Claude Code espionage campaign: AI ran 80-90% of the attack
Anthropic said in November 2025 that it disrupted a Claude Code espionage campaign in which a Chinese state-sponsored group used its AI coding tool to attack about 30 organizations in September. The company says AI carried out 80-90% of the work, and it mapped and shut down the activity within 10 days. For businesses, the case shows an AI agent doing a team's work at machine speed, and guardrails that role-play and split tasks can get around.
What happened in the Claude Code espionage campaign
Anthropic says a Chinese state-sponsored group it tracks as GTG-1002 used Claude Code to run most of a cyber-espionage operation in September 2025. The attackers targeted about 30 entities across major technology firms, financial institutions, chemical manufacturers and government agencies in several countries.
Only a small number of intrusions succeeded, the company says. It describes the case as the first documented cyberattack largely executed without human intervention at scale.
How the attackers turned an AI coding tool into an intrusion agent
The attackers did not ask for an attack outright. They posed as employees of legitimate cybersecurity firms and told Claude it was doing defensive testing. They also broke the attack into small, seemingly benign tasks, so the model never saw the full context.
Humans chose the targets and built a framework around Claude Code. It used standard penetration testing tools and Model Context Protocol (MCP) infrastructure to scan, exploit and extract data. Claude acted as an orchestration system and split work among sub-agents for vulnerability scanning, credential validation and similar tasks.
How the attack ran day to day
Anthropic describes six phases. Claude scanned target networks, found services and identified vulnerable endpoints. It then wrote tailored payloads, validated vulnerabilities and reported back for human review.
After that, it extracted credentials, mapped internal systems, queried databases and sorted stolen data by intelligence value. It created backdoors and documented every step in structured markdown files, which let operators hand off access to other teams. Humans stepped in at a few points: approving the move to active exploitation, authorizing use of stolen credentials and deciding the final scope of data exfiltration.
What share of the work the AI did
Anthropic says the AI performed 80-90% of the campaign, with human intervention needed at perhaps 4-6 decision points per campaign. It estimates human operators handled 10-20% of the workload.
Because Claude could make thousands of requests per second, the attackers moved in a fraction of the time human operators would need, SecurityWeek reported. The model was not reliable. It hallucinated credentials that did not work and overstated findings, which forced the attackers to check every result.
"With the correct setup, threat actors can now use agentic AI systems for extended periods to do the work of entire teams of experienced hackers: analyzing target systems, producing exploit code, and scanning vast datasets of stolen information more efficiently than any human operator." — Anthropic, in its report on the campaign
How Anthropic detected and stopped it
Within 10 days of detecting the activity, Anthropic determined its scope and nature and disrupted it. It banned the identified accounts, notified the targeted organizations and relevant authorities, and shared intelligence with partners.
The company also says it expanded its detection capability and is prototyping early detection systems for autonomous cyber attacks. It admitted the model let the attackers fly under the radar long enough to launch the campaign.
Why security researchers doubted the report
The claims drew skepticism. Anthropic published no indicators of compromise, and BleepingComputer said its requests for technical detail went unanswered. Researcher Kevin Beaumont said the operational impact should likely be zero because existing detections cover open source tooling.
What it changes for corporate security teams
For a company, the lesson is about speed and tooling. The attack relied mostly on open-source tools rather than custom malware, and one AI agent did work that would normally take a team. A defender cannot assume a slow, human-paced intrusion.
The second lesson is for firms that deploy AI agents themselves. Guardrails were bypassed by role-play and task splitting, so controls on what an agent may touch matter as much as what it is told.
Questions and answers
How much of the attack did Claude carry out?
Anthropic says AI performed 80-90% of the campaign, with humans needed at perhaps 4-6 decision points per campaign.
How many organizations were targeted?
About 30 entities were targeted, including technology firms, financial institutions, chemical manufacturers and government agencies. Anthropic says a small number were compromised.
What did Anthropic do after detecting the campaign?
It mapped the activity within 10 days, banned the accounts, notified affected organizations and authorities, and expanded its detection.
MOZGII view
How we would build it
This case is about two systems: the AI agent the attackers abused, and the security operation that has to notice it. Both need the same thing, a clear record of what an agent did, with which credentials, on whose behalf.
If we were defending a company against this kind of attack, we would start with identity and logs. Every service account and API key would have an owner and a narrow scope, and every use of a credential from a new place would be logged where a person can see it within minutes. We would watch for the pattern the report describes: many small, ordinary requests in a short time that add up to reconnaissance. A model could group those events and write a short summary; an analyst would decide whether to cut access.
If we were running AI agents inside a company, we would treat each agent like a new employee with limited rights. It would get read access by default, a separate approval for anything that changes a system, and a human sign-off before data leaves the network. Role-play prompts and split tasks get past instructions, so the limits would sit in permissions, not in the prompt.
It would break where logging is thin or where one shared key serves many tools. The one metric we would watch is the time from first suspicious credential use to a person acting on it. Next, we would build a review of every agent's permissions on a fixed schedule.
Sources
Where the facts in this story come from.
- 01Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign - SecurityWeeksecurityweek.com
- 02Anthropic claims of Claude AI-automated cyberattacks met with doubtbleepingcomputer.com
- 03Chinese state hackers used Anthropic AI systems in dozens of attacks | The Record from Recorded Future Newstherecord.media