WEBVTT
00:00:00.320 --> 00:00:01.600
Three hours.
00:00:02.000 --> 00:00:13.119
That's how long Anthropic says it took one attacker to go from one single stolen developer token to full administrative control of a company's cloud environment.
00:00:13.279 --> 00:00:15.679
No crack password or firewall breach.
00:00:15.839 --> 00:00:20.640
The attacker started with a credential that already worked, basically house keys.
00:00:20.800 --> 00:00:22.480
And this is not a one-off.
00:00:22.640 --> 00:00:28.000
The same pattern keeps showing up across Anthropics' new threat report over and over.
00:00:28.399 --> 00:00:33.439
In one major cyber operation, most intrusions began with compromised credentials.
00:00:33.600 --> 00:00:42.000
Valid tokens were tested against real production systems, then used to expand access, dump secrets, and pool data.
00:00:42.159 --> 00:00:46.880
Most coverage of this report has been about AI making hackers more powerful.
00:00:47.039 --> 00:00:49.200
But that headline skips a step.
00:00:49.439 --> 00:00:56.479
What happens when the attacker doesn't need to break in because the system already believes they belong there?
00:00:56.719 --> 00:00:59.759
My name is Marcos Bravo and this is Subject Line Blank.
00:01:00.000 --> 00:01:00.960
Let's go.
00:01:10.159 --> 00:01:20.719
Look, a stolen credential has always been dangerous, but historically there was often a gap between getting access and turning that access into serious damage.
00:01:20.959 --> 00:01:23.519
That gap was giving the good guys a chance.
00:01:23.760 --> 00:01:27.359
Someone noticed an unusual login and then the process starts.
00:01:27.599 --> 00:01:35.200
Tokens get revoked, a password gets reset, and an analyst somewhere gets woken up to look for suspicious activity.
00:01:35.359 --> 00:01:47.519
The AI can map the environment, search for extra secrets, write the scripts it needs, analyze what it finds, and keep the operation moving while the human just focuses on targets and decisions.
00:01:47.760 --> 00:01:52.560
And one operator can do this across multiple victims at the same time.
00:01:52.799 --> 00:01:55.760
That changes the good guy's job forever.
00:01:56.000 --> 00:02:03.439
You're no longer relying on an attacker being slow enough or nosy enough for somebody to notice before any damage is done.
00:02:03.680 --> 00:02:10.240
Because when the first alert arrives, the question might no longer be did someone get in?
00:02:10.560 --> 00:02:13.599
It might be how much they already done.
00:02:13.840 --> 00:02:16.719
So the question is who the heck is doing this?
00:02:16.960 --> 00:02:17.680
Let's see.
00:02:17.840 --> 00:02:27.039
In the report, Anthropic identified two operators in one Chinese espionage program as undergraduate engineering students.
00:02:27.280 --> 00:02:34.159
One had previously interned at a security company and was interviewing for an offensive cybersecurity job.
00:02:34.479 --> 00:02:35.599
Offensive.
00:02:35.840 --> 00:02:45.280
Their group was running parallel workflows for intrusion attempts, government network reconnaissance, malware development, all the bad stuff.
00:02:45.520 --> 00:02:48.400
They targeted roughly 50 organizations.
00:02:49.039 --> 00:02:49.840
Fifty.
00:02:50.159 --> 00:03:01.680
In another case, Anthropic tracked a single French speaking activist targeting political parties, media companies, think tanks, that kind of stuff, all across Europe.
00:03:01.919 --> 00:03:17.360
One person built custom scanners for exposed API keys, developed exploits and created a doxin search engine containing tens of millions of records, including health and justice system data.
00:03:17.680 --> 00:03:21.360
Anthropic says the platform was built by that one person.
00:03:21.680 --> 00:03:22.960
Oh, and Mali.
00:03:23.360 --> 00:03:34.879
Anthropic says a single independent consultant used Claude as the main engineering workforce behind a national surveillance platform designed for the country's intelligence service.
00:03:35.120 --> 00:03:44.159
The system was built to monitor communications across all three national mobile operators, covering roughly 25 million SIM cards.
00:03:44.479 --> 00:03:46.080
25 million.
00:03:46.400 --> 00:03:49.039
That doesn't mean state-backed hacking disappeared.
