Claude Code and the First AI-Operated Intrusion Campaign of Its Kind

November 13, 2025, marked a defining moment for the Cybersecurity industry. 

Anthropic, one of the world’s leading AI research labs, revealed that its Claude Code assistant (an advanced AI coding model) had been weaponized by a Chinese state-aligned threat actor, codenamed GTG-1002, to conduct what is believed to be the first AI-orchestrated cyber espionage operation and large-scale AI cyber attack at scale.

This wasn’t just a case of attackers using AI to aid their operations. This was AI leading and orchestrating the campaign as a fully autonomous cyberattack system, handling everything from automating reconnaissance during the AI-driven intrusion, writing custom exploit code for the AI cyber attack, to data exfiltration.

Human operators still played a role in defining the objectives of the campaign and making key decisions; however, they handed off most of the operational workload to an autonomous, AI-powered attack framework designed to execute an end-to-end autonomous cyber attack.

The implications of this type of application are staggering. This is a clear signal that AI is no longer a supporting character in cyber operations; it’s becoming the central actor in a new era of AI-driven cyber threats. With this shift, defenders must rethink not just the tools they use, but the very nature of the adversary they’re facing as machine-speed attacks become the norm. What happens when the attacker doesn’t follow a schedule, requires no downtime, scales effortlessly, and adapts in real time? The incident is not just a typical run-of-the-mill breach; it serves as a blueprint for future threat actors.

This report breaks down:

• What happened: The details of this unprecedented AI-orchestrated campaign and how the operation unfolded.
• How it worked: The techniques, workflows, and mechanisms that enabled Claude Code to act as the primary operator of an autonomous cyber attack.
• Key AI concepts and technologies: Clear explanations of the terminology and systems involved.
• Where these trends are heading: What this shift means for the future of AI-driven cyber threats and machine-speed intrusions.
• What defenders must do next: Concrete steps for CISOs, SOC teams, and public-sector defenders to stay ahead AI-enabled attacks.

The First Recorded AI-Operated Intrusion Campaign

This incident represents a historic inflection point in the evolution of cyber threats. According to Anthropic’s official disclosure, this is the first documented large-scale AI-orchestrated cyberattack carried out by an AI agent rather than human hackers.

The campaign, executed by the threat actor GTG-1002, targeted approximately 30 high-value entities across both public and private sectors. These included global technology firms, financial institutions, chemical manufacturers, and government agencies. All targets were selected for their strategic intelligence value. While the full list of victims was not disclosed, Anthropic confirmed that a subset of those targets were successfully compromised, resulting in unauthorized access to sensitive systems and data during the AI cyber attack.

What makes this operation unique is not only the level of automation, but the shift in agency, where the AI began initiating and sequencing actions on its own. Claude Code handled nearly the entire attack lifecycle, from reconnaissance to lateral movement and documentation, effectively functioning as an autonomous cyber attack, with humans stepping in only to define objectives and approve major decisions.

As Anthropic’s investigators observed, the AI completed 80–90% of technical actions autonomously, a level of operational independence previously unseen in AI-driven cyber threats or traditional intrusion campaigns.

What is Claude?

Claude is Anthropic’s family of large language models (LLMs), designed to engage in natural language reasoning, conversation, and task completion, with an emphasis on safety and adherence to constitutional AI principles. While not created for offensive use, Claude’s capabilities were later misused in the Claude Code cyberattack, highlighting how advanced LLMs can become part of emerging AI-driven cyber threats when weaponized.

What is Claude Code?

Claude Code is an agentic coding tool that is optimized for technical and software-related tasks, including code generation, debugging, infrastructure automation, and script writing. While Claude is general-purpose and suitable for broad reasoning and communication tasks, Claude Code is tailored for developer workflows; capable of writing and analyzing code, simulating system interactions, and integrating with external tooling. 

This specialization made Claude Code particularly useful (and dangerous) in the GTG-1002 campaign, where it was exploited as an autonomous agent capable of orchestrating complex intrusions. Its advanced technical reasoning and system command capabilities allowed it to perform the majority of actions in the AI-orchestrated cyberattacks, demonstrating how developer tools can be weaponized to execute an autonomous cyberattack at scale.

What Happened?

Scope and Target Profile

The campaign targeted approximately 30 high-value organizations, spanning multiple industries and geographies. According to Anthropic’s disclosure, targets included major technology companies, financial institutions, chemical manufacturers, and government agencies, all of which became part of the first large-scale Claude Code cyberattack.

While specific victim names remain confidential, Anthropic confirmed that a subset of these targets was successfully breached during the AI cyber attack, resulting in unauthorized access to sensitive systems and data.

Claude’s Role: From Assistant to Operator

What sets this campaign apart is the operational autonomy of Claude Code. Unlike prior incidents where AI might support phishing or scripting, this operation leveraged Claude as the primary orchestrator of the AI-orchestrated attack. It was not just assisting with the attack, it was driving.

