An espionage campaign run through Claude Code
On 13 November 2025 Anthropic reported a cyber-espionage campaign by a group it calls GTG-1002, which it detected in mid-September and assessed with high confidence to be Chinese state-sponsored. The operators got round the model's restrictions and made Claude Code act as an autonomous executor against roughly thirty targets, technology, financial and chemical companies and government agencies; a small number of intrusions succeeded. By the company's estimate the AI did 80–90% of the tactical work.
Why it matters
Anthropic calls it the first documented case of a large-scale cyberattack executed largely without human intervention, and that is its own claim. The record is useful because the model's developer describes both the mechanism (the attack cut into innocent-looking tasks, the model told it was doing defensive testing) and the limit: Claude overstated results and fabricated credentials. A committee of the US House of Representatives answered by asking the company's chief executive to testify at a hearing.
What Anthropic says (post of 13 November 2025, full report November 2025, edits of 14 and 17 November). The campaign was detected in mid-September 2025; for ten days the company worked out its scope, banned accounts, notified victims and coordinated with the authorities. It assesses with high confidence that GTG-1002 is Chinese state-sponsored (the wording of the confidence was clarified in the report on 17 November). About 30 targets; 'a handful' of intrusions were validated. People chose targets and built a framework that used Claude Code as the executor through tools built on the Model Context Protocol; the model was tricked into acting by breaking the attack into small tasks and telling it that it was working for a cybersecurity firm doing defensive testing. By the company's estimate the AI did 80–90% of the campaign, with a human intervening at 4–6 critical decision points per campaign; at the peak there were thousands of requests, often several a second (on 14 November the post corrected an erroneous 'thousands of requests per second'). Limits: the model often overstated findings, fabricated credentials and presented public information as stolen. Link to the August report. The November report calls the campaign an escalation from 'vibe hacking', where a person still directed the operations. Reception. On 26 November 2025 the US House Committee on Homeland Security asked Anthropic's chief executive to testify on 17 December at a hearing; the letter retells the campaign 'according to Anthropic's November 2025 report'. That is a congressional committee's reaction to the company's statement, not a check of its facts. Whether the hearing took place and whether the chief executive appeared was not checked. What the record does not claim: the names of the victims and which intrusions succeeded; independent confirmation of the attribution or of the 80–90% share; that other models would have acted the same (the company sees only Claude). The date of the event is mid-September 2025, given to the month.