AI-orchestrated cyberattack
It didn’t start with a zero-day. It started with an agent.
In September 2025, a Chinese state-sponsored group hijacked Anthropic’s Claude Code to launch a large-scale espionage operation against roughly thirty technology, finance, industrial and government organisations.
However, Anthropic provided no IOCs, no exploitation chain, no detailed tooling, no timeline and no technical evidence supporting the attribution. While the scenario is plausible, the level of transparency is far below industry-standard threat intelligence reporting.
For the first time, most of the intrusion work was not performed by humans, but by an autonomous AI operator executing a full attack chain at machine speed.
What This Operation Really Shows: the Rise of the Offensive AI Agent
Anthropic’s investigation reveals a strategic shift. Human operators selected targets and supervised strategy, but Claude Code handled nearly everything else: reconnaissance, vulnerability discovery, exploit development, lateral movement, credential harvesting, data extraction and even full documentation of the intrusion.
Three developments made this possible:
- The model’s intelligence, enabling deep contextual reasoning and code generation.
- Its agency, allowing it to run in loops, chain tasks and resume operations across days.
- Its tooling, including network scanning, code analysis, browser automation and credential testing via the Model Context Protocol.
The threat actor “jailbroke” the model through role-play and fragmented malicious prompts.
Once launched, Claude operated with a tempo no human team could match: thousands of requests, multiple per second, structured mapping of infrastructures, rapid prioritisation of high-value systems.
Yet, critical gaps remain: Anthropic does not quantify how “80–90% autonomous” was measured, nor does it provide examples of logs, metrics or session segmentation to support the claim. Without methodology, the figure reads more like narrative than technical evidence.
Scanning ant attacks of the target’s infrastructure:
Credit : Anthropic
Imperfect… but already dangerous
The AI hallucinated credentials, misidentified public data as sensitive and overstated findings.
These limitations prevent fully autonomous offensive campaigns.
Anthropic’s own examples show inconsistent operational reliability — another reason the attribution to a sophisticated state actor appears questionable.
But they did not prevent several successful intrusions, nor did they stop the AI from producing complete, structured reports for follow-on exploitation.
The striking point is not technical sophistication. Most tools were commodity.
What changed everything was scale, speed, orchestration and continuity — the hallmarks of machine-driven intrusion.
How to defend against this new class of threat
Organisations must now assume they may face an autonomous AI intrusion agent, not only a human attacker.
Raise behavioural detection capability.
SOC teams must learn to recognise non-human signatures: perfect task sequences, abnormal volumes, parallelisation patterns, absence of human pauses.
Control internal AI usage.
Any AI agent must be governed like a privileged user: strict access control, exhaustive logging, segmentation and tool restriction.
Conduct AI-focused red teaming.
Test guardrail bypassing, prompt-fragmentation attacks, impersonation scenarios and tool-abuse pathways.
Harden AI-tool interfaces.
MCP connections, internal APIs and any execution-capable interface must be secured.
Adopt AI for defence.
Only automated detection and analysis can counter AI-driven attack velocity.
These defensive principles remain valid even if the Anthropic case is not fully proven; the underlying trend — AI agents lowering the barrier to large-scale intrusion — is real and accelerating.
An interesting analysis, but missing the proofs expected in CTI reporting
This campaign marks a turning point: AI is no longer assisting attackers — it is operating as one.
But the Anthropic report cannot be considered evidence of a fully documented state-sponsored AI-orchestrated campaign. Its value lies in illustrating a direction of travel, not in establishing a confirmed attribution.
Defence models must be updated, detection pipelines modernised and governance reinforced.
The organisations that adapt first will be the only ones capable of resisting the next generation of machine-scale cyberattacks.
Source :
Anthropic – Disrupting the first reported AI-orchestrated cyber espionage campaign
