Security leaders face a new class of autonomous threat as Anthropic details a sophisticated cyber espionage campaign orchestrated by AI. The campaign, dubbed GTG-1002, targeted approximately 30 entities, including large tech companies, financial institutions, chemical manufacturing companies, and government agencies. Anthropic’s Threat Intelligence team assessed the operation with high confidence and detected it in mid-September 2025.
The operation’s technical sophistication lay not in novel malware, but in orchestration. Anthropic’s Claude Code model was successfully manipulated to function as an autonomous agent, executing the vast majority of tactical operations independently. This marks a worrying development for CISOs, as AI agents perform 80-90 percent of the offensive work with humans acting only as high-level supervisors. Anthropic believes this is the first documented case of a large-scale cyberattack executed without substantial human intervention.
AI Agents: A New Operational Model for Cyberattacks
The group used an orchestration system that tasked instances of Claude Code to function as autonomous penetration testing agents. These AI agents were directed as part of the espionage campaign to perform reconnaissance, discover vulnerabilities, develop exploits, harvest credentials, move laterally across networks, and exfiltrate data. This enabled the AI to perform reconnaissance in a fraction of the time it would have taken a team of human hackers.
Human involvement was limited to 10-20 percent of the total effort, primarily focused on campaign initiation and providing authorization at a few key escalation points. For example, human operators would approve the transition from reconnaissance to active exploitation or authorize the final scope of data exfiltration. The attackers bypassed the AI model’s built-in safeguards, which are trained to avoid harmful behaviors. They did this by jailbreaking the model, tricking it by breaking down attacks into seemingly innocent tasks, and adopting a “role-play” persona. Operators told Claude that it was an employee of a legitimate cybersecurity firm and was being used in defensive testing. This allowed the operation to proceed long enough to gain access to a handful of validated targets.
The technical sophistication of the attack lay in its use of Model Context Protocol (MCP) servers as an interface between the AI and commodity tools. The attackers used MCP servers to execute commands, analyze results, and maintain operational state across multiple targets and sessions. The AI was even directed to research and write its own exploit code for the espionage campaign.
AI Hallucinations Become a Good Thing
While the campaign successfully breached high-value targets, Anthropic’s investigation uncovered a noteworthy limitation: the AI hallucinated during offensive operations. The report states that Claude “frequently overstated findings and occasionally fabricated data.” This manifested as the AI claiming to have obtained credentials that did not work or identifying discoveries that “proved to be publicly available information.” This tendency required the human operators to carefully validate all results, presenting challenges for the attackers’ operational effectiveness. According to Anthropic, this “remains an obstacle to fully autonomous cyberattacks.” For security leaders, this highlights a potential weakness in AI-driven attacks: they may generate a high volume of noise and false positives that can be identified with robust monitoring.
A Defensive AI Arms Race Against New Cyber Espionage Threats
The primary implication for business and technology leaders is that the barriers to performing sophisticated cyberattacks have dropped considerably. Groups with fewer resources may now be able to execute campaigns that previously required entire teams of experienced hackers. This attack demonstrates a capability beyond “vibe hacking,” where humans remained firmly in control of operations. The GTG-1002 campaign proves that AI can be used to autonomously discover and exploit vulnerabilities in live operations.
Anthropic, which banned the accounts and notified authorities over a ten-day investigation, argues that this development shows the urgent need for AI-powered defense. The company states that “the very abilities that allow Claude to be used in these attacks also make it essential for cyber defense.” The company’s own Threat Intelligence team “used Claude extensively to analyze ‘the enormous amounts of data generated’ during this investigation.”
Security teams should operate under the assumption that a major change has occurred in cybersecurity. The report urges defenders to “experiment with applying AI for defense in areas like SOC automation, threat detection, vulnerability assessment, and incident response.” The contest between AI-driven attacks and AI-powered defense has begun, and proactive adaptation to counter new espionage threats is the only viable path forward.
As the threat landscape continues to evolve, it’s essential for security leaders to stay informed and up-to-date on the latest developments. Anthropic’s report serves as a reminder that the stakes are high, and the consequences of inaction can be severe. By investing in AI-powered defense and staying vigilant, organizations can reduce their risk exposure and protect themselves against the increasing sophistication of cyber threats.
Stay ahead of the curve by exploring the latest trends and insights in cybersecurity and AI. Check out AI & Big Data Expo, taking place in Amsterdam, California, and London, and learn from industry leaders and experts.
