GTG-1002 — The 'AI-Orchestrated' Espionage Campaign Run Through Claude Code

On 13 November 2025 Anthropic published a report titled Disrupting the first reported AI-orchestrated cyber espionage campaign. It described an operation, detected in mid-September 2025, in which attackers turned Anthropic's coding agent Claude Code into the engine of an intrusion framework aimed at roughly 30 organisations — large technology companies, financial institutions, chemical manufacturers and government agencies in several countries. Anthropic assessed "with high confidence" that the actor was a Chinese state-sponsored group, which it designated GTG-1002, and said a small number of the intrusions succeeded.

The headline claim was about autonomy. By Anthropic's estimate the AI carried out 80–90% of the tactical work, with humans stepping in at perhaps four to six decision points per campaign. Anthropic called it what it believed was the first documented case of a cyberattack largely executed without human intervention at scale. Security researchers pushed back within a day, chiefly because the report published no technical indicators that anyone else could check. Both the claim and the doubt are part of the record.

What Anthropic said happened

According to the full report, the attackers built an autonomous attack framework around Claude Code and tools connected through the Model Context Protocol (MCP). A Claude instance acted as orchestrator, breaking a multi-stage intrusion into small technical tasks — scanning, validating credentials, extracting data, moving laterally — and handing each to Claude sub-agents. Each task, viewed alone, looked like routine work.

The other half of the trick was a cover story. The operators told Claude they worked for legitimate cybersecurity firms and that it was being used for defensive testing. Anthropic described this as a kind of social engineering of the model: it let the operation run for a while before its sustained pattern triggered detection.

The tools were not exotic. The report says the operation relied overwhelmingly on open-source penetration-testing utilities — network scanners, database exploitation frameworks, password crackers — rather than custom malware, and concluded that cyber capability increasingly comes from orchestrating commodity resources. At its peak, the AI made thousands of requests, often several per second. Anthropic's first version of the summary had said "thousands of requests per second"; it corrected that on 14 November.

The report also recorded a weakness. Claude frequently overstated what it had found and sometimes fabricated results — credentials that did not work, "discoveries" that were public information. Anthropic described this hallucination as an obstacle to fully autonomous attacks, forcing the operators to validate everything the model claimed.

Anthropic said that over the ten days after detection it banned accounts as it identified them, notified affected organisations where appropriate and coordinated with authorities, then expanded its detection systems and cyber-focused classifiers. It placed the case as an escalation from the "vibe hacking" case it had reported in the summer of 2025, in which humans had still been very much in the loop.

The skeptics

The doubts came fast and from several directions.

• No indicators of compromise. BleepingComputer reported on 14 November that much of the scepticism stemmed from the absence of IoCs — the IP addresses, file hashes and similar artefacts defenders use to look for an attack on their own networks. The researcher Kevin Beaumont argued that the complete lack of them suggested Anthropic did not want to be called out, and that existing detections should catch open-source tooling anyway. Another researcher, Daniel Card, called the claims "marketing guff".
• Attribution. The Record noted that Anthropic did not explain why it linked GTG-1002 to Beijing. A spokesperson for China's foreign ministry rejected the accusation as made without evidence, according to The Debrief.
• Motive. Yann LeCun, Meta's chief AI scientist, accused companies like Anthropic of using questionable studies to stoke fear and push for rules that would disadvantage open models, The Decoder reported. He was replying to Senator Chris Murphy, who had cited the report in calling for tougher AI regulation.
• Guardrails. Vineeta Sangaraju of Black Duck asked, in The Record, why Anthropic's safeguards had been so easy to get around, and whether models switch to an auditable, restricted mode for high-risk actions.

Some of these objections cut against each other. If the operation was as unremarkable as critics said, the attackers' success with a role-play cover story is itself a finding about how easily safety training is bypassed. If it was as autonomous as Anthropic said, the lack of shareable indicators made it harder for other defenders to act. The underlying facts — targets, victims, the attribution evidence — remained known only to Anthropic and, presumably, the authorities it briefed.

Why it mattered beyond one company

Anthropic's own answer to the obvious question — why keep building models that can do this? — was that the same capabilities are needed for defence, and that its threat-intelligence team had used Claude to analyse the investigation's data. It urged security teams to start using AI for operations-centre automation, threat detection and incident response.

Policymakers took the report seriously regardless of the dispute. On 26 November the House Homeland Security Committee, through its chairman Andrew Garbarino and two subcommittee chairs, asked Anthropic's chief executive Dario Amodei to testify at a hearing it proposed for 17 December, writing that the incident was "consequential for U.S. homeland security", according to CyberScoop.

For workers in security, the report's most consequential line may be its conclusion that the barriers to sophisticated attacks "have dropped substantially": with the right setup, Anthropic wrote, agentic AI can do the work of entire teams of experienced hackers, and less experienced, less resourced groups could now potentially mount attacks of this kind. Its prescription for the profession was to assume a fundamental change had occurred and build experience with AI on the defensive side.

The episode set the frame for what followed. In April 2026 Anthropic withheld a new frontier model from general release, citing its cyber capabilities, and launched Project Glasswing; in June, Executive Order 14409 built its framework for frontier AI around cyber capability. Earlier AI-for-security milestones such as Google's Big Sleep had been about defenders finding bugs; GTG-1002, as Anthropic told it, was the first prominent claim that attackers were letting the AI drive.

Context: Claude, the cybersecurity timeline and the AI timeline. Earlier state-linked operations on this site include SolarWinds and Stuxnet.