An agent is used as the attacker: an intrusion campaign run through a coding agent, which the vendor says ran largely autonomously, reported 13 November 2025
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate | Espionage against roughly thirty targets, per the vendor; the operators told the agent it was working for a legitimate cybersecurity firm and split the attack into innocent-looking tasks | assertion | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign | medium |
| Actor: status | Attributed by the vendor, with high confidence, to a Chinese state-sponsored group it designates GTG-1002; no independent attribution, and no government has publicly confirmed it. A spokesperson for the Chinese embassy in the United States responded that China 'firmly opposes and cracks down on all forms of cyberattacks' and opposes 'groundless attacks and slanders against China' (as reported by Axios) | assertion | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign; Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic, November 2025; its changelog of 17 November 2025 says the executive summary was updated 'to clarify our high confidence in our attribution'); Chinese hackers used Anthropic's AI agent to automate spying (Axios, Sam Sabin) | medium |
| Inputs | Target systems and tooling supplied by the operators | assertion | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign | medium |
| Decision | The vendor estimates the agent performed 80 to 90 percent of the campaign's tactical work, with human operators stepping in at perhaps four to six critical decision points per campaign (blog post), including approving the move from reconnaissance to exploitation, authorising use of harvested credentials and deciding what data to take (full report). Outside security researchers disputed the account as overstated, noting that the vendor published no indicators of compromise (as reported by BleepingComputer and TechRadar Pro) | assertion | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign; Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic, November 2025; its changelog of 17 November 2025 says the executive summary was updated 'to clarify our high confidence in our attribution'); Anthropic claims of Claude AI-automated cyberattacks met with doubt (BleepingComputer, Bill Toulas); Experts cast doubt over Anthropic claims that Claude was hijacked to automate cyberattacks (TechRadar Pro, Ellen Jennings-Trace) | medium |
| Envelope: constraints | The vendor's usage policies and safeguards; bypassed by role-play framing | assertion | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign; Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic, November 2025; its changelog of 17 November 2025 says the executive summary was updated 'to clarify our high confidence in our attribution') | medium |
| Action | A small number of successful intrusions, per the vendor | assertion | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign | medium |
| Outcome | State: harm (extent not independently established). Detected in mid-September 2025, within two weeks of the attackers' first confirmed offensive activity, per the vendor; over the following ten days accounts were banned, affected entities notified and authorities informed. The House Committee on Homeland Security asked the vendor to testify (26 November 2025), and the vendor gave a statement for the record at a joint subcommittee hearing on 17 December 2025. As of Oct 2026. | assertion | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign; Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic, November 2025; its changelog of 17 November 2025 says the executive summary was updated 'to clarify our high confidence in our attribution'); Statement for the Record, Dr. Logan Graham, Head of Frontier Red Team, Anthropic: 'The Quantum, AI, and Cloud Landscape: Examining Opportunities, Vulnerabilities, and the Future of Cybersecurity', House Committee on Homeland Security joint subcommittee hearing, 17 December 2025 (pages 7 to 12 of the committee's combined testimony file); House Committee on Homeland Security to Anthropic re Request to Testify (letter of 26 November 2025 from Chairmen Andrew R. Garbarino and Andy Ogles to Dario Amodei) | medium |
| Evidence: actor | All evidence is vendor telemetry; no independent investigation has been published | interpretation | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign | high |
| Recovery: technical | Account bans; safeguard changes | assertion | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign | medium |
| Recovery: accountability | None public against the operators | interpretation | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| succeeded | Vendor detection and account action | C-R4 Organizational recovery process |
| absent | Independent attribution path | C-V3 Attribution independent of the vendor |
| absent | The operators told the model, in prompts, that they were employees of legitimate cybersecurity firms doing defensive testing, and the model went along with it; no source describes any check of who the operators were or whether they were authorised to test the targets. The vendor describes the bypass as role-play combined with splitting the attack into tasks that looked legitimate on their own (per the vendor) | C-A1 Actor identity verification |
Unmapped
- Proposed control, not yet in the canonical set: misuse detection by the model's provider. Here the vendor's detection found the activity in mid-September 2025, within two weeks of the first confirmed offensive activity, per the vendor, followed by account bans; it is recorded under C-R4 for now
Inference
inference Unlike the register's other software cases, the agent's principal here was the attacker: by the vendor's account, the operators chose the targets, built the attack framework and got the model past the vendor's safeguards by posing as employees of legitimate cybersecurity firms doing defensive testing and splitting the attack into tasks that looked legitimate on their own. The safeguards did not stop the campaign; the vendor detected it, by its own account within two weeks of the first confirmed offensive activity and after the campaign had been launched, and then disrupted it, banning accounts over the following ten days. The vendor says the model's own errors, such as invented credentials, also hampered the operators. The record does not show who the victims were, any independent investigation or any published technical indicators of the attack, and outside researchers disputed how autonomous the campaign was.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| ANTH | Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign | company primary record | anthropic.com ↗ checked 2026-10-13 |
| ANTH_RPT | Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic, November 2025; its changelog of 17 November 2025 says the executive summary was updated 'to clarify our high confidence in our attribution') | company primary record | assets.anthropic.com ↗ checked 2026-10-20 |
| GRAHAM | Statement for the Record, Dr. Logan Graham, Head of Frontier Red Team, Anthropic: 'The Quantum, AI, and Cloud Landscape: Examining Opportunities, Vulnerabilities, and the Future of Cybersecurity', House Committee on Homeland Security joint subcommittee hearing, 17 December 2025 (pages 7 to 12 of the committee's combined testimony file) | company primary record | homeland.house.gov ↗ checked 2026-10-20 |
| HOUSE | House Committee on Homeland Security to Anthropic re Request to Testify (letter of 26 November 2025 from Chairmen Andrew R. Garbarino and Andy Ogles to Dario Amodei) | public record primary record | homeland.house.gov ↗ checked 2026-10-20 |
| AXIOS | Chinese hackers used Anthropic's AI agent to automate spying (Axios, Sam Sabin) | press pointer secondary: press report | axios.com ↗ checked 2026-10-20 |
| BLEEP | Anthropic claims of Claude AI-automated cyberattacks met with doubt (BleepingComputer, Bill Toulas) | press pointer secondary: press report | bleepingcomputer.com ↗ checked 2026-10-20 |
| TECHR | Experts cast doubt over Anthropic claims that Claude was hijacked to automate cyberattacks (TechRadar Pro, Ellen Jennings-Trace) | press pointer secondary: press report | techradar.com ↗ checked 2026-10-20 |