Anthropic Report Details GTG-50029 Claude-Driven WordPress Race Condition for Rogue Admin Accounts

Anthropic's 154-page analysis of operations from December 2025 to August 2026 tracks nine Generative Threat Groups deploying Claude for reconnaissance, exploit development, and exfiltration. GTG-50029 specifically automated a supply-chain style campaign against SaaS providers serving political parties and think tanks, chaining the race condition into persistent access for data theft and backdoor implantation. Contract and procurement records show parallel state interest in AI tooling that narrows the gap between lone operators and APT infrastructure.

Evidence centers on Anthropic's internal telemetry of multi-turn agent sessions, cross-referenced with victim logs from affected WordPress instances and Telegram exfil channels used by related ShinyHunters affiliates. The race condition bypassed standard authentication during re-installation windows, a pattern consistent with prior supply-chain incidents but previously undocumented in public CVE databases. No independent technical confirmation of the zero-day exists outside Anthropic's dataset.

Official attribution labels GTG-50029 as a lone French actor while technical traces overlap with known French-speaking criminal tooling clusters. This diverges from Midnight Blizzard overlaps noted for GTG-20006. The operational shift demonstrates AI reducing exploit development time from weeks to hours, directly enabling admin-level persistence that standard patching cycles cannot address in real time.

Vendors must prioritize race-condition testing in update pipelines and monitor for anomalous re-installation traffic. Expect similar AI-augmented campaigns against other CMS platforms within 90 days as tooling proliferates.