{
  "actor": "Single French-speaking hacktivist (tracked by Anthropic as GTG-50029)",
  "actor_type": "single-operator",
  "added": {
    "by": "MLSecOpsHub",
    "date": "2026-10-10"
  },
  "ai_role": "significant",
  "autonomy_level": "human-in-the-loop",
  "autonomy_pct": null,
  "category": "ai-orchestrated-campaign",
  "confidence": "primary",
  "date_disclosed": "2026-09-10",
  "guardrail_bypass": [
    "legitimate-tool-abuse"
  ],
  "id": "gtg-50029-hacktivist-agentic-recon",
  "impact": "Per Anthropic: internal access to at least 14 of 42 tracked entities; about 140,000 records including users' political opinions taken from a political campaign management platform; party donor and member records, student application records including minors, and payment-provider data exposed; an estimated 12 to 26 GB of database dumps and a 15,000-message mailbox taken; a doxxing platform holding tens of millions of rows built by one person.",
  "last_updated": "2026-10-10",
  "lifecycle_phases": [
    "recon",
    "resource-dev",
    "initial-access",
    "exfiltration",
    "impact"
  ],
  "mappings": {
    "aiid": [],
    "cve": [],
    "mitre_atlas": [],
    "mitre_attack": [],
    "owasp_asi": [],
    "owasp_llm": []
  },
  "mitigations": [
    "Anthropic states it investigated and disrupted the campaign and published indicators in the report's IOC tables."
  ],
  "model_families": [
    "claude"
  ],
  "models": [],
  "name": "GTG-50029 single hacktivist's Claude-built mass privacy attack on European political targets",
  "related": [
    "gtg-2002-vibe-hacking-extortion",
    "gtg-20006-agentic-espionage",
    "gtg-50014-agentic-mass-exfiltration",
    "gtg-10007-agent-swarm-intrusions",
    "gtg-50020-ai-vendor-api-key-theft"
  ],
  "severity": "high",
  "sources": [
    {
      "archive_url": "https://web.archive.org/web/20261009173227/https://www.anthropic.com/threat-intelligence-report-september-2026",
      "date": "2026-09-10",
      "publisher": "Anthropic",
      "title": "Countering misuse of AI: September 2026",
      "type": "first-party-disclosure",
      "url": "https://www.anthropic.com/threat-intelligence-report-september-2026"
    }
  ],
  "status": "confirmed",
  "summary": "In its September 2026 report \"Countering misuse of AI\", Anthropic disclosed a hacktivist campaign it tracks as GTG-50029, observed in the spring of 2026 and run by \"a single French-speaking actor\" who used Claude to target European political parties, media outlets, think tanks and the SaaS providers those organizations rely on. Across 42 tracked target entities the actor gained internal access to at least 14. Affected data included party donor and member records, student application records including minors, payment-provider data, approximately 140,000 records from a political campaign management platform including users' political opinions, an estimated 12 to 26 GB of database dumps and a 15,000-message mailbox. The actor also built a purpose-built doxxing platform loaded with tens of millions of rows, which Anthropic states was created by one person. Anthropic frames the case as AI-assisted software engineering applied directly to a mass attack on privacy, and states it investigated and disrupted the campaign.",
  "targets": {
    "countries": [],
    "orgs_affected": 14,
    "records_exfiltrated": 140000,
    "sectors": [
      "political-parties",
      "media",
      "technology"
    ]
  }
}