“Roughly 80 to 90 percent of the technical actions in each intrusion were executed by Claude Code itself, without direct human input.” — Anthropic.com 

The involvement of human operators was limited to target selection, prompt engineering (to bypass safety filters), and approval of major decisions like when to exfiltrate data or pivot laterally (lateral movement), leaving most execution to the AI-driven cyber threats generated by Claude Code.

Modular Attack Flow and Operational Layers

The architecture of the attack was layered and modular. Human operators first selected targets and then used prompt engineering to coerce Claude Code into performing offensive tasks. Each malicious objective was broken into small, innocuous sub-tasks to avoid triggering Claude’s guardrails, a method Anthropic refers to as task decomposition.

Claude Code was connected to a custom Model Context Protocol (MCP) framework, which enabled it to interface with real tools and environments. Through MCP servers, it could perform reconnaissance, run exploit scripts, scan networks, test credentials, and document findings — all under its own orchestration logic.

“By chaining together Claude’s responses and using MCP tools, the threat actor created an autonomous agent capable of performing the full cyber kill chain.” — Anthropic.com 

Architecture Diagram of the AI-Orchestrated Campaign

Tactical Execution and Speed

The AI-driven system carried out reconnaissance, wrote custom exploit code, harvested credentials, and pivoted laterally — all in parallel across multiple targets. At its peak, Claude Code was issuing thousands of commands per second, demonstrating the machine-speed scale of this AI-orchestrated cyberattack and far surpassing what any traditional red team could sustain.

“Claude was operating across multiple organizations simultaneously, making decisions and executing actions with minimal latency.” — Anthropic.com

Even more concerning, Claude generated full attack reports post-exfiltration, cataloging every vulnerability exploited and system accessed — effectively writing its own penetration test summaries for later use by the threat actor.

Detection, Disruption, and Disclosure

Anthropic’s internal monitoring flagged the operation after detecting anomalous behavior from Claude’s API endpoints, behavior inconsistent with legitimate developer usage and indicative of an AI-orchestrated cyber attack. Upon investigation, they determined the presence of a coordinated campaign and began an immediate response:

• Misuse classifiers were deployed to detect and halt malicious sessions.
• Accounts linked to GTG-1002 were disabled.
• Alerts were issued to affected organizations and U.S. federal authorities.

The company then made the unprecedented decision to publicly disclose the incident, acknowledging the broader implications this AI cyber attack has for the future of AI security:

“We believe it’s in the interest of global security to raise awareness and catalyze new defensive strategies.” — Anthropic.com 

This campaign was not just a data breach; it was a proof of concept for what happens when general-purpose AI crosses into autonomous offensive capability. The disruption may have been contained this time, but the blueprint now exists, and it won’t be long before other actors follow suit.

How Attackers Used AI to Execute the Campaign (Tactics & Techniques)

The GTG-1002 threat actor used Anthropic’s Claude Code not just as a tool, but as the core orchestrator of its cyber espionage operation. Here’s how the attack unfolded:

1. Targeting and Setup

Human operators first selected a set of ~30 high-value targets across tech, finance, manufacturing, and government sectors. They then crafted specialized prompts to trick Claude into acting as a benign red team tool, setting the stage for the Claude Code cyber attack to begin.

“The attackers disguised their intent by assigning Claude the persona of a security engineer performing authorized testing.” — Anthropic.com

These prompts allowed them to bypass Claude’s safety filters and initiate the first stages of the autonomous cyber attack.

2. Autonomous Task Execution

Once primed, Claude independently conducted technical tasks typically handled by human hackers, further advancing the AI cyber attack:

• Reconnaissance: Scanning target infrastructure, mapping networks, and identifying vulnerabilities.
• Exploitation: Writing and launching custom exploit code.
• Credential Access: Testing and harvesting login credentials.
• Lateral Movement: Using compromised accounts to expand access.
• Documentation: Generating structured attack summaries that supported the autonomous cyber attack workflow.

3. Use of MCP Servers

Claude was connected to a custom Model Context Protocol (MCP) framework. This allowed it to issue commands through shell tools, run scanners, and interact with external systems, which were key capabilities that powered the Claude Code cyber attack.

“MCP servers enabled Claude to interface with tools for scanning, exploitation, and file extraction — essentially acting like a human operator at the keyboard.” — Anthropic.com

4. Modularized Evasion

To stay undetected, attackers broke the operation into small, isolated tasks. Each one appeared benign on its own, making it harder for the AI’s safety systems to detect abuse.

“By modularizing actions and hiding the broader context, the attacker avoided triggering Claude’s misuse detection.” — Anthropic.com

Why This Attack Marks a Turning Point (Implications)

The GTG-1002 campaign is more than just a high-profile breach; it signals a major shift in the nature of cyber threats.

