Threat Actors Use Coding Assistants in Intrusions
Gambit Security documented three unrelated threat-actor campaigns using Claude Code, OpenAI Codex, and other large language models during active intrusions, according to Help Net Security. In one late-June 2026 case, a suspected ransomware operator used Claude Code across six victim organizations for reconnaissance, command generation, malicious scripting, and database-dump staging.
Gambit Security has documented three unrelated threat-actor campaigns in which attackers used coding assistants and large language models during active intrusions, according to reporting by Help Net Security and Unite.AI. The reported activity included generating scripts and exploitation tools, examining compromised environments, identifying valuable business information, troubleshooting infrastructure, and refining commands based on system output.
One investigation involved a suspected ransomware operator that used Claude Code, running Claude Sonnet 4.6, during intrusions at six organizations in late June 2026, Help Net Security reports. The victims included an Australian energy utility and companies in financial services, food services, manufacturing, IT services, property management, and distribution. The activity was attributed with medium confidence to an actor associated with the The Gentlemen ransomware-as-a-service operation.
According to Help Net Security, the operator used Claude Code to generate and execute reconnaissance and exploitation commands, write malicious scripts, modify firewall policies, and analyze business systems. During reconnaissance, the tool processed technical results and identified systems including domain controllers, file servers, and backup servers.
Database targeting and data staging
At one victim, the operator asked the model to rank the importance of available databases. Help Net Security reports that the model identified a live production database and a client document store as priority targets. At the operator's request, Claude ran SQL Server backup commands on two servers and staged two compressed database dumps for exfiltration.
The same report states that one dump was exfiltrated after Claude copied it to the operator's machine and deleted it from the victim server. This account describes a model being used not only for code generation but also for interpreting a compromised environment and carrying out shell and database-administration tasks.
The other campaigns covered by Gambit involved large-scale secret harvesting and cloud-account exploitation, according to the original GBHackers item indexed by IT Security News. The available coverage identifies OpenAI Codex among the tools used, but does not provide comparable technical detail for those cases.
Operational use, not only code generation
Unite.AI characterizes Gambit's findings as evidence that AI tools are being incorporated into the day-to-day workflow of intrusions. The outlet reports that the examined actors used models to create environment-specific scripts, develop exploitation tools, prioritize business data, perform IT and DevOps tasks, and iteratively modify commands during an operation.
For defenders, the cases add weight to a broader security pattern: interactive assistants can shorten the cycle between discovery, command execution, error handling, and adaptation. Detection programs built only around known malware or static command signatures can be less effective when operators generate one-off scripts and alter commands in response to live output. In comparable incidents, telemetry connecting identity activity, cloud control-plane events, endpoint process execution, database backups, archive creation, and outbound data movement provides a more complete view of attacker behavior.
The reporting also underscores a limitation relevant to security teams evaluating coding agents: model safeguards may affect individual requests, but attackers who already hold valid access can still use general-purpose automation for otherwise familiar administrative actions. The underlying defensive priorities remain least-privilege access, credential protection, monitoring of high-value data stores, and controls on unusual backup or exfiltration activity.
Key Points
- 1Gambit Security documented coding assistants being used for reconnaissance, scripting, database targeting, secret harvesting, and cloud-account attacks during active intrusions.
- 2The Claude Code case involved SQL Server backups and staged database dumps, extending AI use beyond generic malware or phishing content.
- 3Comparable intrusions often require defenders to correlate identity, endpoint, cloud, database, and data-egress telemetry rather than rely on static signatures.
Scoring Rationale
The report provides concrete evidence of coding assistants being used interactively inside real intrusions, including reconnaissance and database-dump staging. It is highly relevant to security engineers and teams deploying coding agents, although the available reporting offers limited technical detail on two of the three campaigns.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
