brand reply can be attributed, which affects how crypto content teams can quietly use AI.
Observed reaction
Mostly alarmed and amplifying: the RTs carry 'BREAKING' framing and a Covid-week-1 analogy, while the watermark news is treated with dark humor ('Claude gonna start snitching on Tuesday'). A minority is defensive or promotional, using the same report to position $ICP as the alternative and to pitch AI-inference tokens.
Spread
Where it started and who carried it
- First seen
- Oct 25, 01:02 UTC by @truonggiangle99
- Accounts
- 57 tracked · 42 elsewhere on X
- Communities
- memecoins solana (12), general ct (8), ai crypto (8), nft culture (6)
- Key accounts
- @polymarket, @prof_oak_, @_genk__, @blockstargram, @daguyoverthere
Explainability
Evidence register
In Latin America one gang ran AI agents built on Claude, Grok and Kimi against 400+ targets including banks and payment firms.
[1][2]In South Korea hackers used a Chinese AI tool to breach at least 7 financial firms initially, 16 firms by mid-October, stealing 68,000 people's data, with Daishin Securities reporting 38,490 customers' data leaked this week including bank account numbers.
[1][2]Anthropic emailed customers that starting Nov 3, Claude text carries an invisible watermark that survives copy-and-paste and some editing, is invisible to users, and can currently only be checked by regulators, journalists, fact-checkers and researchers; it indicates Claude touched the words, not who the user is.
[1]The Internet Computer is now integrated with Claude, according to a promotional RT, following an earlier ChatGPT connection.
[1]A Binance hack explainer thread was written entirely by Claude using the Blockworks MCP, per a JasonYanowitz RT.
[1]Angles
- Map the threat report's three buckets (Russian state-linked group, ShinyHunters-linked scammers, Chinese AI labs) against the specific bank targets named in the Latin America and Korea posts, and ask what crypto fintechs should copy from the banks' incident response
- Explain the Nov 3 Claude watermark like an attribution tool: what it does and does not reveal (it says Claude touched the words, it doesn't identify the user), and what that means for brands that publish unedited AI text
- Contrast the two uses of Claude inside crypto this week: an MCP-assisted writeup of the Binance hack versus the same agent stack used against banks, and what teams should log or restrict
In the playbook for Wed, Nov 4 · goes stale fast
Formats in use
- Quote-tweeted breaking-news thread screenshots
- TLDR bullet breakdown of the threat report
- Plain-text alarm post with numbered country list
- Community note-style warning about the watermark
- AI-written explainer thread (Claude + Blockworks MCP)
Risks
- The hack, breach counts (68,000 records, 16 firms, 400+ targets) and nation-state attribution come from a report summarized by RTs; mark as unverified and attribute to the report, not as confirmed facts
- The Nov 3 watermark details come from a secondhand RT of an Anthropic email; verify on Anthropic's own channels before posting
- The 'Internet Computer integrated with Claude' RT is promotional and unpriced; do not restate it as a confirmed partnership
- No price targets or comparisons of AI-token performance should be inferred from the threat report
Observed content
Most-engaged posts
RT @USronaldcarter: 🚨 BREAKING: Hackers are hitting banks in 7 countries at the same time. This is what Covid looked like in week 1. A few countries. Small numbers. Nobody called it a crisis. 1/ South Korea: hackers used a Chinese AI tool to break into at least 7 financial firOpen on X →
RT @USronaldcarter: 🚨 BREAKING: Hackers are hitting banks in 7 countries at the same time. This is what Covid looked like in week 1. A few countries. Small numbers. Nobody called it a crisis. 1/ South Korea: hackers used a Chinese AI tool to break into at least 7 financial firOpen on X →
RT @zhodonx: I just went through Anthropic’s threat report & woah! This is genuinely the craziest article I’ve read all month. They documented hackers, governments, scammers and Chinese AI labs all using Claude in completely different ways. & some of the cases are insane. HeOpen on X →
RT @petesena: Claude gonna start snitching on Tuesday. Anthropic just emailed customers. Starting Nov 3, text carries an invisible watermark. You can't see it. It survives copy and paste, and it can survive some editing. Only regulators, journalists, fact-checkers and researchOpen on X →
RT @0x0SojalSec: You can now Run locally 'Claude Sonnet 5.5 level' model DeepSeek-V4.1-Flash-1017 on your home 64GB+ RAM. https://t.co/ZhcIA1VHdNOpen on X →
RT @UPing123zzz: 我最近越来越强烈地感觉到一件事：天天混 X、GitHub 和 AI 社区的人，对整个社会的 AI 普及程度，可能有非常严重的误判。 我们每天看到的是什么？新模型发布、Agent 自动写代码、一个人运行多个 AI、几十个 Skill 相互协作，甚至已经有人开始讨论怎么用 AI 组织去管理一个完整的业务系统。看这些内容看多了，你会觉得这些东西不是早就普及了吗？现在还有谁不会用 AI？ 但是你真正走进一家传统企业，和老板、员工聊聊，你会发现根本不是这么回事。 有些人对 AI 的全部认知，可能就是打开一个聊天软件，问几个问Open on X →
RT @MTSlive: SITUATION DETECTED: Anthropic is building Claude to autonomously handle open-ended tasks lasting for weeks with the judgment of a brilliant colleague - scaling to millions of Virtual Collaborators running in parallel, what it calls “a country of geniuses in a data ceOpen on X →
RT @RealAllinCrypto: 🚨BREAKING NEWS: The Internet Computer is now officially integrated with Claude, one of the world's BIGGEST AI platforms! And remember, $ICP is ALSO connected to ChatGPT! So now officially two of the world's biggest AI platforms are opening new doors to thOpen on X →
History
Weeks this story made the report
- #13steadyAnthropic's own threat report: hackers ran AI agents on Claude, Grok and Kimi against 400+ banks, as Claude text gets watermarked from Nov 3
- #19steadyClaude gets pulled into defense work: Aave gains access to its Cyber Defense tools while The Information reports attackers used Claude and Grok to hit 400+ Latin American financial targets