00:03:49.199 --> 00:03:51.280
The report has plenty of that for sure.
00:03:51.439 --> 00:03:58.159
What it does make harder is looking at a sophisticated attack and assuming there must be a huge team behind it.
00:03:58.319 --> 00:04:02.879
Remember when there were whole government teams behind this kind of attacks?
00:04:03.120 --> 00:04:07.280
Now all you need is just one person and one laptop.
00:04:07.520 --> 00:04:09.280
Soon, maybe just the phone.
00:04:09.599 --> 00:04:12.560
But not everything in Anthropics Report actually worked.
00:04:12.719 --> 00:04:18.639
One operation was traced to LKM Company, it's a French digital advertising agency.
00:04:18.879 --> 00:04:30.720
It built a network of roughly 70 fake news websites, supported by matching social accounts, and more than 250 fake commenting accounts.
00:04:30.959 --> 00:04:32.240
A marketer's dream.
00:04:32.480 --> 00:04:42.000
Cloud was used to write original stories and rewrite articles from legitimate news organizations with whatever political angle the campaign needed.
00:04:42.160 --> 00:04:43.199
Now listen to this.
00:04:43.360 --> 00:04:50.560
The network published at least 8,913 articles in around 20 languages.
00:04:50.720 --> 00:04:52.560
That is a ridiculous amount of content.
00:04:52.720 --> 00:04:57.600
But Anthropic says most of it generated almost no engagement from real people, at least.
00:04:57.839 --> 00:05:12.240
Using the breakout scale, the operation only reached category 2, meaning the content circulated through its own websites and associated social accounts with hardly any evidence that it broke out much further than that.
00:05:12.480 --> 00:05:17.199
Anthropic also said it disrupted the operation before it could build a real audience.
00:05:17.439 --> 00:05:25.839
And I think there's something useful in that for anyone currently being told that AI means they should publish five times more content.
00:05:26.079 --> 00:05:34.639
This group had fake journalists, dozens of websites, hundreds of supporting accounts, and nearly 9,000 articles.
00:05:34.879 --> 00:05:37.600
What it didn't have was an audience.
00:05:37.920 --> 00:05:38.879
Sound familiar?
00:05:39.120 --> 00:05:42.639
That's one of the more reassuring findings in the whole report.
00:05:42.879 --> 00:05:49.439
AI can scale the supply of content very quickly, but you can't AI attention.
00:05:49.759 --> 00:05:55.360
Now, one of the biggest operations in the whole report was not aimed at a company network.
00:05:55.600 --> 00:05:57.920
It was aimed at Claude itself.
00:05:58.319 --> 00:06:09.360
Anthropic says it detected large-scale attempts by a Chinese AI lab to use CLOD's outputs to train their own models, a process known as distillation.
00:06:09.600 --> 00:06:11.199
You learn something new every day.
00:06:11.439 --> 00:06:17.759
The largest campaign was attributed by Anthropic to Alibaba between May and July 2026.
00:06:18.000 --> 00:06:23.920
Anthropic says it observed more than 151 million exchanges linked to the operation.
00:06:24.240 --> 00:06:33.839
Alibaba accessed CLUD through thousands of fraudulent accounts using residential proxies, disposable email addresses, and virtual payment cards.
00:06:34.160 --> 00:06:38.800
When one pool of accounts was banned, the traffic moved just to another.
00:06:38.959 --> 00:06:40.240
The idea was simple.
00:06:40.480 --> 00:06:49.680
Ask a stronger model, an enormous amount of questions, collect the answers, and use them as training material for a different model.
00:06:50.000 --> 00:06:51.040
Your own model.
00:06:51.439 --> 00:06:55.759
Anthropic says Moonshot and Dipsyc went even further.
00:06:56.000 --> 00:07:04.160
In some cases, users who thought they were talking to those companies' own models were actually having their request forwarded to Claude.
00:07:06.399 --> 00:07:09.199
And those were not always harmless prompts.
00:07:09.439 --> 00:07:17.600
Anthropic says some of the forwarded conversations contained company information, code, even live credentials.
00:07:17.759 --> 00:07:23.759
So the users themselves may not have known their data was being sent to another AI provider.
00:07:24.000 --> 00:07:31.600
So when we talk about stolen AI access, it's not only criminals looking for a free API key.
