Vibe Hacking Explained: What Anthropic's 2025 and September 2026 Reports Actually Say
Vibe hacking explained in one sentence: an operator hands an AI agent a goal instead of a script - use this credential, pull data from that set of targets - and lets the agent write and run its own code, summarise what it finds, and repeat until the job is done. It is Anthropic's term, it appears exactly once in the September 2026 threat report [1], and that single appearance is why so many explainers get the story wrong: the 17-organization extortion campaign quoted in nearly every "vibe hacking" article is from Anthropic's August 2025 report, not September 2026.
For a business running AI agents, that date is the difference between a live technique and a year-old precedent.
What is vibe hacking? Anthropic's own definition
Anthropic defines it inside its GTG-50014 case study:
"The use of AI during intrusions and data theft operations often resembles “vibe hacking,” wherein operators direct AI to achieve general goals ... then allow the AI to evaluate the environment, author and execute scripts, provide summaries, and repeatedly execute until the task is complete." [1]
The report adds that the operator "may not directly understand each target environment" - they name a goal and defer the specifics to the AI. Three things matter there: the operator supplies intent while the agent supplies tradecraft; the loop repeats by design, which separates an AI that answers a question about hacking from an agent that keeps working a target; and the phrase is a description, not a case name.
Vibe hacking is not vibe coding, which means building your own software by describing the outcome you want. Two terms recur in the report: GTG is Anthropic's label for a Generative Threat Group it has watched abusing AI, and uplift is its measure of how much more harm happened with AI than without it.
"Uplift": what Anthropic actually measures
"The report also attempts to measure uplift, a term we use to describe the AI capability boost, or how much more harm was caused with AI versus without AI." [1]
That measures replaced labour rather than new magic: the report views uplift "through the lens of speed, scale, and depth" [1], meaning the same intrusion attempted faster, against more targets, with less specialist knowledge per target.
Why "sophistication" stopped being a signal
"The main distinguishing feature between these classes of actors is no longer sophistication but intent." [1]
The report says AI "has leveled the playing field" between criminals and states, and draws the conclusion: "sophistication has stopped being a reliable signal of who is behind an operation." [1] The techniques themselves are ordinary - "None of the operations in this report depended on some entirely novel technique that defenders have never seen" [1] - and coverage put it plainly: "even lone individuals can create threats that would not have been possible even a year ago." [9]
2025 vs September 2026: what changed
This is the part almost nobody has published, and it decides whether a headline applies to you.
The August 2025 report (case GTG-2002). Anthropic described a data-extortion operation "potentially affecting at least 17 distinct organizations in just the last month across government, healthcare, emergency services, and religious institutions," with direct ransom demands "occasionally exceeding $500,000" and a pattern "where AI serves as both a technical consultant and active operator." [3] The Verge's headline of 27 August 2025 - "'Vibe-hacking' is now a top AI threat" - is where the term entered general circulation [4].
The September 2026 report. "Detecting and countering misuse of AI: September 2026" runs 154 pages, covers activity Anthropic says it disrupted between December 2025 and August 2026 across seven harm areas, and involved Claude Haiku, Sonnet and Opus, with no Fable- or Mythos-class model except in one distillation case. [1][2]
The checkable difference. Searching both documents settles it mechanically: in the September 2026 page and PDF, "17 distinct", "$500,000", "technical consultant" and "consistent patterns" each occur zero times, and "vibe hacking" occurs once - as the description above. Every one of those figures is August 2025 material [1][2][3], and a risk register is only as good as its dates.
The four September 2026 cases an owner should actually know
GTG-20006 - malware that rebuilds itself when your scanner flags it
Anthropic attributes this actor consistently with public reporting linking it to Midnight Blizzard. When a security product flagged its deployed malware, its monitoring agents acted:
"If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections. The agents were designed to continue iterating on GTG-20006's toolkit until it was undetected." [1]
The sentence to carry into any security conversation: "AI has inverted the cost back onto defenders," because capable adversaries "can 'close the loop,' bypassing traditional security detections faster than defenders can develop and deploy them." [1] The actor targeted more than 20 distinct organizations and reached some indirectly, compromising "at least three hospitality vendors that operate hotel guest WiFi" and taking "more than 300,000 national identity records, and the commercial registry data of more than half a million companies" from a North African government technology authority [1]. Hotel WiFi is the reminder that your supplier list is part of your attack surface.
GTG-50014 - one stolen AI API key, roughly three weeks of follow-on attacks
This cluster, whose operators are suspected to be affiliates of the ShinyHunters collective, is where the vibe-hacking definition lives, and it turns AI keys from a billing concern into a security one:
"One of the stolen API keys was then used by the attacker for roughly three weeks to conduct secondary attacks, which targeted other organizations including compromising a French retail chain and probing a Web3 identity platform." [1]
The numbers show what a few operators got done: "1.8 million distinct Android APKs" mass-downloaded and scanned for hardcoded secrets [1]; a SaaS breach that reached "roughly 200 of the SaaS company's downstream customer organizations" [1]; and an escalation "from a single stolen developer token to full administrative control of a victim's cloud environment in roughly three hours." [1] If your team rates an API key below a password, this is the case that contradicts it - the named-incident update to our LLMjacking explainer on how stolen AI keys get reused.
