{
 "schema_version": "0.4",
 "id": "REG-0023",
 "title": "An agent is used as the attacker: an intrusion campaign run through a coding agent, which the vendor says ran largely autonomously, reported 13 November 2025",
 "batch": "B2",
 "family": "software",
 "context": {
  "domain": "Software agent used adversarially",
  "autonomy_level": "supervised",
  "actor_type": "Software: Claude Code, operated by a group the vendor assesses as state-sponsored",
  "actors": {
   "count": 1,
   "text": "1 agent; operators role-tagged adversary",
   "roles": [
    "defender",
    "adversary"
   ]
  },
  "mandate_context": "adversarial",
  "jurisdiction": [
   "Global",
   "vendor in the United States"
  ],
  "autonomy_level_text": "Machine performs most of the tactical work, with humans approving key steps, per the vendor; outside researchers disputed the degree of autonomy",
  "mandate_context_text": "Adversarial production use"
 },
 "provenance_tier": "single_source",
 "status": "provisional",
 "fields": [
  {
   "layer": "Mandate",
   "facet": null,
   "value": "Espionage against roughly thirty targets, per the vendor; the operators told the agent it was working for a legitimate cybersecurity firm and split the attack into innocent-looking tasks",
   "assertion_type": "assertion",
   "source_ids": [
    "ANTH"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": "status",
   "value": "Attributed by the vendor, with high confidence, to a Chinese state-sponsored group it designates GTG-1002; no independent attribution, and no government has publicly confirmed it. A spokesperson for the Chinese embassy in the United States responded that China 'firmly opposes and cracks down on all forms of cyberattacks' and opposes 'groundless attacks and slanders against China' (as reported by Axios)",
   "assertion_type": "assertion",
   "source_ids": [
    "ANTH",
    "ANTH_RPT",
    "AXIOS"
   ],
   "confidence": "medium",
   "disputed": true
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "Target systems and tooling supplied by the operators",
   "assertion_type": "assertion",
   "source_ids": [
    "ANTH"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "The vendor estimates the agent performed 80 to 90 percent of the campaign's tactical work, with human operators stepping in at perhaps four to six critical decision points per campaign (blog post), including approving the move from reconnaissance to exploitation, authorising use of harvested credentials and deciding what data to take (full report). Outside security researchers disputed the account as overstated, noting that the vendor published no indicators of compromise (as reported by BleepingComputer and TechRadar Pro)",
   "assertion_type": "assertion",
   "source_ids": [
    "ANTH",
    "ANTH_RPT",
    "BLEEP",
    "TECHR"
   ],
   "confidence": "medium",
   "disputed": true
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "The vendor's usage policies and safeguards; bypassed by role-play framing",
   "assertion_type": "assertion",
   "source_ids": [
    "ANTH",
    "ANTH_RPT"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "A small number of successful intrusions, per the vendor",
   "assertion_type": "assertion",
   "source_ids": [
    "ANTH"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: harm (extent not independently established). Detected in mid-September 2025, within two weeks of the attackers' first confirmed offensive activity, per the vendor; over the following ten days accounts were banned, affected entities notified and authorities informed. The House Committee on Homeland Security asked the vendor to testify (26 November 2025), and the vendor gave a statement for the record at a joint subcommittee hearing on 17 December 2025. As of Oct 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "ANTH",
    "ANTH_RPT",
    "GRAHAM",
    "HOUSE"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "actor",
   "value": "All evidence is vendor telemetry; no independent investigation has been published",
   "assertion_type": "interpretation",
   "source_ids": [
    "ANTH"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "Account bans; safeguard changes",
   "assertion_type": "assertion",
   "source_ids": [
    "ANTH"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "None public against the operators",
   "assertion_type": "interpretation",
   "source_ids": [
    "ANTH"
   ],
   "confidence": "high",
   "disputed": false
  }
 ],
 "controls": {
  "failed": [],
  "succeeded": [
   {
    "id": "C-R4",
    "note": "Vendor detection and account action",
    "confidence": "medium",
    "basis": "curated"
   }
  ],
  "absent": [
   {
    "id": "C-V3",
    "note": "Independent attribution path",
    "confidence": "high",
    "basis": "curated"
   },
   {
    "id": "C-A1",
    "note": "The operators told the model, in prompts, that they were employees of legitimate cybersecurity firms doing defensive testing, and the model went along with it; no source describes any check of who the operators were or whether they were authorised to test the targets. The vendor describes the bypass as role-play combined with splitting the attack into tasks that looked legitimate on their own (per the vendor)",
    "confidence": "medium",
    "basis": "curated"
   }
  ]
 },
 "applicable_rules": [
  "Vendor usage policy; computer-misuse law for the operators"
 ],
