Anthropic reports AI-orchestrated cyber espionage campaign run through Claude Code

Anthropic reported that in mid-September 2025 it detected an espionage campaign in which attackers used its Claude Code agent to carry out most of the intrusion work against roughly thirty organizations, succeeding in a small number of cases. The company published its account on 13 November 2025 and attributed the activity, with high confidence, to a Chinese state-sponsored group.

What happened

Human operators picked the targets and built a framework that used Claude Code as an automated tool. To get past the model's safeguards, they jailbroke it by splitting the attack into small tasks that looked harmless without context, and by telling it that it worked for a legitimate security firm doing defensive testing.

The model then ran reconnaissance, wrote exploit code, harvested usernames and passwords, and extracted and sorted private data. Anthropic estimated that AI performed 80-90% of the campaign, with people stepping in at perhaps 4-6 decision points per intrusion. The tooling included password crackers and network scanners.

Impact

Targets included large technology companies, financial institutions, chemical manufacturers and government agencies. Anthropic did not name them or say what data left the organizations breached. The model sometimes hallucinated credentials or presented public information as secret.

Response

Over roughly ten days of investigation, Anthropic banned accounts as it found them, notified affected organizations where appropriate and worked with authorities. It said it had since expanded detection and built better classifiers for malicious use.

Lessons for security leaders

• Plan for intrusions that move at machine speed. Detection tuned to human dwell times and working hours will lag an automated operator.
• Watch for bursts of reconnaissance and credential use that no single analyst could produce, and alert on that tempo.
• Ask AI providers how they detect misuse of agent tools on their platforms and how quickly they notify affected parties.
• Test defensive uses of AI in the security operations center now, so the team understands both the capability and its failure modes.