00:07:31.920 --> 00:07:37.279
At this scale, access to the model is valuable enough to become the target itself.
00:07:37.519 --> 00:07:43.839
Now there's one line in the Russian espionage case that should worry anyone working in email.
00:07:44.079 --> 00:07:44.879
That's you.
00:07:45.199 --> 00:07:55.199
Anthropic says the group used device code phishing that abuse legitimate signing flows for cloud email services, which in this case was Microsoft 365.
00:07:55.360 --> 00:07:59.680
Device code phishing is different from the fake login page most people picture.
00:07:59.839 --> 00:08:04.240
The victim is pushed through a real Microsoft authentication flow.
00:08:04.480 --> 00:08:08.079
They approve access and the attacker gets a valid token.
00:08:08.319 --> 00:08:12.160
Anthropic says the group built an entire platform around this.
00:08:12.319 --> 00:08:21.759
It was used against diplomatic and government targets and led to mail records being accessed and exposed from at least eight organizations.
00:08:22.079 --> 00:08:27.920
The same group also bulk exported mailboxes belonging to at least two drone component manufacturers.
00:08:28.079 --> 00:08:32.000
Now think about what that means for email authentication.
00:08:32.320 --> 00:08:41.679
SPF, DKIM, and DMARC are very good at answering whether a message is authorized to come from a domain.
00:08:42.000 --> 00:08:50.639
But if somebody has taken over the actual account and sends through the legitimate infrastructure, those checks can still pass.
00:08:51.120 --> 00:08:53.919
Nothing needs to pretend to be your domain.
00:08:54.080 --> 00:08:56.399
The attacker is using your account.
00:08:58.000 --> 00:09:03.120
So for anyone running email infrastructure, authentication is only part of the job.
00:09:03.360 --> 00:09:09.200
You also need to know when a perfectly valid account starts behaving like somebody else have the keys.
00:09:09.440 --> 00:09:17.679
The part of this report that is actually special is how often the attacker was already holding something the system accepted.
00:09:18.000 --> 00:09:25.679
A valid token, a real Outh grant, an API key, a real sign in flow.
00:09:26.000 --> 00:09:28.720
Not every attack in the report worked that way.
00:09:28.960 --> 00:09:34.879
There are exploits, malware, and plenty of old school intrusion techniques, for sure.
00:09:35.200 --> 00:09:40.480
But the credential base cases expose, let's say, an awkward gap.
00:09:40.799 --> 00:09:48.080
Most of security is designed around spotting an outsider trying to look real, to look legitimate.
00:09:48.320 --> 00:09:52.879
But what happened when they are legitimate, at least as far as the system is concerned?
00:09:53.120 --> 00:09:59.440
Because now you have something that doesn't fit neatly into intruder alert or insider.
00:09:59.840 --> 00:10:07.840
You have somebody operating with a valid batch, but moving through the environment at a speed that no normal employee will ever would.
00:10:08.159 --> 00:10:21.679
Anthropic says AI is being used as a recon system to harvest credentials, move around data, export data, and keep access, sometimes with the human mainly choosing targets and reviewing what came back.
00:10:21.919 --> 00:10:28.559
And that is the threat model correction I think get lost if we reduce this report to AI makes hackers better.
00:10:28.799 --> 00:10:35.600
The harder problem is figuring out when access that looks completely valid has stopped being legitimate.
00:10:35.759 --> 00:10:37.759
Now I want your comments on this question.
00:10:38.000 --> 00:10:47.200
If an attacker has a valid sending credential for your domain and passes every single authentication, what are you relying on to catch them?
00:10:47.519 --> 00:10:49.600
How are you gonna catch them?
00:10:49.919 --> 00:10:54.879
Because SPF, DKIM, and DMARC are not answering that question anymore.
00:10:55.039 --> 00:10:57.120
And the follow-up should be exactly that.
00:10:57.440 --> 00:11:00.720
What does catch an authenticated attacker?
00:11:00.960 --> 00:11:03.759
Now don't forget to subscribe so you can answer to these questions.
00:11:03.919 --> 00:11:07.759
Always stay in touch with what's happening around the world of AI, tech, and marketing.
00:11:07.919 --> 00:11:11.679
My name is Marcos Revo, and this is Subject Line Blank.
00:11:11.840 --> 00:11:12.960
See you next time.