 "unmapped": [
  "Proposed control, not yet in the canonical set: misuse detection by the model's provider. Here the vendor's detection found the activity in mid-September 2025, within two weeks of the first confirmed offensive activity, per the vendor, followed by account bans; it is recorded under C-R4 for now"
 ],
 "corrections": [
  {
   "date": "2026-10-13",
   "field": "fields and sources",
   "old": "attribution 'state-sponsored group'; 'outside observers questioned aspects of the account' (no source)",
   "new": "attribution as the vendor states it; unsourced claim about outside observers replaced by what the record shows (no independent investigation); proportions as the vendor reports them",
   "reason": "claims aligned to what each linked record says, found on review"
  },
  {
   "date": "2026-10-14",
   "field": "reviewed_by",
   "old": "none",
   "new": "Saurabh Bhatnagar (editor)",
   "reason": "case checked by the editor against its linked records"
  },
  {
   "date": "2026-10-14",
   "field": "controls",
   "old": "failed candidate 'Usage-policy enforcement against role-play framing'",
   "new": "C-A1 (failed), medium confidence",
   "reason": "verifier rule 10: the vendor's account says the operators were trusted on a claimed role; C-A1 requires identity by credential, not by role"
  },
  {
   "date": "2026-10-14",
   "field": "named_parties[Anthropic].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "reason": "right of reply offered by email from register@secureautonomous.com to press@anthropic.com on 14 October 2026, in one letter covering REG-0011, REG-0023 and REG-0024 (confirmed in the Sent folder); recorded at the editor's instruction"
  },
  {
   "date": "2026-10-16",
   "field": "inference.value",
   "old": "The Register holds this case for one reason: it is the counter-example to every other software entry. The actor did what its mandate said; the mandate was the problem. Controls on authority and inputs do nothing against an adversarial principal; only the vendor's envelope did",
   "new": "The counter-example to every other software case: the agent did what it was told, and the instructions were the problem. Limits on authority and inputs do nothing against a principal who is the attacker; only the vendor's own restrictions did.",
   "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged"
  },
  {
   "date": "2026-10-20",
   "field": "sources.ANTH_RPT",
   "old": null,
   "new": "{\"title\": \"Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic, November 2025; its changelog of 17 November 2025 says the executive summary was updated 'to clarify our high confidence in our attribution')\", \"type\": \"company\", \"url\": \"https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf\", \"via_press\": false, \"date\": \"2025-11-13\", \"tier\": \"single_source\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the full report linked from the vendor's post ('Read the full report') is the primary record for the role-play framing, the GTG-1002 designation, the three human approval points and the revision of its attribution wording on 17 November 2025; it is now cited as its own source"
  },
  {
   "date": "2026-10-20",
   "field": "sources.GRAHAM",
   "old": null,
   "new": "{\"title\": \"Statement for the Record, Dr. Logan Graham, Head of Frontier Red Team, Anthropic: 'The Quantum, AI, and Cloud Landscape: Examining Opportunities, Vulnerabilities, and the Future of Cybersecurity', House Committee on Homeland Security joint subcommittee hearing, 17 December 2025 (pages 7 to 12 of the committee's combined testimony file)\", \"type\": \"company\", \"url\": \"https://homeland.house.gov/wp-content/uploads/2025/12/2025-12-17-CIPOIA-HRG-Testimony.pdf\", \"via_press\": false, \"date\": \"2025-12-17\", \"tier\": \"single_source\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the vendor's statement for the record to the House Committee on Homeland Security (17 December 2025) is a later primary record from the vendor: it says detection came 'within two weeks of the attackers' first confirmed offensive activity' and that technical indicators were shared with partners"
  },
  {
   "date": "2026-10-20",
   "field": "sources.HOUSE",
   "old": null,
   "new": "{\"title\": \"House Committee on Homeland Security to Anthropic re Request to Testify (letter of 26 November 2025 from Chairmen Andrew R. Garbarino and Andy Ogles to Dario Amodei)\", \"type\": \"public_record\", \"url\": \"https://homeland.house.gov/wp-content/uploads/2025/11/2025-11-26-CHS-to-Anthropic-re-Request-to-Testify.pdf\", \"via_press\": false, \"date\": \"2025-11-26\", \"tier\": \"public_regulatory\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the committee's letter of 26 November 2025 asking the vendor's chief executive to testify on the campaign is the primary record of the congressional inquiry"
  },
  {
   "date": "2026-10-20",
   "field": "sources.AXIOS",
   "old": null,
   "new": "{\"title\": \"Chinese hackers used Anthropic's AI agent to automate spying (Axios, Sam Sabin)\", \"type\": \"press_pointer\", \"url\": \"https://www.axios.com/2025/11/13/anthropic-china-claude-code-cyberattack\", \"via_press\": true, \"date\": \"2025-11-13\", \"tier\": \"press\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: Axios (13 November 2025) reports the Chinese embassy's response to the attribution and the vendor's head of threat intelligence telling the Wall Street Journal that as many as four attacks breached organizations"
