Anthropic says an Iran-nexus threat actor used AI to research known vulnerabilities in maritime VSAT, Cisco communications and industrial-control equipment. The activity was disrupted, and the report does not say the listed products were successfully compromised.
Anthropic's September 2026 threat-intelligence report shows a threat actor using AI to research known vulnerabilities in shipboard communications and operational-technology equipment. 1
The research included vulnerabilities linked to COBHAM SAILOR 900 VSAT, Cisco Unified Communications Manager, Cisco industrial wireless equipment and Schneider Electric EcoStruxure products.
Anthropic describes the actor as Iran-nexus and says the activity formed part of wider reconnaissance against US naval forces. The account was banned and the activity disrupted. The report does not say that the maritime products listed were successfully compromised.
What was being researched?
Anthropic identified the following products and public CVEs:
Scroll sideways to compare all columns
| Product | CVEs researched |
|---|---|
| COBHAM SAILOR 900 VSAT | CVE-2022-22707, CVE-2019-11072, CVE-2018-19052 |
| Cisco Unified Communications Manager | CVE-2025-20309 |
| Cisco Ultra-Reliable Wireless Backhaul | CVE-2024-20418 |
| Cisco IW3702 industrial wireless AP | CVE-2024-20354 |
| Schneider Electric EcoStruxure products | CVE-2024-2658 |
Some of these vulnerabilities have already been patched, and whether a vessel is affected depends on the exact product, software version and configuration.
The important point is that older maritime and industrial vulnerabilities are being actively researched by real threat actors.
Why this matters onboard
Shipboard equipment is often kept in service for many years because it remains operationally reliable. Satellite terminals, telephony servers, industrial wireless equipment and OT systems may also sit on segmented networks and rarely be administered.
That can make them easy to miss during vulnerability reviews.
Segmentation reduces risk, but it does not remove it. Equipment may still become reachable through remote support, maintenance laptops, temporary firewall rules, another compromised device, or network changes made since the system was installed.
The same applies to equipment left on old firmware because it is stable. There may be good operational reasons not to update immediately, but the decision should be based on a known vulnerability and support position.
What should technical teams do?
Legacy satcom, communications and OT equipment should be included in routine vulnerability reviews - a task that is often left out of a yachts PMS schedule.
For each system, establish:
- hardware and software version;
- current vendor support status;
- whether known vulnerabilities affect that version;
- whether management or remote-access services are reachable;
- whether a supported patch or mitigation exists; and
- what testing would be required before applying a change.
Where equipment is out of support or cannot be safely patched, the vessel should consider stronger isolation, tighter management access or planned replacement.
The wider lesson
The report shows that specialist maritime equipment should not be assumed too obscure to attract attention.
Public CVE records and vendor advisories are easy to search, and AI can accelerate the process of finding and organising that information.
For ETOs, CTOs and engineering teams, this makes accurate asset and software inventories increasingly important. When a new advisory appears, the vessel should already know whether the affected equipment is onboard.
References
1. Anthropic — Detecting and countering misuse of AI: September 2026. Published 10 September 2026.
2. Cisco — Unified Communications Manager Static SSH Credentials Vulnerability, CVE-2025-20309.