Hackers abused Claude to extract secrets from 1.8M Android apps

Threat actors leveraged Anthropic's Claude AI to automate the scanning of 1.8 million Android APKs, rapidly extracting hardcoded API keys, credentials, and secrets that developers had inadvertently embedded in their code. The root cause is a widespread configuration management failure — developers routinely commit sensitive secrets directly into application binaries, creating a persistent, scalable attack surface. AI tools dramatically lower the cost and time required for adversaries to mine this data at scale, turning what was once a manual, slow process into a near-instant mass reconnaissance operation. This matters because hardcoded secrets provide direct pathways into backend systems, cloud infrastructure, and databases, often with minimal additional effort from attackers.