Skip to Content
logologo
AI Incident Database
Donate
Discover
Submit
  • Welcome to the AIID
  • Table View
  • List view
  • Entities
  • Taxonomies
  • Spatial View
  • Blog
  • AI News Digest
  • Random Incident
  • Sign Up
Discover
Submit
  • Welcome to the AIID
  • Table View
  • List view
  • Entities
  • Taxonomies
  • Spatial View
  • Blog
  • AI News Digest
  • Random Incident
  • Sign Up
Entities

Claude AI models

Incidents implicated systems

Incident 165711 Report
Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

2023-09-27

Music publishers alleged that Anthropic copied copyrighted song lyrics without permission to train Claude and that Claude reproduced protected lyrics in its outputs. Anthropic denied infringement and has argued that its training use is fair use. Publishers alleged that the conduct deprived rightsholders and songwriters of licensing control and revenue and undermined markets for licensed lyrics.

More

Incident 10545 Report
Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

2025-04-23

In April 2025, Anthropic published a report detailing several misuse cases involving its Claude LLM, all detected in March. These included an "influence-as-a-service" operation that orchestrated over 100 social media bots; an effort to scrape and test leaked credentials for security camera access; a recruitment fraud campaign targeting Eastern Europe; and a novice actor developing sophisticated malware. Anthropic banned the accounts involved but could not confirm downstream deployment.

More

Incident 16613 Report
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

2026-04-08

Between April 8 and May 21, 2026, a Russian-speaking operator linked to the Aurora ransomware group reportedly used Cursor Agent, running Anthropic's Claude Sonnet 4.5, to assist exploitation across multiple organizations. Researchers said some AI-directed tasks succeeded while others failed; independent reporting identified six affected companies but could not determine how much the AI facilitated each breach or whether all led to data theft or extortion.

More

Related Entities
Other entities that are related to the same incident. For example, if the developer of an incident is this entity but the deployer is another entity, they are marked as related entities.
 

Entity

Malicious actors

Incidents involved as Deployer
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

Influence-as-a-service operators

Incidents involved as Deployer
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

Cybercriminals

Incidents involved as Deployer
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Anthropic

Incidents involved as both Developer and Deployer
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

Incidents involved as Developer
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Social media users

Incidents Harmed By
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

People targeted by malware

Incidents Harmed By
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

National security and intelligence stakeholders

Incidents Harmed By
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

Job seekers in Eastern Europe

Incidents Harmed By
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

IoT security camera owners

Incidents Harmed By
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

Epistemic integrity

Incidents Harmed By
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

Targets of fraudulent professional opportunities

Incidents Harmed By
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

LLM-enhanced malware toolkits

Incidents implicated systems
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

Claude

Incidents implicated systems
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

AI-generated social media bots

Incidents implicated systems
  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

Large language models

Incidents implicated systems
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

Chatbots

Incidents implicated systems
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

  • Incident 1054
    5 Reports

    Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development

More
Entity

AI service providers

Incidents involved as Deployer
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Large language model developers

Incidents involved as Developer
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Chatbot developers

Incidents involved as Developer
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Universal Music Group

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Songwriters

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Round Hill Music

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

publishers

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Musicians

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Music publishers

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Intellectual Property rights holders

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Copyright holders

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Concord Music Group

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

BMG Rights Management

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

ABKCO Music

Incidents Harmed By
  • Incident 1657
    11 Reports

    Anthropic Allegedly Copied Copyrighted Song Lyrics Without Permission to Train Claude

More
Entity

Aurora ransomware affiliate

Incidents involved as Deployer
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Ransomware operators

Incidents involved as Deployer
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Agentic threat actors

Incidents involved as Deployer
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

AI agent system deployers

Incidents involved as Deployer
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Anysphere

Incidents involved as Developer
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

AI agent system developers

Incidents involved as Developer
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Christeyns

Incidents Harmed By
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Teckentrup

Incidents Harmed By
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Helideck Certification Agency

Incidents Harmed By
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Bayou Title

Incidents Harmed By
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Companies

Incidents Harmed By
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Organizations

Incidents Harmed By
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Cursor

Incidents implicated systems
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Claude Sonnet 4.5

Incidents implicated systems
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

AI agent systems

Incidents implicated systems
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Aurora ransomware

Incidents implicated systems
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

Ransomware

Incidents implicated systems
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More
Entity

LLM-integrated code assistants

Incidents implicated systems
  • Incident 1661
    3 Reports

    Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

More

Research

  • Defining an “AI Incident”
  • Defining an “AI Incident Response”
  • Database Roadmap
  • Related Work
  • Download Complete Database

Project and Community

  • About
  • Contact and Follow
  • Apps and Summaries
  • Editor’s Guide

Incidents

  • All Incidents in List Form
  • Flagged Incidents
  • Submission Queue
  • Classifications View
  • Taxonomies

2026 - AI Incident Database

  • Terms of use
  • Privacy Policy
  • dd3f754