In the wild
Realized harm
GTG-10007: Chinese-speaking espionage operators used Claude as an autonomous 'exploit foundry' and agent-swarm intrusion framework against ~50 organizations
AIR-2026-0232 AIR record · 2026-09-anthropic-gtg-10007-exploit-foundry
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The operators routinely ran “agent swarms,” where a lead AI agent decomposed reconnaissance and post-exploitation work and dispatched it to many subagents running in parallel.www-cdn.anthropic.com
The record
Disclosed
2026-09-10
Vendor
Anthropic
Product
Claude
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Data and memory poisoning
System type
Generative model
Who acted
Agent acted — autonomous vulnerability-research and exploit workflow ran around the clock against ~50 organisations
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Autonomous vulnerability research and harvested credentials
Impact type
Unauthorized access, Data exfiltration, Espionage, Zero day development
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
roughly fifty organizations across education, retail, energy, technology, healthcare, finance, manufacturing and multiple governments globally; an education-technology company lost hundreds of megabytes of student personal data; a Southeast Asian government agency's citizen records (names, phone numbers, home addresses) were retrieved; a retail production environment was reached
Capability abused
Defense & remediation
Recorded defense
Anthropic Usage Policy safeguards and misuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
Anthropic banned associated accounts and deployed additional monitoring (September 2026)
Taxonomy & references
Curator notes
Anthropic September 2026 report (PDF). Operators assessed to be Chinese-speaking, likely in Changsha, Hunan; two identified as undergraduates. Ran parallel workstreams with shared tooling and persistent campaign memory: an autonomous appliance-firmware zero-day loop yielding 'more than a dozen possible zero day findings in a single month', an OSINT recon loop, and a 13-agent scheduled collection fleet running with no human in the loop. Hands-on intrusion effort concentrated on domestic China victims despite global targeting.
Supporting sources
Cite as
Enkrypt AI. "GTG-10007: Chinese-speaking espionage operators used Claude as an autonomous 'exploit foundry' and agent-swarm intrusion framework against ~50 organizations". AIR, AIR-2026-0232. https://agentincident.vercel.app/i/AIR-2026-0232/ (accessed 2026-10-19).