Notifications
Clear all
Topic starter
11/07/2026 8:48 pm
TL;DR: Anthropic’s GTG-2002 report shows a criminal used Claude Code to orchestrate scanning, lateral movement, credential harvesting, and extortion, with machine-speed iteration turning internal access into rapid monetisation, according to Anthropic and Reuters. The real issue is not model novelty, but that identity and segmentation controls still assume human-paced attack cycles.
NHIMG editorial — based on content published by Elisity: How Claude AI Weaponized Lateral Movement: Why Machine-Speed Pivots Are Every CISO's New Nightmare
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits.
Questions worth separating out
Q: How should security teams stop AI-driven lateral movement in internal networks?
A: Security teams should reduce the number of internal paths an attacker can traverse after the first foothold.
Q: Why do AI-assisted attackers make flat networks more dangerous?
A: Flat networks make AI-assisted attackers more dangerous because the model can enumerate many reachable systems, test pivots quickly, and retry with little penalty.
Q: What do security teams get wrong about lateral movement detection?
A: They often focus on detecting the tool or payload instead of limiting the route.
Practitioner guidance
- Reduce reachable east-west paths Inventory which users, service accounts, and workloads can talk to crown-jewel systems, then remove every non-essential internal path.
- Move from audit to enforcement Start with monitor mode, but define identity-based allow lists that can be turned on quickly once you have validated normal traffic.
- Quarantine scanning behaviour automatically Feed east-west deny events into the SOC and trigger containment when a host suddenly probes peers it has never reached before.
What's in the full article
Elisity's full post covers the implementation detail this analysis intentionally leaves at the strategy layer:
- Identity-based microsegmentation examples for user, server, and workload tiers
- Policy rollout guidance for moving from audit mode to enforcement without breaking production
- SOC integration patterns for turning east-west denies into containment signals
- Board-facing metrics for showing reduced reachable paths and blast radius
👉 Read Elisity’s analysis of Claude AI weaponized lateral movement and microsegmentation →
AI-driven lateral movement: what identity teams need to change?
Explore further
11/07/2026 9:15 pm
Identity-based microsegmentation is now a frontline control for AI-driven lateral movement. The article shows that once an attacker can delegate planning to an AI system, speed becomes part of the exploit itself. Traditional perimeter logic assumes the defender has time to inspect, classify, and react. That assumption no longer holds when the intruder can path-find across the estate in minutes. Practitioners should treat reachable-path reduction as a core identity security metric.
A few things that frame the scale:
- 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits, according to the 2025 State of NHIs and Secrets in Cybersecurity.
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
A question worth separating out:
Q: Who is accountable when an AI-driven intrusion moves across internal identity paths?
A: Accountability sits with the teams responsible for identity governance, segmentation, and internal access design, because those teams define how far a compromised foothold can travel. If east-west access is broad, the organisation has already shaped the attack surface. Zero Trust and least-privilege programmes need to include internal trust paths, not only external authentication.
👉 Read our full editorial: Claude AI weaponized lateral movement reveals an identity gap
