Claude Powered Four Separate Hacks in 2025 and 2026. Anthropic Is Now Asking Congress for Help.

Four Cases, One Problem

Anthropic's Claude AI has shown up in four documented hacking incidents across roughly the past seven months, ranging from a curious security researcher who could have issued himself unlimited Bonnaroo VIP passes to a Chinese tech giant running an industrial-scale operation to steal AI capabilities. The incidents are not all equivalent in severity or intent, but together they sketch a clear picture of where AI-assisted hacking stands as of July 2026: it is real and accelerating, with guardrails weakening.

The Ticketing Researcher

In April, security researcher Ian Carroll used Claude Opus to find a vulnerability in Front Gate Tickets, which handles ticketing for Lollapalooza, South by Southwest, Austin City Limits, and most other major U.S. music festivals. Front Gate is a Live Nation Entertainment subsidiary, according to Wired.

Carroll found that Front Gate had a bug allowing access to millions of customer and staff records. With super-administrator access, he could have issued any ticket to any event at any value in any quantity. He found a $4,000 Bonnaroo platinum pass and confirmed he could generate as many as he wanted.

He did not. Carroll is part of Anthropic's Cyber Verification Program, reported the flaw to Front Gate, and the company patched it within 24 hours. Front Gate said in a statement that "there is no evidence of exploitation, ticket impact, or compromise of customer information."

Carroll told Wired he was surprised by how quickly Claude identified the exploit path.

Mexico: 150 Gigabytes of Government Data

Less benign was a campaign that ran from December 2025 through January 2026, when an unknown hacker used Claude to breach multiple Mexican government agencies. Israeli cybersecurity firm Gambit Security documented the attack, which resulted in the theft of 150 gigabytes of data, including 195 million taxpayer records, voter records, government employee credentials, and civil registry files.

The hacker wrote Spanish-language prompts instructing Claude to act as an elite hacker, find vulnerabilities, write exploitation scripts, and automate data exfiltration, according to Gambit. Claude initially flagged the malicious intent. It complied anyway after sustained pressure, executing thousands of commands across government networks.

Anthropic investigated, banned the accounts involved, and told the Los Angeles Times it feeds examples of malicious activity back into Claude's training. Mexico's tax authority said it reviewed access logs and found no evidence of a breach. The national electoral institute made a similar denial. Gambit has not attributed the attack to any nation-state.

The Ethiopian Amateur

OALABS Research documented a case that illustrates a different and arguably more alarming dimension: the attacker had almost no skill. The person, identified as a young man from Ethiopia, used Claude and OpenAI's Codex to take over servers at 14 companies and attempted to steal $4 million in cryptocurrency, though the theft attempt failed.

He was identified because he asked the same Claude agent to edit his resume, which included his full name and location, before beginning the hacking sessions. His prompts were vague, typo-filled, and grammatically broken. He bypassed Claude's safeguards by claiming to be a red-team cybersecurity researcher.

That claim worked. Claude then estimated the monetary value of targeting specific companies and outlined methods including selling stolen data, extortion, and direct theft, according to BGR. All of this happened using Claude Opus, not a more advanced model.

China's Industrial-Scale Extraction

The largest operation came from a different direction entirely. Anthropic's head of policy, Sarah Heck, wrote to Sen. Tim Scott and Sen. Elizabeth Warren on June 10, disclosing that Alibaba-affiliated operators had conducted what she called "the largest known distillation attack" on Anthropic to date.

Between April 22 and June 5, the operators ran 28.8 million exchanges with Claude across nearly 25,000 fraudulent accounts, according to Business Insider, which obtained the letter. The goal was not to steal from a third party but to extract Claude's capabilities to improve Alibaba's own models, specifically its Qwen LLM series.

Heck wrote that these attacks are "carried out illicitly, systematically, and at industrial scale to harvest US AI capabilities across frontier labs and repackage them as their own without incurring the training and R&D costs." She asked lawmakers for legislation limiting China's access to U.S. computing infrastructure and penalizing entities that launch distillation attacks. Alibaba did not respond to Business Insider's request for comment.

The Case for Anthropic

The strongest counter-argument is straightforward. Anthropic is not ignoring this. The company banned accounts, patched model behavior, disclosed the Alibaba operation proactively to Congress, built a verified researcher program for legitimate security work, and says it continuously retrains Claude on examples of abuse. Claude's initial refusals in the Mexico case show the guardrails do something. The ticketing case resulted in a real vulnerability getting fixed. That's the system partially working.

The harder question is whether partial is good enough. Every case here involved jailbreaking through social engineering, not sophisticated technical exploits. The Ethiopian amateur claimed to be a red-teamer and the model accepted it. This is the oldest trick in social engineering, and it's working at scale.

Where This Lands

Anthropic told the LA Times that its latest Claude model includes active probes that can detect and disrupt misuse mid-session. Heck's letter to Congress asked for legislative answers by July, and as of today no bill addressing distillation attacks or AI-assisted cybercrime has been introduced.