Breaches and incidentsBriefChecked against a primary source
Anthropic threat intelligence report
Covers Dec 2025 to Aug 2026.
- Disclosed
What happened (also listed in 4)
- GTG-50014 (ShinyHunters affiliates): one stolen developer token reached full cloud admin in about 3 hours. One session-store dump yielded 2,100+ Azure AD token sets.
- Another actor decompiled 1.8M APKs with TruffleHog to find hardcoded secrets.
- GTG-50020 used prompt injection against an AI vendor’s evaluation sandbox to get production keys, then hit about 30 AI companies in 4 days.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.