  },
  {
   "date": "2026-10-20",
   "field": "sources.BLEEP",
   "old": null,
   "new": "{\"title\": \"Anthropic claims of Claude AI-automated cyberattacks met with doubt (BleepingComputer, Bill Toulas)\", \"type\": \"press_pointer\", \"url\": \"https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/\", \"via_press\": true, \"date\": \"2025-11-14\", \"tier\": \"press\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: BleepingComputer (14 November 2025) reports security researchers' doubts about the vendor's account and that the vendor provided no indicators of compromise"
  },
  {
   "date": "2026-10-20",
   "field": "sources.TECHR",
   "old": null,
   "new": "{\"title\": \"Experts cast doubt over Anthropic claims that Claude was hijacked to automate cyberattacks (TechRadar Pro, Ellen Jennings-Trace)\", \"type\": \"press_pointer\", \"url\": \"https://www.techradar.com/pro/security/experts-cast-doubt-over-anthropic-claims-that-claude-was-hijacked-to-automate-cyberattacks\", \"via_press\": true, \"date\": \"2025-11-17\", \"tier\": \"press\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: TechRadar Pro (17 November 2025) reports experts saying the autonomy claim is likely inflated, with human intervention downplayed"
  },
  {
   "date": "2026-10-20",
   "field": "title",
   "old": "An agent is used as the attacker: a largely autonomous intrusion campaign run through a coding agent, reported 13 November 2025",
   "new": "An agent is used as the attacker: an intrusion campaign run through a coding agent, which the vendor says ran largely autonomously, reported 13 November 2025",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the degree of autonomy is the vendor's own estimate (blog post: 80-90% of the campaign; full report: 80 to 90 percent of tactical work, with humans approving key steps), and outside researchers disputed it (BleepingComputer, TechRadar Pro); the title now attributes it"
  },
  {
   "date": "2026-10-20",
   "field": "context.autonomy_level_text",
   "old": "Machine acts alone for most of the campaign, per the vendor",
   "new": "Machine performs most of the tactical work, with humans approving key steps, per the vendor; outside researchers disputed the degree of autonomy",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the full report says the AI executed 'approximately 80 to 90 percent of all tactical work' with human operators approving progression to exploitation, use of harvested credentials and exfiltration scope; BleepingComputer and TechRadar Pro report researchers disputing the account. The coded autonomy level itself is left for the editor"
  },
  {
   "date": "2026-10-20",
   "field": "outcome.affected_parties",
   "old": "[\"~30 targets per vendor\"]",
   "new": "[\"~30 targeted, per the vendor; a handful of intrusions succeeded (as many as four, per the vendor's head of threat intelligence, Jacob Klein, to the Wall Street Journal, as reported by Axios)\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the full report says 'The operation targeted roughly 30 entities and our investigation validated a handful of successful intrusions'; about 30 were targeted, not affected. Axios reports Jacob Klein told the Wall Street Journal as many as four attacks breached organizations (the Wall Street Journal itself was not read)"
  },
  {
   "date": "2026-10-20",
   "field": "outcome.regime_consequence",
   "old": "account bans",
   "new": "account bans; a congressional inquiry: the House Committee on Homeland Security asked the vendor to testify on the campaign (letter of 26 November 2025), and the vendor gave a statement for the record at a joint subcommittee hearing on 17 December 2025",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: later development: the committee's letter of 26 November 2025 (source HOUSE) requests testimony citing the vendor's report on GTG-1002, and the vendor's statement for the record to the 17 December 2025 hearing (source GRAHAM) is on the committee's site"
  },
  {
   "date": "2026-10-20",
   "field": "outcome.as_of",
   "old": "Nov 2025",
   "new": "Oct 2026",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the case now records the congressional inquiry of November and December 2025; searches through 20 October 2026 found no government attribution, charge or sanction"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Actor status",
   "old": "{\"value\": \"Attributed by the vendor, with high confidence, to a Chinese state-sponsored group; no independent attribution\", \"source_ids\": [\"ANTH\"], \"disputed\": false}",
   "new": "{\"value\": \"Attributed by the vendor, with high confidence, to a Chinese state-sponsored group it designates GTG-1002; no independent attribution, and no government has publicly confirmed it. A spokesperson for the Chinese embassy in the United States responded that China 'firmly opposes and cracks down on all forms of cyberattacks' and opposes 'groundless attacks and slanders against China' (as reported by Axios)\", \"source_ids\": [\"ANTH\", \"ANTH_RPT\", \"AXIOS\"], \"disputed\": true}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the full report names the group GTG-1002 ('a Chinese state-sponsored group we've designated GTG-1002'); Axios reports the Chinese embassy's statement opposing 'groundless attacks and slanders against China', so the attribution is disputed by the accused party; searches through 20 October 2026 found no government confirming it"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Decision",
