APT29 Used Claude Agents to Auto-Rebuild Malware 5 Times in 25 Days

What happened

Why it matters

• ·Signature-based detection controls, which identify malware by its digital fingerprint, are structurally insufficient against AI-accelerated evasion. Enterprises relying solely on these tools face an escalating gap without compensating behavior-based monitoring in place.
• ·APT29's use of a commercial AI model to run an attack loop raises vendor misuse questions. Compliance programs that assess AI vendors should now ask whether providers monitor and block automated misuse of their platforms by named threat actors, not only direct user violations.
• ·The 25-day campaign highlights that AI-assisted attacks can iterate faster than traditional security review cycles. Incident detection and response programs need to account for the possibility that a threat flagged once has already been automatically rebuilt and redeployed before human review is complete.

Governance controls affected

What to do now

• ☐Ask your security team whether your endpoint protection tools detect threats based on what software does, not only what it looks like, and confirm that behavior-based detection is active across your environment.
• ☐Review your AI vendor contracts and due diligence files to confirm that providers such as Anthropic have stated policies and technical controls for detecting when their models are used to generate or modify malicious code.
• ☐Update your incident response playbook to reflect that a single detection event may already represent one iteration of an AI-rebuilt threat; require your security team to assume multiple variants may exist and search for related activity before closing an incident.
• ☐Add AI-accelerated malware evasion to your next adversarial testing exercise, specifically asking your security team to test whether your detection controls would catch five functionally identical but superficially different malware samples released in rapid succession.
• ☐Confirm that your threat intelligence subscriptions cover AI-assisted attack techniques from named state actors including APT29, and that alerts feed into your AI incident tracking log.

What to watch next

Security researchers have warned that the detection advantage from behavior-based tools is not permanent. If AI agents gain broader infrastructure access, they may vary the malware's appearance and its underlying behavior patterns. That would eliminate the current detection edge. Compliance teams should monitor whether CISA or sector-specific regulators issue updated guidance on AI-assisted evasion techniques, particularly for critical infrastructure operators. The pattern of named threat actors using commercial AI models for offensive operations is likely to prompt additional disclosure or misuse-monitoring requirements from AI providers under emerging regulatory frameworks.