00:00:00.320 --> 00:00:01.600
Three hours.
00:00:02.000 --> 00:00:13.119
That's how long Anthropic says it took one attacker to go from one single stolen developer token to full administrative control of a company's cloud environment.
00:00:13.279 --> 00:00:15.679
No crack password or firewall breach.
00:00:15.839 --> 00:00:20.640
The attacker started with a credential that already worked, basically house keys.
00:00:20.800 --> 00:00:22.480
And this is not a one-off.
00:00:22.640 --> 00:00:28.000
The same pattern keeps showing up across Anthropics' new threat report over and over.
00:00:28.399 --> 00:00:33.439
In one major cyber operation, most intrusions began with compromised credentials.
00:00:33.600 --> 00:00:42.000
Valid tokens were tested against real production systems, then used to expand access, dump secrets, and pool data.
00:00:42.159 --> 00:00:46.880
Most coverage of this report has been about AI making hackers more powerful.
00:00:47.039 --> 00:00:49.200
But that headline skips a step.
00:00:49.439 --> 00:00:56.479
What happens when the attacker doesn't need to break in because the system already believes they belong there?
00:00:56.719 --> 00:00:59.759
My name is Marcos Bravo and this is Subject Line Blank.
00:01:00.000 --> 00:01:00.960
Let's go.
00:01:10.159 --> 00:01:20.719
Look, a stolen credential has always been dangerous, but historically there was often a gap between getting access and turning that access into serious damage.
00:01:20.959 --> 00:01:23.519
That gap was giving the good guys a chance.
00:01:23.760 --> 00:01:27.359
Someone noticed an unusual login and then the process starts.
00:01:27.599 --> 00:01:35.200
Tokens get revoked, a password gets reset, and an analyst somewhere gets woken up to look for suspicious activity.
00:01:35.359 --> 00:01:47.519
The AI can map the environment, search for extra secrets, write the scripts it needs, analyze what it finds, and keep the operation moving while the human just focuses on targets and decisions.
00:01:47.760 --> 00:01:52.560
And one operator can do this across multiple victims at the same time.
00:01:52.799 --> 00:01:55.760
That changes the good guy's job forever.
00:01:56.000 --> 00:02:03.439
You're no longer relying on an attacker being slow enough or nosy enough for somebody to notice before any damage is done.
00:02:03.680 --> 00:02:10.240
Because when the first alert arrives, the question might no longer be did someone get in?
00:02:10.560 --> 00:02:13.599
It might be how much they already done.
00:02:13.840 --> 00:02:16.719
So the question is who the heck is doing this?
00:02:16.960 --> 00:02:17.680
Let's see.
00:02:17.840 --> 00:02:27.039
In the report, Anthropic identified two operators in one Chinese espionage program as undergraduate engineering students.
00:02:27.280 --> 00:02:34.159
One had previously interned at a security company and was interviewing for an offensive cybersecurity job.
00:02:34.479 --> 00:02:35.599
Offensive.
00:02:35.840 --> 00:02:45.280
Their group was running parallel workflows for intrusion attempts, government network reconnaissance, malware development, all the bad stuff.
00:02:45.520 --> 00:02:48.400
They targeted roughly 50 organizations.
00:02:49.039 --> 00:02:49.840
Fifty.
00:02:50.159 --> 00:03:01.680
In another case, Anthropic tracked a single French speaking activist targeting political parties, media companies, think tanks, that kind of stuff, all across Europe.
00:03:01.919 --> 00:03:17.360
One person built custom scanners for exposed API keys, developed exploits and created a doxin search engine containing tens of millions of records, including health and justice system data.
00:03:17.680 --> 00:03:21.360
Anthropic says the platform was built by that one person.
00:03:21.680 --> 00:03:22.960
Oh, and Mali.
00:03:23.360 --> 00:03:34.879
Anthropic says a single independent consultant used Claude as the main engineering workforce behind a national surveillance platform designed for the country's intelligence service.
00:03:35.120 --> 00:03:44.159
The system was built to monitor communications across all three national mobile operators, covering roughly 25 million SIM cards.
00:03:44.479 --> 00:03:46.080
25 million.
00:03:46.400 --> 00:03:49.039
That doesn't mean state-backed hacking disappeared.