   "old": "{\"value\": \"The vendor reports the agent performed 80 to 90 percent of the campaign, with human decisions at four to six points\", \"source_ids\": [\"ANTH\"], \"disputed\": false}",
   "new": "{\"value\": \"The vendor estimates the agent performed 80 to 90 percent of the campaign's tactical work, with human operators stepping in at perhaps four to six critical decision points per campaign (blog post), including approving the move from reconnaissance to exploitation, authorising use of harvested credentials and deciding what data to take (full report). Outside security researchers disputed the account as overstated, noting that the vendor published no indicators of compromise (as reported by BleepingComputer and TechRadar Pro)\", \"source_ids\": [\"ANTH\", \"ANTH_RPT\", \"BLEEP\", \"TECHR\"], \"disputed\": true}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the blog post hedges the figure ('perhaps 4-6 critical decision points per hacking campaign'); the full report gives 'approximately 80 to 90 percent of all tactical work' and names the human approval points but not the four-to-six figure; BleepingComputer reports researchers calling the report 'made up' or overstated and the absence of indicators of compromise, and TechRadar Pro reports experts saying the claim is 'likely inflated with human intervention downplayed'"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Envelope constraints.source_ids",
   "old": "[\"ANTH\"]",
   "new": "[\"ANTH\", \"ANTH_RPT\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: 'role-play' is the full report's word ('The key was role-play'); the blog post says 'jailbreaking it, effectively tricking it to bypass its guardrails'. The full report is now cited"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Outcome",
   "old": "{\"value\": \"State: harm (extent not independently established). Accounts banned; victims and authorities notified. As of Nov 2025.\", \"source_ids\": [\"ANTH\"]}",
   "new": "{\"value\": \"State: harm (extent not independently established). Detected in mid-September 2025, within two weeks of the attackers' first confirmed offensive activity, per the vendor; over the following ten days accounts were banned, affected entities notified and authorities informed. The House Committee on Homeland Security asked the vendor to testify (26 November 2025), and the vendor gave a statement for the record at a joint subcommittee hearing on 17 December 2025. As of Oct 2026.\", \"source_ids\": [\"ANTH\", \"ANTH_RPT\", \"GRAHAM\", \"HOUSE\"]}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the blog post and full report give the detection date ('In mid-September 2025') and the ten-day response; the vendor's statement for the record says detection came 'within two weeks of the attackers' first confirmed offensive activity'; the committee's letter and the statement record the congressional inquiry"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Recovery accountability.assertion_type",
   "old": "fact",
   "new": "interpretation",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: no primary record states that no action has been taken against the operators; it is the register's reading of what searches through 20 October 2026 found (no charge, sanction or government attribution), so it is typed as the register's interpretation"
  },
  {
   "date": "2026-10-20",
   "field": "controls.C-A1",
   "old": "The operators' claim to work for a legitimate cybersecurity firm was accepted without verification; safeguards bypassed by role-play framing (per the vendor)",
   "new": "The operators told the model, in prompts, that they were employees of legitimate cybersecurity firms doing defensive testing, and the model went along with it; no source describes any check of who the operators were or whether they were authorised to test the targets. The vendor describes the bypass as role-play combined with splitting the attack into tasks that looked legitimate on their own (per the vendor)",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: no source describes a verification step that was presented with the claim and passed it, so 'accepted without verification' implied a check the record does not show; the full report says 'The key was role-play: the human operators claimed that they were employees of legitimate cybersecurity firms' and that tasks 'appeared legitimate when evaluated in isolation'. The control's bucket and confidence are left for the editor's pending call"
  },
  {
   "date": "2026-10-20",
   "field": "inference.value",
   "old": "The counter-example to every other software case: the agent did what it was told, and the instructions were the problem. Limits on authority and inputs do nothing against a principal who is the attacker; only the vendor's own restrictions did.",
