Anthropic disclosed that a financially motivated actor it tracks as linked to the ShinyHunters collective used its Claude model to automate a large-scale credential-harvesting pipeline. Running on cloud worker instances, the operation downloaded and decompiled roughly 1.8 million Android apps and scanned them for hardcoded secrets, routing verified findings to an external channel for use in further breaches. The same actor used AI assistance to extract more than 2,100 sets of authentication tokens across 40-plus corporate accounts in roughly 34 hours, and separately exfiltrated about 1 terabyte of data from a technology provider. Anthropic said it suspended the associated accounts and added detection measures after identifying the activity.