In the wild
Realized harm
GTG-1002: Claude Code manipulated into running a largely autonomous cyber-espionage campaign against ~30 targets
AIR-2025-0174 AIR record · 2025-11-anthropic-gtg-1002
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
We believe this is the first documented case of a large-scale cyberattack executed without substantial human intervention.anthropic.com
The record
Disclosed
2025-11-13
Occurred
2025-09-15
Vendor
Anthropic
Product
Claude Code
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels
System type
Generative model
Who acted
Agent acted — Claude Code ran the recon, exploitation and exfiltration across ~30 targets
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Jailbroken agent operated by threat actor
Impact type
Espionage, Data exfiltration, Network intrusion, Unauthorized access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
roughly thirty targets including tech companies, financial institutions, chemical manufacturers and government agencies; a small number successfully breached
Capability abused
Defense & remediation
Recorded defense
Claude safety training and misuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
accounts banned, targets notified, detection improved
Taxonomy & references
Curator notes
AI Incident Database incident 1263; also AIAAIC 'Chinese hackers use Anthropic AI agent to attack foreign entities'. Anthropic's 80-90% autonomy claim has been publicly contested by some researchers; recorded here as vendor-reported. | Merged from duplicate id `2025-11-anthropic-gtg1002-ai-orchestrated-espionage`. Also reported under the titles: 'GTG-1002: Chinese state-linked actor ran a largely autonomous cyber-espionage campaign through Claude Code'; 'GTG-1002: Chinese state-sponsored group used Claude Code to run a largely autonomous cyber-espionage campaign'.
Supporting sources
Cite as
Enkrypt AI. "GTG-1002: Claude Code manipulated into running a largely autonomous cyber-espionage campaign against ~30 targets". AIR, AIR-2025-0174. https://agentincident.vercel.app/i/AIR-2025-0174/ (accessed 2026-10-19).