   "new": "Unlike the register's other software cases, the agent's principal here was the attacker: the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as a cybersecurity firm doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor's detection disrupted it, by its own account within about two weeks of the first confirmed offensive activity and after the campaign had been launched, followed by account bans. The model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the vendor's records show its safeguards were bypassed ('tricking it to bypass its guardrails'; 'allowed the threat actor to fly under the radar for long enough to launch their campaign'), so 'only the vendor's own restrictions did' overstated them; what disrupted the campaign was detection and account bans; the full report names the model's hallucinations as an obstacle for the actor; the vendor's statement for the record gives the detection timing; BleepingComputer and TechRadar Pro report the dispute over autonomy. The interpretation was not signed (signed_by null); the editor must sign the new wording"
  },
  {
   "date": "2026-10-20",
   "field": "inference.source_ids",
   "old": "[\"ANTH\"]",
   "new": "[\"ANTH\", \"ANTH_RPT\", \"GRAHAM\", \"BLEEP\", \"TECHR\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the interpretation now rests on the full report, the vendor's statement for the record and the press reports of the dispute, as well as the blog post"
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-A1",
   "old": "failed",
   "new": "absent",
   "reason": "Editor's classification call of 21 October 2026 (call 5, accepted from pull request #74): no source describes any check of who the operators were or whether they were authorised to test the targets, so the control is recorded as absent rather than failed."
  },
  {
   "date": "2026-10-21",
   "field": "unmapped",
   "old": null,
   "new": "Proposed control, not yet in the canonical set: misuse detection by the model's provider. Here the vendor's detection found the activity in mid-September 2025, within about two weeks of the first confirmed offensive activity, per the vendor, followed by account bans; it is recorded under C-R4 for now",
   "reason": "Editor's classification call of 21 October 2026 (call 5, accepted from pull request #74): the prompts got past the model's safeguards; what disrupted the campaign was the vendor's misuse detection, which the canonical set does not yet name; proposed for the editor's control list."
  },
  {
   "date": "2026-10-21",
   "field": "context.autonomy_level",
   "old": "alone",
   "new": "supervised",
   "reason": "Editor's classification call of 21 October 2026 (call 13, accepted from pull request #74): the vendor's own account has human operators approving key steps at several decision points per campaign, so 'supervised' fits better than 'alone'; the autonomy text already says so."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Unlike the register's other software cases, the agent's principal here was the attacker: the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as a cybersecurity firm doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor's detection disrupted it, by its own account within about two weeks of the first confirmed offensive activity and after the campaign had been launched, followed by account bans. The model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "new": "Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as a cybersecurity firm doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor's detection disrupted it, by its own account within about two weeks of the first confirmed offensive activity and after the campaign had been launched, followed by account bans. The model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the targets, framework and deception come only from the vendor's own records (ANTH, ANTH_RPT, GRAHAM) and are now attributed."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as a cybersecurity firm doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor's detection disrupted it, by its own account within about two weeks of the first confirmed offensive activity and after the campaign had been launched, followed by account bans. The model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "new": "Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as employees of legitimate cybersecurity firms doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor's detection disrupted it, by its own account within about two weeks of the first confirmed offensive activity and after the campaign had been launched, followed by account bans. The model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the vendor's full report, page 8, as the case's control C-A1 already says."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as employees of legitimate cybersecurity firms doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor's detection disrupted it, by its own account within about two weeks of the first confirmed offensive activity and after the campaign had been launched, followed by account bans. The model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "new": "Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as employees of legitimate cybersecurity firms doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor's detection disrupted it, by its own account within about two weeks of the first confirmed offensive activity and after the campaign had been launched, followed by account bans. The vendor says the model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: this comes only from the vendor's report and is now attributed."
