When von der Leyen warned about AI-enabled hacking, it had already happened
In her State of the Union address on 16 September, Ursula von der Leyen warned that the AI models being built now will enable hacking at a level no one thought possible — and that they will soon be in the hands of adversaries.
A threat intelligence report from the AI company Anthropic, published the same month, shows this is not a warning about the future. It is a description of the present.
European governments as targets
The report documents a Russian state-linked operation that, between December 2025 and August 2026, ran espionage against Ukrainian and European government bodies, military organisations and drone manufacturers. More than 20 organisations were targeted — ministries, defence bodies, embassies and think tanks — and at least eight had their email records compromised, including a national prosecutor's office and a military education institute.
The drone supply chain in particular was mapped systematically. The attackers stole a complete software development kit for a drone vision system and reverse-engineered it to recover product architecture, hardware bills of materials and supplier dependencies. They also reached firmware for military drone control.
A parallel Chinese operation hit around 50 organisations globally across education, retail, energy and government.
Nine influence operations
On the disinformation side, nine operations were disrupted, originating in Russia, Iran, Turkey, the Gulf, South Asia, Africa and Europe. One had produced 8,913 articles across roughly 70 fabricated news sites in about 20 languages. Another ran daily radio content in the Central African Republic pushing pro-Russia, anti-France narratives.
What is new is the scale
None of these are new kinds of attack. Espionage, technology theft and propaganda are ancient disciplines. What AI changes is how much a single operator can cover: automated fingerprinting of vulnerabilities, writing and debugging exploits, standing up phishing infrastructure, sorting stolen data at scale, and producing thousands of plausible articles in twenty languages.
Anthropic has banned the accounts involved, extended its monitoring and shared the findings with authorities and industry partners.
For ordinary users the point is not drone firmware. It is that the same capability drives the phishing and the fake messages landing in your inbox. We have collected the advice in Hackers are getting more numerous and better.
Sources
- Anthropic — the threat intelligence report with the documented operations, the number of organisations hit and the disrupted influence campaigns
- Euronews — coverage of the report and the Russian operations against European targets
- Help Net Security — von der Leyen's warning about hacking from the State of the Union address