Claude's Compromise Raises Agentic AI Concerns As DOGE's Data Copied To Cloud

Every headline these days seems to carry the same undertone: our digital world is much more fragile than we think.

From insider risks shaking trust within organizations to whistleblowers raising alarms about government databases, the message is clear. Protecting sensitive information is no longer an IT issue, it’s a matter of public trust and personal data security.

What follows are recent stories that highlight just how urgent this challenge is, especially with the increasing frequency and scale of cyber incidents. Read on!

Anthropic, the company behind the AI assistant Claude, revealed in its latest threat intelligence report that cybercriminals are now using its agentic AI coding assistant to actively carry out cyber-attacks, going beyond cases where AI merely supported criminals with phishing or coding.

The most troubling example was a campaign by a group known as GTG-2002. Anthropic says the group relied on Claude Code to execute a sweeping data theft and extortion scheme that targeted at least 17 organizations worldwide.

Instead of using the tool for basic coding support, the attackers actually fed it their own playbook of tactics and then let it handle the campaign. Claude Code wasn’t just scanning networks or writing scripts but actively helping decide which companies to target, how to steal their data, how to pressure victims with ransom demands, and even how to build malware that could evade security systems.

"It created obfuscated versions of the Chisel tunneling tool to evade Windows Defender detection and developed completely new TCP proxy code that doesn't use Chisel libraries at all," Anthropic noted, adding that the AI also assisted with ransom notes, sometimes setting demands upwards of $500,000.

What makes this case a turning point, Anthropic said, is that AI wasn’t just a tool on the sidelines but a direct operator in the attack, guiding privilege escalation, lateral movement, data exfiltration, and ransom strategy in real time. The company banned the accounts involved and is developing classifiers to prevent similar misuse.


Anthropic calls this shift “vibe hacking,” where AI evolves from an assistant into an active cybercriminal partner, highlighting how fast the threat landscape is changing.

While this raises fresh concerns about data security, another story this week highlights the growing risks within organizations themselves.

A new report from Exabeam reveals that insider risks have now overtaken external attacks as the top security concern for organizations, and AI, once again, is the key driving factor.

Almost two out of three security professionals now believe the real danger isn’t coming from hackers on the outside, but from insiders. “Insiders aren’t just people anymore,” said Steve Wilson, Exabeam’s Chief AI and Product Officer. “They’re AI agents logging in with valid credentials, spoofing trusted voices, and making moves at machine speed.”

More than half of the organizations surveyed said they’ve seen a rise in insider incidents over the past year, with AI-driven phishing and social engineering being among the most common tactics. On top of that, three out of four companies admitted employees are using generative AI tools without approval, creating yet another layer of risk.

Despite most companies having insider threat programs, less than half use advanced analytics to detect unusual behavior. “AI has added a layer of speed and subtlety to insider activity that traditional defenses weren’t built to detect,” warned Kevin Kirkwood, Exabeam’s CISO. The report concludes that organizations must evolve their insider threat strategies to keep pace with the growing role of AI.

It's not just the private sector grappling with AI-driven risks. Federal agencies are now facing explosive allegations over how they’re handling sensitive data.

A whistleblower inside the Social Security Administration (SSA) says Elon Musk’s Department of Government Efficiency (DOGE) copied the entire Social Security database onto a cloud system with almost no security controls, putting the personal details of more than 300 million Americans at risk.

The complaint, filed by SSA Chief Data Officer Charles Borges through the Government Accountability Project, states that DOGE officials bypassed safeguards and created a “live copy” of the NUMIDENT database, which contains names, birthdates, citizenship, parents’ Social Security numbers, addresses, and other personal information.


“This vulnerable cloud environment is effectively a live copy of the entire country's Social Security information from the Numerical Identification System (NUMIDENT) database, that apparently lacks any security oversight from SSA or tracking to determine who is accessing or has accessed the copy of this data," the letter warned.

An internal July email from DOGE-embedded SSA CIO Aram Moghaddassi shows him approving the project, stating, “I have determined the business need is higher than the security risk associated with this implementation and I accept all risks associated with this implementation and operation.”

Borges and watchdog groups are calling on Congress to step in, warning that the data leak could open the door to widespread identity theft and even push the government into the costly task of reissuing Social Security numbers for every affected American.

Do you think technology is actively increasing the attack vectors rather than shielding us from risks?

Let us know your thoughts in the comments section below!