00:03:49.199 --> 00:03:51.280
The report has plenty of that for sure.
00:03:51.439 --> 00:03:58.159
What it does make harder is looking at a sophisticated attack and assuming there must be a huge team behind it.
00:03:58.319 --> 00:04:02.879
Remember when there were whole government teams behind this kind of attacks?
00:04:03.120 --> 00:04:07.280
Now all you need is just one person and one laptop.
00:04:07.520 --> 00:04:09.280
Soon, maybe just the phone.
00:04:09.599 --> 00:04:12.560
But not everything in Anthropics Report actually worked.
00:04:12.719 --> 00:04:18.639
One operation was traced to LKM Company, it's a French digital advertising agency.
00:04:18.879 --> 00:04:30.720
It built a network of roughly 70 fake news websites, supported by matching social accounts, and more than 250 fake commenting accounts.
00:04:30.959 --> 00:04:32.240
A marketer's dream.
00:04:32.480 --> 00:04:42.000
Cloud was used to write original stories and rewrite articles from legitimate news organizations with whatever political angle the campaign needed.
00:04:42.160 --> 00:04:43.199
Now listen to this.
00:04:43.360 --> 00:04:50.560
The network published at least 8,913 articles in around 20 languages.
00:04:50.720 --> 00:04:52.560
That is a ridiculous amount of content.
00:04:52.720 --> 00:04:57.600
But Anthropic says most of it generated almost no engagement from real people, at least.
00:04:57.839 --> 00:05:12.240
Using the breakout scale, the operation only reached category 2, meaning the content circulated through its own websites and associated social accounts with hardly any evidence that it broke out much further than that.
00:05:12.480 --> 00:05:17.199
Anthropic also said it disrupted the operation before it could build a real audience.
00:05:17.439 --> 00:05:25.839
And I think there's something useful in that for anyone currently being told that AI means they should publish five times more content.
00:05:26.079 --> 00:05:34.639
This group had fake journalists, dozens of websites, hundreds of supporting accounts, and nearly 9,000 articles.
00:05:34.879 --> 00:05:37.600
What it didn't have was an audience.
00:05:37.920 --> 00:05:38.879
Sound familiar?
00:05:39.120 --> 00:05:42.639
That's one of the more reassuring findings in the whole report.
00:05:42.879 --> 00:05:49.439
AI can scale the supply of content very quickly, but you can't AI attention.
00:05:49.759 --> 00:05:55.360
Now, one of the biggest operations in the whole report was not aimed at a company network.
00:05:55.600 --> 00:05:57.920
It was aimed at Claude itself.
00:05:58.319 --> 00:06:09.360
Anthropic says it detected large-scale attempts by a Chinese AI lab to use CLOD's outputs to train their own models, a process known as distillation.
00:06:09.600 --> 00:06:11.199
You learn something new every day.
00:06:11.439 --> 00:06:17.759
The largest campaign was attributed by Anthropic to Alibaba between May and July 2026.
00:06:18.000 --> 00:06:23.920
Anthropic says it observed more than 151 million exchanges linked to the operation.
00:06:24.240 --> 00:06:33.839
Alibaba accessed CLUD through thousands of fraudulent accounts using residential proxies, disposable email addresses, and virtual payment cards.
00:06:34.160 --> 00:06:38.800
When one pool of accounts was banned, the traffic moved just to another.
00:06:38.959 --> 00:06:40.240
The idea was simple.
00:06:40.480 --> 00:06:49.680
Ask a stronger model, an enormous amount of questions, collect the answers, and use them as training material for a different model.
00:06:50.000 --> 00:06:51.040
Your own model.
00:06:51.439 --> 00:06:55.759
Anthropic says Moonshot and Dipsyc went even further.
00:06:56.000 --> 00:07:04.160
In some cases, users who thought they were talking to those companies' own models were actually having their request forwarded to Claude.
00:07:06.399 --> 00:07:09.199
And those were not always harmless prompts.
00:07:09.439 --> 00:07:17.600
Anthropic says some of the forwarded conversations contained company information, code, even live credentials.
00:07:17.759 --> 00:07:23.759
So the users themselves may not have known their data was being sent to another AI provider.
00:07:24.000 --> 00:07:31.600
So when we talk about stolen AI access, it's not only criminals looking for a free API key.
