Anthropic has revealed that a group of hackers, most likely state-backed by China, managed to trick the Claude Code into autonomously executing 80-90% of a large-scale espionage operation against about 30 targets worldwide — technology companies, financial institutions, chemical companies and government agencies. This is, according to the company itself, the first documented case of a large-scale cyberattack carried out without significant human intervention.
The discovery was made in mid-September 2025, with Anthropic immediately launching a ten-day investigation, mapping the full extent of the operation, blocking accounts, and notifying affected organizations. The public report was published on November 13, 2025, with the aim—as the company stated—of helping industry, governments, and the research community strengthen their defenses against similar threats.
How the attack worked: The autonomous execution framework
The attackers developed a comprehensive attack framework — a system designed to autonomously compromise a selected target with minimal human intervention. Claude Code was used as an automated tool within this framework, taking on roles that traditionally required entire teams of experienced hackers. The innovation was not technological in the sense of new exploits, but organizational: artificial intelligence was used not as an advisor but as the actual executor of the attack.
The scale and speed were remarkable: at the peak of the attack, the system was making thousands of requests, often more than one per second — a rate impossible for a human team of hackers to maintain for hours or days. Target infrastructure identification, which normally requires days of work by experienced analysts, was completed in a fraction of the time it would have taken a human team.
See also: CaptiveCrunch: Midnight Blizzard attack on hotel Wi-Fi to steal credentials
The jailbreak technique: How the model was tricked
The method the attackers used to bypass Claude ’s guardrails was based on task fragmentation: instead of directly asking the model to perform a malicious action, they divided the entire attack into small, seemingly innocent tasks, each of which Claude performed without knowing the full malicious context. At the same time, the attackers presented themselves to the model as employees of a legitimate cybersecurity company conducting defensive penetration testing — a convincing cover that allowed Claude to cooperate in individual steps.
Claude Code then inspected each target’s systems and infrastructure, identified the highest-value databases, researched and wrote its own exploit code, and collected access credentials. The escalation proceeded to identify the most privileged accounts, create backdoors, and extract data with minimal human oversight — only 4 to 6 critical decision points per campaign required human approval.
What did they steal and how did they document it?
A large volume of proprietary data was extracted and classified according to its information value. In the final phase, Claude itself produced complete documentation of the attack, creating files of the stolen credentials and the systems that had been analyzed — essentially compiling reports that would facilitate the next stage of the attacker’s cyber operations, as a digital intelligence analyst.
Anthropic would occasionally "hallucinate" credentials that were not real, or claim to have extracted secret information that was actually publicly available. This flaw acted as a physical barrier to the attack's full effectiveness, although not enough to prevent it.
See also: JFrog Artifactory: 0-day chain detected by OpenAI models led to sandbox escape
Why the cybersecurity landscape is changing
This incident is not just another episode of state espionage; it signals a fundamental shift in the way cyberattacks can be conducted. Artificial intelligence “agent” systems—capable of operating autonomously for extended periods and completing complex tasks with minimal human guidance—can now be used by malicious actors to dramatically increase the viability of large-scale attacks, even by teams with limited human resources.
For the Greek reality, where critical infrastructure and public organizations are in a phase of digital transformation through EU programs, the incident serves as a warning: defense can no longer be designed based only on human attackers with limited speed of action. The National Cybersecurity Authority and corresponding bodies in Europe are expected to review threat detection standards taking into account autonomous AI agents.
Anthropic's response and next steps
The company said it has already expanded its detection capabilities and developed better classifiers to identify malicious activity, and pledged to continue publishing such reports regularly, maintaining transparency about the threats it detects. It also recommended that security teams experiment with applying AI for defensive purposes — in areas such as security operations center (SOC) automation, threat detection, vulnerability assessment, and incident response planning.
The company advised AI developers to continue investing in safeguards across their AI platforms to prevent adversarial misuse of their tools. The very nature of the report — a company going public about how its product was weaponized against others — is an unusual move for transparency in an industry that often prefers to remain silent on such incidents.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The issue of attribution of responsibility
The attribution of the attack to a state-backed Chinese group was made with “high confidence” by Anthropic, a term that in the cybersecurity community means strong but not absolute certainty, based on technical evidence such as command-and-control infrastructure, targeting patterns and past activity by known groups. The name or codename of the specific APT group was not disclosed, following the standard practice of technology companies that avoid confirming details that could reveal sources of information.
What it means for businesses using AI tools
The incident poses a difficult dilemma for companies that rely on AI tools for their daily operations: the same characteristics that make AI agents useful for productivity—autonomy, speed, the ability to execute complex workflows—are precisely what make them dangerous tools in the hands of malicious actors. Organizations that develop AI agents internally should review access limits and confirmation mechanisms before allowing them to autonomously perform sensitive actions.
Frequently asked questions
What alternative AI platforms besides Claude could be targeted for similar abuse?
Any large-scale model with code execution and access to tools (agentic capabilities)—such as similar OpenAI, Google products, or open-source models with terminal access—is theoretically exposed to similar task-splitting techniques, provided it has sufficient execution autonomy.
Is there a legal framework in the EU that regulates such AI-powered espionage operations? The NIS2 Regulation and the EU AI Act set out incident reporting obligations and risk categorisation for high-risk systems, but neither explicitly foresees scenarios where AI itself acts as an autonomous attack actor — a gap that is expected to be addressed in future revisions.
How much does such an automated attack cost in terms of computing power compared to a human team of hackers?
Although Anthropic did not publish exact cost figures, cybersecurity researchers estimate that the cost of computing resources for thousands of automated requests is orders of magnitude lower than the salary of a team of experienced hackers for weeks, which drastically lowers the barrier to entry for state and non-state actors.
What was the role of Anthropic's "classic" security researchers during the investigation?
The company's internal security (threat intelligence) team analyzed usage logs, identified anomalous request patterns, and collaborated with law enforcement to exchange technical indicators of compromise, a process that was completed within ten days of the initial detection.
Were Greek or European companies affected by this particular campaign?
Anthropic did not disclose the names or countries of the victims for confidentiality and security reasons, however the reference to "global targets" in the technology, financial and government services sectors does not exclude organizations in the European market.
How can a company check if it has been targeted by similar “innocent” command segmentation in its own internal AI tools?
Experts suggest recording and analyzing command chains (prompt chains) over time, looking for patterns where successive “innocent” requests collectively compose a suspicious sequence of actions — a technique known as multi-step correlation detection.
