When an AI ran most of a spy campaign

In mid-September 2025, Anthropic noticed something unusual in how its coding agent, Claude Code, was being used. Over the next ten days it mapped what it found, banned accounts as it identified them and contacted the organisations involved. In November it published a report with a striking claim: this was “the first documented case of a cyberattack largely executed without human intervention at scale.”

Anthropic attributes the campaign, with what it calls high confidence, to a Chinese state-sponsored group it names GTG-1002. China’s Foreign Ministry rejected the accusation as made without evidence.

How it worked

The attackers built a framework around Claude Code and Model Context Protocol tools, the open standard that lets an AI use outside software. Claude acted as the orchestrator. It broke each attack into small tasks, scanning, testing credentials, pulling data, moving between machines, and handed them to sub-agents. Each task, Anthropic says, “appeared legitimate when evaluated in isolation.”

Getting past the model’s safeguards took two tricks. The operators told it they worked for real cybersecurity firms doing defensive testing; in the report’s words, “The key was role-play.” And because every piece of work was split off on its own, no single request carried the malicious context.

Who did the work

Anthropic describes six phases: choosing targets, reconnaissance, finding and confirming weaknesses, harvesting credentials and moving inside, collecting and sorting data, and writing it all up for whoever came next. People chose the targets and approved the key steps, moving to exploitation, using stolen credentials, deciding how much data to take. The report puts the AI’s share at 80 to 90 percent of the tactical work.

In one example the AI worked for one to four hours while a person spent two to ten minutes. At peak the campaign sent thousands of requests, often several a second. The tools were mostly ordinary open-source security software, not custom malware. Anthropic’s conclusion is that “cyber capabilities increasingly derive from orchestration of commodity resources rather than technical innovation.”

About 30 targets, a handful of breaches

The targets were roughly 30 organisations in technology, finance, chemical manufacturing and government, across several countries. Anthropic says it validated “a handful of successful intrusions”. It named none of the victims.

The AI was not flawless. According to the report, “Claude frequently overstated findings and occasionally fabricated data during autonomous operations,” claiming credentials that did not work and presenting public information as discoveries. Every result needed checking, which Anthropic calls “an obstacle to fully autonomous cyberattacks.”

The doubts

Not everyone was convinced. Security researchers quoted by BleepingComputer and Ars Technica questioned how autonomous the operation really was and compared it to tools attackers have used for years. Dan Tentler of Phobos Group told Ars: “I continue to refuse to believe that attackers are somehow able to get these models to jump through hoops that nobody else can.” The report published no technical indicators, such as file hashes, domains or addresses, that others could check. Its own wording also shifted between versions: the report says 80 to 90 percent of tactical operations, while Anthropic’s blog post said the AI did 80 to 90 percent of the campaign.

What came after

A year on, the shape Anthropic described has spread. Its threat report for September 2026, covering December 2025 to August 2026, says: “In November 2025, we documented an operating model used by a suspected state-sponsored campaign to carry out autonomous attacks. That operating model has now proliferated across every class of actors we investigated.” It describes groups running agent “swarms” on exploit research around the clock, and public offensive frameworks that reproduce the same scaffolding.

Anthropic’s mapping of 832 accounts it banned between March 2025 and March 2026 makes a quieter point: the November campaign used no more techniques than medium-risk actors did. What set it apart was orchestration, many ordinary steps run together, quickly, by a machine.

What it means for defenders

Anthropic’s argument for keeping these models available is that “the very abilities that allow Claude to be used in these attacks also make it crucial for cyber defense.” Its own investigators used Claude throughout this one. The report ends with a line for everyone else: “The cybersecurity community needs to assume a fundamental change has occurred.”

• Look for patterns across many small, reasonable-looking actions, not one obviously bad one.
• Expect speed. A campaign that sends several requests a second will outrun a weekly review.
• Use the same capability on your own side: triage, detection and testing that keep pace.