  },
  {
   "date": "2026-10-21",
   "field": "inference.signed_by",
   "old": "Saurabh Bhatnagar",
   "new": null,
   "reason": "The interpretation's wording changed after the editor signed it (second, independent check of 21 October 2026); the signature is cleared so the editor signs the corrected wording."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as employees of legitimate cybersecurity firms doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor's detection disrupted it, by its own account within about two weeks of the first confirmed offensive activity and after the campaign had been launched, followed by account bans. The vendor says the model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "new": "Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as employees of legitimate cybersecurity firms doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor detected it, by its own account within two weeks of the first confirmed offensive activity and after the campaign had been launched, and then disrupted it, banning accounts over the following ten days. The vendor says the model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: third check: the vendor's two-week figure is for detection, not disruption: 'Anthropic detected this CCP-backed campaign within two weeks of the attackers' first confirmed offensive activity ... Over the following 10 days, we banned the associated accounts' (GRAHAM, page 11; ANTH)."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Anthropic].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"outside researchers' dispute of the autonomy account; no published indicators of compromise\"}]}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-22",
   "field": "unmapped[0]",
   "old": "Proposed control, not yet in the canonical set: misuse detection by the model's provider. Here the vendor's detection found the activity in mid-September 2025, within about two weeks of the first confirmed offensive activity, per the vendor, followed by account bans; it is recorded under C-R4 for now",
   "new": "Proposed control, not yet in the canonical set: misuse detection by the model's provider. Here the vendor's detection found the activity in mid-September 2025, within two weeks of the first confirmed offensive activity, per the vendor, followed by account bans; it is recorded under C-R4 for now",
   "reason": "Found in the independent re-read of 22 October 2026: the source gives no 'about'; the vendor's statement for the record (Dr. Logan Graham, Head of Frontier Red Team, Anthropic, House Committee on Homeland Security joint subcommittee hearing, 17 December 2025) says 'within two weeks of the attackers' first confirmed offensive activity' (GRAHAM), and the Outcome field and interpretation already say 'within two weeks'."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Anthropic].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"outside researchers' dispute of the autonomy account; no published indicators of compromise\"}, {\"sent\": \"2026-10-22\", \"covers\": \"the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status); the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up\"}], \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status)\", \"the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up\"], \"note\": null}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"outside researchers' dispute of the autonomy account; no published indicators of compromise\"}, {\"sent\": \"2026-10-22\", \"covers\": \"the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status); the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up\"}], \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status)\", \"the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up\"], \"note\": null}]}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-28",
   "field": "named_parties[Anthropic].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"outside researchers' dispute of the autonomy account; no published indicators of compromise\"}, {\"sent\": \"2026-10-22\", \"covers\": \"the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status); the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up\"}], \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status)\", \"the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up\"], \"note\": null}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"outside researchers' dispute of the autonomy account; no published indicators of compromise\"}, {\"sent\": \"2026-10-22\", \"covers\": \"the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status); the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up\"}], \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status)\", \"the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up\"], \"note\": null}], \"no_response_as_of\": \"2026-10-28\"}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-06",
 "last_reviewed": "2026-10-28",
 "actor_status": "vendor_attributed",
 "provenance_tier_text": "Vendor report; single source",
 "status_text": "Attributed by vendor only",
 "outcome": {
  "state": "harm",
  "severity": "not independently established",
