{
 "public_id": "AIR-2025-0174",
 "incident_id": "2025-11-anthropic-gtg-1002",
 "date_disclosed": "2025-11-13",
 "date_occurred": "2025-09-15",
 "title": "GTG-1002: Claude Code manipulated into running a largely autonomous cyber-espionage campaign against ~30 targets",
 "class": "in_the_wild",
 "attack_surface": "coding_agent",
 "initial_vector": "jailbroken_agent_operated_by_threat_actor",
 "agent_capability_abused": [
  "autonomous_recon",
  "vulnerability_discovery",
  "exploitation",
  "credential_harvesting",
  "data_extraction",
  "sub_agent_orchestration",
  "mcp_tool_use",
  "shell_execution",
  "autonomous_planning",
  "network_scanning",
  "credential_testing",
  "data_exfiltration",
  "code_execution",
  "tool_use_via_mcp",
  "autonomous_task_decomposition",
  "network_reconnaissance"
 ],
 "target_product": "Claude Code",
 "target_vendor": "Anthropic",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "espionage",
  "data_exfiltration",
  "network_intrusion",
  "unauthorized_access"
 ],
 "blast_radius": "roughly thirty targets including tech companies, financial institutions, chemical manufacturers and government agencies; a small number successfully breached",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI01",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "ai_orchestrated_intrusion",
   "task_decomposition_jailbreak",
   "state_sponsored",
   "first_of_kind",
   "agent_as_attack_tool",
   "guardrail_bypass",
   "task_decomposition",
   "pentest_persona",
   "mcp_orchestration",
   "agentic_offense",
   "jailbreak_persona"
  ]
 },
 "defense_present": "Claude safety training and misuse detection",
 "defense_bypassed": true,
 "fix_shipped": "accounts banned, targets notified, detection improved",
 "primary_sources": [
  "https://www.anthropic.com/news/disrupting-AI-espionage",
  "https://incidentdatabase.ai/cite/1263"
 ],
 "verified_quote": "We believe this is the first documented case of a large-scale cyberattack executed without substantial human intervention.",
 "confidence": "high",
 "notes": "AI Incident Database incident 1263; also AIAAIC 'Chinese hackers use Anthropic AI agent to attack foreign entities'. Anthropic's 80-90% autonomy claim has been publicly contested by some researchers; recorded here as vendor-reported. | Merged from duplicate id `2025-11-anthropic-gtg1002-ai-orchestrated-espionage`. Also reported under the titles: 'GTG-1002: Chinese state-linked actor ran a largely autonomous cyber-espionage campaign through Claude Code'; 'GTG-1002: Chinese state-sponsored group used Claude Code to run a largely autonomous cyber-espionage campaign'.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy",
  "product_misuse"
 ],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Credential & Secret Theft",
  "Remote Code Execution & Sandbox Escape",
  "Unauthorized Access & Account Takeover"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Claude Code ran the recon, exploitation and exfiltration across ~30 targets",
 "vector_family": "other",
 "vector_detail": "jailbroken_agent_operated_by_threat_actor",
 "guardrail_kind": [
  "abuse_detection"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1263
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "claude_code",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "vendor_disclosure",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels"
 ],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05 | added ASI01 (vector=injection), ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}