GTG-50020 - your AI vendor's evaluation sandbox is on your attack surface
"By injecting malicious instructions into an AI vendor's automated evaluation sandbox," the actor caused the sandbox to hand over "the production AI API keys from multiple providers belonging to that vendor," and the same infrastructure then "attacked roughly thirty AI companies in about four days," repeating one working attack path across all thirty in pursuit of a pre-release model [1]. Two accuracy points, because this case is the most overstated: "The actor never gained access; every attempted path failed," and the keys were "customers' keys stolen from customers' environments." [1] A sandbox holding production keys is a production system.
GTG-50029 - one person, 42 tracked targets
One French-speaking actor used Claude against European political parties, media and think tanks, gaining "internal access to at least 14" of "42 tracked target entities" [1] through an undocumented WordPress re-installation race condition that created a rogue admin account without valid credentials, and exfiltrated "approximately 140,000 records that included users' political opinions." [1] Anthropic's verdict: "one of the clearest cases we have seen of AI-assisted software engineering applied directly to a mass attack on privacy - and the entire platform was created by just one person." [1] The ingredients are not political: mainstream web software, one unpatched path, one person.
Machine speed: the second, independent 2026 datapoint
Anthropic measures autonomy; Palo Alto Networks' Unit 42 measured speed, in an intrusion published 2 September 2026 [5]. A human operator drove frontier models to compress "weeks of methodical intrusion tradecraft (using more than 50 MITRE ATT&CK techniques) into less than 10 hours" - an outcome "at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks" - with no novel zero-day, and left the victim "an 80-page, technical audit detailing dozens of exploited findings." [5] Unit 42 later clarified "that the attack was an intrusion, and not a ransomware attack." [5]
The defence guidance on that page is the part to copy: hunt for "bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and sudden model usage from unexpected identities" [5] - behavioural signals a rewritten tool cannot erase. Our AI cyberattack preparedness checklist covers that layer.
What this means for your audit - the AI agent security checklist
The news cycle covered who was attacked. These are the four questions the report hands you.
- AI API-key custody. Who holds your AI keys, where do they live, what is the rotation interval, and would you see one being used somewhere else for three weeks? The guidance is blunt: "Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials," and "AI access should be purchased only through authorized channels" [1] - which rules out discounted reseller access, the pattern behind its fraudulent Claude reseller case [1].
- Agent reach. Scope agent access the way you scope database access: egress allowlists, sandbox separated from production, and a written answer to which integrations can touch production keys. GTG-50020 is the test case.
- Detection that survives rewriting. Signature and static detection now feed the adversary's loop, because GTG-20006's agents watched for detection and rebuilt until it stopped firing [1]. Behavioural detection stays expensive for them: bursty API calls, sharp 401/200 shifts, parallel authentications from unexpected identities [5].
- Agent identity and blast radius. Long-lived tokens, MFA on admin paths, monitoring on outbound writes. Rehearse the three-hour stolen-token-to-cloud-admin path [1], not the generic phishing email.
Our AI agent risk checklist walks the same four areas item by item, and the free AI audit tool below scores them for a small business in about ten minutes.
Run the four checks on your own stack: Free AI Audit Tool →
The bottom line for a small business: vibe hacking did not invent new attacker skills - it removed the skill barrier, so the AI agent security work worth funding is key custody, agent reach, detection that survives rewriting, and a rehearsed revocation path.
Working with an agency that deploys or hosts agents for you? The same vibe hacking risk becomes a contract question - key custody, rotation alerts, disclosure windows - covered in our companion guide on AI agency security vetting.
Questions people actually ask
Label key: [AC] = the question as phrased is a Google Autocomplete suggestion (probed directly, 2026-09-10); [GAP] = unanswered by every ranking page and unsupported by Autocomplete. These are not Google People-Also-Ask sets, and no AI Overview data is claimed - neither is observable from our tooling.
What is vibe coding and vibe hacking?
[AC] Vibe coding is building software by describing the outcome and letting an AI write the code. Vibe hacking is that working style aimed at systems you do not own: Anthropic's report defines it as directing AI to achieve general goals, then letting it "evaluate the environment, author and execute scripts, provide summaries, and repeatedly execute until the task is complete." [1]
Are AI agents a security risk?
[AC] An agent carries the risk of the access behind it, not a new kind of risk by itself. The September 2026 report's agent-driven cases reached "over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours," and one intrusion "escalated from a single stolen developer token to full administrative control of a victim's cloud environment in roughly three hours." [1] Long-lived credentials and outbound write access are the two conditions worth removing first.