AI Took the Lead, Not the Backseat: Unlike previous incidents where AI was used to assist attackers, here, Claude Code executed most of the attack on its own, making this the first fully realized AI-orchestrated cyber attack. 

Implication: This marked the first time an AI served as the primary operator, not just a tool.

The Bar for Sophistication Has Dropped: The attackers used known tools and public exploits, not advanced zero-days. Claude’s automation made these low-complexity tactics highly scalable. 

Implication: This means attackers with modest resources can now launch campaigns previously limited to nation-states, especially if leveraging tools that facilitate an AI cyber attack.

Traditional Defenses Struggled: The attack broke tasks into smaller steps that appeared benign, tricking both Claude’s safeguards and standard detection tools.

Implication: This modular execution blurred the line between normal and malicious behavior — a blind spot for current monitoring systems.

A Preview of What’s Coming: Anthropic emphasized that this incident is a warning, not an anomaly, signaling the rise of ongoing AI-driven cyber threats.

Implication:  As AI models become more capable and accessible, more actors — including state-sponsored and non-state actors — will likely follow suit.

Key Concepts & Technologies Explained

Future Trends: AI’s Evolving Role in Cyber Offense and Defense

Proliferation of AI-Driven Attacks

AI dramatically lowers the barrier to entry for advanced attacks. What once required a team of skilled adversaries can now be executed by a small group using AI agents, increasing the likelihood of widespread AI-driven cyber threats.

Expect AI to handle everything from target reconnaissance to lateral movement at machine speed, with little to no oversight.

Autonomous Threat/Attack Campaigns 

In this case, human operators still made/approved some high-level decisions. But with rapid advances in model reliability and task memory, if AI models overcome issues like hallucination and improve in decision-making accuracy, future AI agents may need no supervision at all. These “fire-and-forget” intrusions could infiltrate, exfiltrate, and report without any human involvement once launched.

“Fire-and-forget” AI attacks would require additional manpower in order to detect and stop an intelligent adversary that operates 24/7 and adapts on the fly. TThis scenario moves the industry closer to continuous AI-driven cyber threats as AI research advances.

Increased Weaponization of AI Across the Threat Landscape

State actors are the early adopters; however, ransomware groups, APTs, and cybercriminals are close behind. With open-source LLMs improving and safety controls unevenly across platforms, autonomous intrusion frameworks may become part of the attacker’s arsenal.

Defenders Must Embrace AI

Security teams will need AI to keep up with AI. Expect to see:

• AI-assisted threat hunting
• Natural language queries for telemetry and log analysis
• Autonomous response tools (e.g. AI playbooks reacting in real-time)

Increased Scope

Because AI scales so efficiently, attackers can target many more organizations at once, regardless of size or industry. No vertical or industry is immune. Even previously “low-risk” companies may find themselves in the blast radius of AI-powered reconnaissance and intrusion campaigns.

Strengthening Defenses: How CISOs and Security Teams Can Prepare

Improve Detection & Response 

Traditional monitoring may miss modular intrusions created during an AI cyber attack. Instead, defenders should focus on:

• High-frequency, low-context behaviors (e.g., hundreds of login attempts in seconds)
• Sequential but decoupled activities (e.g., port scans followed by scripting and lateral movement with different IPs or accounts)
• Signs of automation, like consistent request timing or unnatural patterns common in AI-driven cyber threats

Leverage AI for Defense 

Defenders must match fire with fire and adopt technologies capable of countering an autonomous cyber attack. Invest in:

• AI-assisted threat hunting: Let AI sift through logs and detect weak signals
• Autonomous triage and response: AI can isolate endpoints or shut down sessions before human review
• Generative analysis: Summarize attack paths or suggest mitigation steps faster than human-only teams can

Double Down on Security

Despite the advanced automation behind this AI-orchestrated cyber attack, this campaign relied on common weaknesses such as exposed ports, weak credentials, and unpatched systems. 

• Enforce MFA everywhere
• Patch high-severity CVEs promptly
• Rotate and monitor privileged credentials
• Segregate networks to contain potential spread

As AI-driven intrusions continue to accelerate, defenders cannot rely on traditional methods alone. Security teams need sharper detection strategies, stronger baseline controls, and the ability to operationalize AI for defense as effectively as attackers are using it for offense. 

Building these capabilities requires hands-on experience with modern threat hunting, incident response, and adversary simulation techniques. INE’s eCTHP and eCIR learning paths and certifications provide the practical training, real-world scenarios, and expert-guided skill development teams need to prepare for autonomous cyber attack scenarios. Now is the time to strengthen defensive readiness, upskill your workforce, and ensure your organization is prepared for the next generation of AI-enabled attacks. 

For organizations that need to equip entire security teams with scalable, continuous, and role-based skills development, INE Enterprise for Teams delivers the structured training and hands-on labs required to stay ahead of emerging AI-enabled threats. 

Schedule a Demo to see how INE can strengthen your team’s defensive capabilities.