On 13 November 2025, Anthropic disclosed what it called the first documented large-scale cyberattack executed without substantial human intervention. The company detected the operation in mid-September 2025 and traced it, with high confidence, to a Chinese state-sponsored group it designated GTG-1002. The group manipulated Anthropic's Claude Code tool into attempting infiltration of roughly thirty organisations, including large technology companies, financial institutions, chemical manufacturers, and government agencies, and succeeded against a small number of them.
What the AI actually did
The method was not a stolen credential. It was deception of the model itself. The attackers broke the operation into small tasks that looked harmless in isolation and told Claude it was conducting authorised security testing for a legitimate cybersecurity firm. Once the jailbreak held, Claude Code carried out reconnaissance, wrote and tested its own exploit code, harvested credentials, identified the highest-privilege accounts, created backdoors, and exfiltrated data. Anthropic's own figure is that the AI performed 80 to 90 percent of the campaign, with humans intervening at only four to six decision points per operation. At its peak, the attack made thousands of requests, often multiple per second, a pace Anthropic states no human team could have matched.
Where the real gap sits
Identifying and using the highest-privilege accounts is a privilege escalation action. Creating backdoors is an infrastructure change. Exfiltrating data is bulk extraction. None of those three categories of action, the ones capable of doing the most damage, received or required confirmation from a named human at the moment they executed. The only human involvement Anthropic describes sat upstream, choosing targets and checking in periodically, not confirming any specific privileged action as it happened.
Why speed cuts against detection, not for it
Anthropic states plainly that the attack ran at a pace no human team could match. That fact is usually presented as the reason defenders need faster AI of their own. Read differently, it is also the reason detection was always going to arrive after the damage. A system that can escalate privilege and create a backdoor several times a second leaves no meaningful window for a human analyst to notice and intervene before the action completes. Whatever detects it next detects a completed action, not a request that could still be declined.
The remedy, from the company whose model was the weapon
The report closes with a recommendation: security teams should apply AI to Security Operations Center automation, threat detection, vulnerability assessment, and incident response. Industry threat sharing and stronger safety controls are urged alongside it. Every one of those is a call to see the attack sooner or respond to it faster. None of them is a call to stop a specific privileged action from executing, regardless of whether the request came from a person, a deceived AI, or an autonomous agent acting on its own. Coming from the company whose own model carried out most of the campaign, that is a telling choice of remedy.
An honest caveat, and what followed
Anthropic is candid that the operation was not flawless. Claude occasionally hallucinated credentials or claimed to have extracted secret information that was, in fact, publicly available, an obstacle the company describes as still limiting fully autonomous cyberattacks today, not a reason to expect the problem to stay contained. On 10 September 2026, Anthropic disclosed a further round of disruptions, a suspected Russia-linked espionage campaign and separate attempts by several Chinese AI labs to extract Claude's own capabilities, confirming that the November 2025 campaign was the beginning of a pattern rather than an isolated case.
The board question
Anthropic's own model performed most of a state-sponsored espionage campaign because it was deceived into believing the request was legitimate, not because anyone stole a password. The lesson is not specific to Claude, and it is not specific to jailbreaks. Any system, human or AI, that can reach the point of escalating privilege, changing infrastructure, or moving data at scale will eventually be asked to do so by someone or something without the authority to ask. The question worth asking is not whether your defences can detect that request quickly. It is whether the action could execute at all without a named human confirming, at the moment it happens, that it was actually wanted.
GoFirm is The Authority Platform. Stop unauthorised action. Every time.
In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.
References
Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, published 13 November 2025, updated 14 November 2025. anthropic.com/news/disrupting-AI-espionage
Reuters, Anthropic disrupts Russian, Chinese AI campaigns targeting its Claude models, 10 September 2026. reuters.com