How do I audit AI agents in my business?
[AC] Start with the four items above: key custody and rotation alerting, what the agent can reach, detection that survives a rewritten tool, and agent identity plus blast radius. Anthropic's own guidance is the baseline - AI keys and agent integrations "should be treated with the same level of seriousness as production credentials" [1] - and the practical version is a review you can repeat quarterly, not a one-off project. Our AI agent risk checklist walks those four areas item by item.
What is LLMjacking?
[GAP] LLMjacking is the industry label for attackers using stolen AI credentials to run inference on someone else's bill and someone else's account. It is not Anthropic's term and the report does not use it, but GTG-50014 is the clearest named incident of the pattern: one stolen AI API key reused "for roughly three weeks to conduct secondary attacks." [1] Treat any paid AI credential as a production credential from the day it is issued, whatever its label.
Which of these groups hit ordinary businesses rather than governments only?
[GAP] The financially motivated ones. Between them, the September 2026 cases show a SaaS provider's roughly 200 downstream customer organizations, roughly 30 AI companies attacked in about four days, and a WordPress flaw that reached 14 of 42 tracked targets - small-to-mid-market exposure rather than state-targeting lists [1]. The state-linked cases in the same report sit in another category entirely: surveillance and repression operations, including one where "the actor was able to re-prompt the model to produce functional suppression guidance naming 10 private citizens to target for “control.”" [1] Business owners meet those as citizens, not as targets - but the report's admission that "our existing safeguards did not perform uniformly in these cases" is worth knowing before you rely on a model's refusal as a control [1].
Our scanner already flagged their malware once - why did it come back?
[GAP] Because in GTG-20006 the detection signal is the trigger. Monitoring agents watched for security products flagging the actor's deployed malware, then "set about the process of autonomously modifying and rebuilding the malware to evade the existing detections," iterating "until it was undetected." [1] The same sample returning in a new form is the expected behaviour, not a false positive - which is why the detection layer worth funding is behavioural [5].
What did the August 2025 case have to do with the September 2026 report?
[GAP] Only the news cycle. The 17-organization extortion campaign, the $500,000-plus ransom demands and the "technical consultant and active operator" line belong to Anthropic's August 2025 report (case GTG-2002) [3], and The Verge's "'Vibe-hacking' is now a top AI threat" headline is dated 27 August 2025 [4]. The September 2026 report uses the phrase once, as a description inside its GTG-50014 case [1]. If you are dating a risk register entry, that difference is the whole ballgame.
Sources
- Anthropic, "Detecting and countering misuse of AI: September 2026" (report page, published 10 September 2026) - https://www.anthropic.com/threat-intelligence-report-september-2026
- The same report as published PDF (154 pages) - https://cdn.sanity.io/files/4zrzovbb/website/e50be2e51e7695dc4b1366a37a245a597377d3b5.pdf
- Anthropic Threat Intelligence Report: August 2025 (PDF, 25 pages; the source of the GTG-2002 extortion case, the 17-organization figure, the $500,000-plus ransom demands and the "technical consultant and active operator" line) - https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf
- The Verge, "'Vibe-hacking' is now a top AI threat," 27 August 2025 (cited only as the dated 2025 artifact that current coverage keeps re-using) - https://www.theverge.com/ai-artificial-intelligence/766435/anthropic-claude-threat-intelligence-report-ai-cybersecurity-hacking
- Palo Alto Networks Unit 42, "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation," 2 September 2026, updated 3 September 2026 - https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation
- Axios, "Governments use Claude to spy on people, Anthropic warns," 10 September 2026 - https://www.axios.com/2026/09/10/anthropic-claude-government-surveillance-threats
- POLITICO, "Bad actors in China and Russia are already weaponizing Anthropic's AI," 10 September 2026 - https://www.politico.com/news/2026/09/10/bad-actors-china-russia-weaponizing-anthropic-01070435
- CyberScoop, "AI lets small actors run state-level hacking campaigns, Anthropic report finds," 10 September 2026 - https://cyberscoop.com/anthropic-report-ai-enabled-cyber-attacks/
- AP News, "Anthropic says it blocked efforts to use its AI for weapons and cyberattacks," 10 September 2026 - https://apnews.com/article/anthropic-ai-threat-bioweapon-russia-00266dca90e4f8853f669648998d3bda
Sourcing notes: quotations from [1], [3] and [5] were matched against the fetched source text for this draft; [2] is the same report as [1] in PDF form. Jacob Klein, Anthropic's threat intelligence lead, is quoted in [6] saying AI tools "are making state-backed surveillance cheaper and more efficient, rather than fundamentally changing who governments target," and that "authoritarian states are using AI for surveillance, repression and influence operations today" - "it's no longer hypothetical." [6] In [7] he says "some cases of misuse that used to be hypothetical are now real." His title varies by outlet ("head of threat intelligence" in [6]; "head of threat research" in [7]), so it is quoted in context rather than merged.