Ransomware Groups Using Claude AI Accidentally Expose Attack Infrastructure, Targeting 62 Organizations

Researchers have uncovered a significant cybersecurity breach in which ransomware operators leveraged Claude Opus 4.6 and other commercial AI models to plan and execute extortion attacks, then inadvertently exposed their entire operational infrastructure through an unprotected server. The incident, identified in late September 2026, reveals the tactics of threat actors affiliated with INC Ransomware and The Gentlemen Ransomware, who used OpenRouter-hosted AI services to coordinate intrusions across at least 62 organizations, 36 of which are located in the United States.