00:07:31.920 --> 00:07:37.279
At this scale, access to the model is valuable enough to become the target itself.
00:07:37.519 --> 00:07:43.839
Now there's one line in the Russian espionage case that should worry anyone working in email.
00:07:44.079 --> 00:07:44.879
That's you.
00:07:45.199 --> 00:07:55.199
Anthropic says the group used device code phishing that abuse legitimate signing flows for cloud email services, which in this case was Microsoft 365.
00:07:55.360 --> 00:07:59.680
Device code phishing is different from the fake login page most people picture.
00:07:59.839 --> 00:08:04.240
The victim is pushed through a real Microsoft authentication flow.
00:08:04.480 --> 00:08:08.079
They approve access and the attacker gets a valid token.
00:08:08.319 --> 00:08:12.160
Anthropic says the group built an entire platform around this.
00:08:12.319 --> 00:08:21.759
It was used against diplomatic and government targets and led to mail records being accessed and exposed from at least eight organizations.
00:08:22.079 --> 00:08:27.920
The same group also bulk exported mailboxes belonging to at least two drone component manufacturers.
00:08:28.079 --> 00:08:32.000
Now think about what that means for email authentication.
00:08:32.320 --> 00:08:41.679
SPF, DKIM, and DMARC are very good at answering whether a message is authorized to come from a domain.
00:08:42.000 --> 00:08:50.639
But if somebody has taken over the actual account and sends through the legitimate infrastructure, those checks can still pass.
00:08:51.120 --> 00:08:53.919
Nothing needs to pretend to be your domain.
00:08:54.080 --> 00:08:56.399
The attacker is using your account.
00:08:58.000 --> 00:09:03.120
So for anyone running email infrastructure, authentication is only part of the job.
00:09:03.360 --> 00:09:09.200
You also need to know when a perfectly valid account starts behaving like somebody else have the keys.
00:09:09.440 --> 00:09:17.679
The part of this report that is actually special is how often the attacker was already holding something the system accepted.
00:09:18.000 --> 00:09:25.679
A valid token, a real Outh grant, an API key, a real sign in flow.
00:09:26.000 --> 00:09:28.720
Not every attack in the report worked that way.
00:09:28.960 --> 00:09:34.879
There are exploits, malware, and plenty of old school intrusion techniques, for sure.
00:09:35.200 --> 00:09:40.480
But the credential base cases expose, let's say, an awkward gap.
00:09:40.799 --> 00:09:48.080
Most of security is designed around spotting an outsider trying to look real, to look legitimate.
00:09:48.320 --> 00:09:52.879
But what happened when they are legitimate, at least as far as the system is concerned?
00:09:53.120 --> 00:09:59.440
Because now you have something that doesn't fit neatly into intruder alert or insider.
00:09:59.840 --> 00:10:07.840
You have somebody operating with a valid batch, but moving through the environment at a speed that no normal employee will ever would.
00:10:08.159 --> 00:10:21.679
Anthropic says AI is being used as a recon system to harvest credentials, move around data, export data, and keep access, sometimes with the human mainly choosing targets and reviewing what came back.
00:10:21.919 --> 00:10:28.559
And that is the threat model correction I think get lost if we reduce this report to AI makes hackers better.
00:10:28.799 --> 00:10:35.600
The harder problem is figuring out when access that looks completely valid has stopped being legitimate.
00:10:35.759 --> 00:10:37.759
Now I want your comments on this question.
00:10:38.000 --> 00:10:47.200
If an attacker has a valid sending credential for your domain and passes every single authentication, what are you relying on to catch them?
00:10:47.519 --> 00:10:49.600
How are you gonna catch them?
00:10:49.919 --> 00:10:54.879
Because SPF, DKIM, and DMARC are not answering that question anymore.
00:10:55.039 --> 00:10:57.120
And the follow-up should be exactly that.
00:10:57.440 --> 00:11:00.720
What does catch an authenticated attacker?
00:11:00.960 --> 00:11:03.759
Now don't forget to subscribe so you can answer to these questions.
00:11:03.919 --> 00:11:07.759
Always stay in touch with what's happening around the world of AI, tech, and marketing.
00:11:07.919 --> 00:11:11.679
My name is Marcos Revo, and this is Subject Line Blank.
00:11:11.840 --> 00:11:12.960
See you next time.