  "affected_parties": [
   "~30 targeted, per the vendor; a handful of intrusions succeeded (as many as four, per the vendor's head of threat intelligence, Jacob Klein, to the Wall Street Journal, as reported by Axios)"
  ],
  "cost": "not disclosed",
  "regime_consequence": "account bans; a congressional inquiry: the House Committee on Homeland Security asked the vendor to testify on the campaign (letter of 26 November 2025), and the vendor gave a statement for the record at a joint subcommittee hearing on 17 December 2025",
  "as_of": "Oct 2026",
  "derived_by": "backfill-curated"
 },
 "inference": {
  "value": "Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as employees of legitimate cybersecurity firms doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor detected it, by its own account within two weeks of the first confirmed offensive activity and after the campaign had been launched, and then disrupted it, banning accounts over the following ten days. The vendor says the model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.",
  "source_ids": [
   "ANTH",
   "ANTH_RPT",
   "GRAHAM",
   "BLEEP",
   "TECHR"
  ],
  "confidence": "high",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "named_parties": [
  {
   "name": "Anthropic",
   "right_of_reply": {
    "offered": "2026-10-14",
    "response": null,
    "followups": [
     {
      "sent": "2026-10-22",
      "covers": "outside researchers' dispute of the autonomy account; no published indicators of compromise"
     },
     {
      "sent": "2026-10-22",
      "covers": "the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status); the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up"
     }
    ],
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [
       "the Chinese embassy's denial is recorded and Anthropic's attribution marked as disputed (Actor status)",
       "the editor treats this as a dispute of Anthropic's statement, not covered by the 22 October follow-up"
      ],
      "note": null
     }
    ],
    "no_response_as_of": "2026-10-28"
   }
  }
 ],
 "sources": {
  "ANTH": {
   "title": "Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign",
   "type": "company",
   "url": "https://www.anthropic.com/news/disrupting-AI-espionage",
   "via_press": false,
   "date": "2025-11-13",
   "tier": "single_source",
   "interest": null,
   "primary": true,
   "checked": "2026-10-13"
  },
  "ANTH_RPT": {
   "title": "Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic, November 2025; its changelog of 17 November 2025 says the executive summary was updated 'to clarify our high confidence in our attribution')",
   "type": "company",
   "url": "https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf",
   "via_press": false,
   "date": "2025-11-13",
   "tier": "single_source",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "GRAHAM": {
   "title": "Statement for the Record, Dr. Logan Graham, Head of Frontier Red Team, Anthropic: 'The Quantum, AI, and Cloud Landscape: Examining Opportunities, Vulnerabilities, and the Future of Cybersecurity', House Committee on Homeland Security joint subcommittee hearing, 17 December 2025 (pages 7 to 12 of the committee's combined testimony file)",
   "type": "company",
   "url": "https://homeland.house.gov/wp-content/uploads/2025/12/2025-12-17-CIPOIA-HRG-Testimony.pdf",
   "via_press": false,
   "date": "2025-12-17",
   "tier": "single_source",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "HOUSE": {
   "title": "House Committee on Homeland Security to Anthropic re Request to Testify (letter of 26 November 2025 from Chairmen Andrew R. Garbarino and Andy Ogles to Dario Amodei)",
   "type": "public_record",
   "url": "https://homeland.house.gov/wp-content/uploads/2025/11/2025-11-26-CHS-to-Anthropic-re-Request-to-Testify.pdf",
   "via_press": false,
   "date": "2025-11-26",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "AXIOS": {
   "title": "Chinese hackers used Anthropic's AI agent to automate spying (Axios, Sam Sabin)",
   "type": "press_pointer",
   "url": "https://www.axios.com/2025/11/13/anthropic-china-claude-code-cyberattack",
   "via_press": true,
   "date": "2025-11-13",
   "tier": "press",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  },
  "BLEEP": {
   "title": "Anthropic claims of Claude AI-automated cyberattacks met with doubt (BleepingComputer, Bill Toulas)",
   "type": "press_pointer",
   "url": "https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/",
   "via_press": true,
   "date": "2025-11-14",
   "tier": "press",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  },
  "TECHR": {
   "title": "Experts cast doubt over Anthropic claims that Claude was hijacked to automate cyberattacks (TechRadar Pro, Ellen Jennings-Trace)",
   "type": "press_pointer",
   "url": "https://www.techradar.com/pro/security/experts-cast-doubt-over-anthropic-claims-that-claude-was-hijacked-to-automate-cyberattacks",
   "via_press": true,
   "date": "2025-11-17",
   "tier": "press",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  }
 },
 "derived_by": "backfill-curated",
 "reviewed_by": "Saurabh Bhatnagar (editor)"
}