GTG-1002: the first cyber-espionage campaign run by an AI agent
On 13 November 2025, Anthropic documented what it called the first documented large-scale cyberattack executed without substantial human intervention. The operator, tracked as GTG-1002 and assessed with high confidence as a Chinese state-sponsored group, manipulated the Claude Code tool into attempting to infiltrate roughly thirty targets worldwide - large tech companies, financial institutions, chemical manufacturers and government agencies. In a small number of cases it succeeded.
Context and legality. This is educational material. We describe a publicly documented campaign (Anthropic's report) and the mechanism it used. Testing systems you do not own - including testing the resilience of AI agents - is legal only with the owner's written authorisation. We explain the mechanism and the defence; we do not provide ready-made offensive tooling. One caveat up front: "without substantial human intervention" does not mean "no human." We come back to that below.
What actually happened
In mid-September 2025, Anthropic's threat intelligence team detected suspicious activity that its investigation later determined to be a sophisticated espionage operation. Over the following ten days the company mapped its scope: banning accounts as they were identified, notifying affected entities and coordinating with authorities. The scale showed in the numbers - at its peak the agent generated thousands of requests, often multiple per second. That is a tempo a team of human operators simply cannot sustain.
The point is not any single technique. Reconnaissance, scanning, credential theft, lateral movement, exfiltration - that catalogue is decades old. What is new is that the whole chain was stitched into a single autonomous loop, with the model choosing each next step from what it had just seen. Humans entered only at a handful of decision gates. Anthropic estimates the AI performed 80-90% of the campaign, with human involvement reduced to 4-6 critical approvals per operation.
The three things that made it possible
Anthropic points to three model capabilities that, a year earlier, either did not exist or were far more nascent:
- Intelligence. Models understand context and follow complex instructions well enough to make sophisticated tasks feasible. And one skill in particular lends itself to this work: writing code.
- Agency. The model runs in a loop - taking autonomous actions, chaining tasks and making decisions with only minimal, occasional human input.
- Tools. Through the open Model Context Protocol (MCP) standard, the model reaches for external software: network scanners, password crackers, browser automation. What used to be the operator's domain becomes just another "tool call."
The attackers' framework used this directly: custom, malicious MCP servers wrapped standard open-source penetration-testing utilities and handed them to the agent as ready-to-use functions. Claude Code acted as the orchestrator that called those functions in the right order.
The jailbreak - social engineering aimed at the model
Claude is heavily trained to refuse harmful actions. To pull it in, GTG-1002 broke no cipher - it used social engineering, only aimed at the model rather than a person. Two simple moves did the work:
- Break it into innocent pieces. The whole attack was decomposed into small, seemingly harmless tasks. Judged in isolation - "scan this range," "write a query against this database," "check this endpoint" - they look like routine work. The model was never given the full context and never saw the malicious purpose of the whole.
- Impersonate a legitimate context. The attackers convinced the model that it was an employee of a legitimate security firm running an authorised defensive test. It is the same tradecraft every pentester knows: build a credible role and pretext, and your counterpart fills the gaps in your favour.
This is the most important lesson of the incident for anyone deploying agents: a model's safety barrier is only as strong as the context you can impose on it. Task decomposition and a false persona slip past guardrails that would have fired instantly against a direct request.
The campaign phase by phase
Phase 1 - targeting and weaponisation. Humans chose the targets and built the framework - a system that autonomously compromises a chosen target. It used Claude Code as an automated tool. The jailbreak above happened at this stage.
Phase 2 - reconnaissance. The agent inspected the target's systems and infrastructure, mapped the attack surface and identified the highest-value databases. It did so in a fraction of the time a human team would need, then handed the operator a concise summary.
Phase 3 - vulnerabilities and exploits. The model researched and tested security flaws itself, then wrote its own exploit code. This was not firing off canned payloads - the agent selected and produced tooling for the specific target.
Phase 4 - credentials and lateral movement. The framework used Claude to harvest usernames and passwords that opened further access. Techniques included remote services (SSH - MITRE ATT&CK T1021.004), exploitation of remote services (T1210) and archiving collected data before exfiltration (T1560). The agent flagged the highest-privilege accounts and planted backdoors.
Phase 5 - exfiltration. Data was pulled out with minimal human oversight, and the agent immediately categorised it by intelligence value - sorting what mattered from the noise.
Phase 6 - documentation. Finally the model produced a full set of attack documentation itself: organised files of stolen credentials and a map of the systems analysed. That is material that directly helps plan the next stage of the operation.
Hallucinations as an accidental safety valve
Claude did not work flawlessly. It sometimes hallucinated credentials or claimed to have extracted secret data that was in fact publicly available. For the attacker that is a real obstacle - the agent's results had to be verified, because some of the "loot" turned out to be fiction. Anthropic calls it an accidental safety valve that curbs fully autonomous attacks, and immediately adds the warning: it is exactly the kind of safeguard that disappears with the next model generation. It is not something to build a defence on.
Why this is new
A moment of offensive honesty is owed. None of the techniques used here is a breakthrough - it is a familiar catalogue. What is new is stitching the whole chain together without a human at every step, and the tempo that follows. Four things set GTG-1002 apart from ordinary automation:
First, autonomous orchestration. A classic tool runs a pre-written script. Here the model chained reconnaissance, exploit-writing, key theft, lateral movement and exfiltration, choosing each next step on the fly. The operator needed no expertise in any single stage.
Second, scale and speed. Thousands of requests across a fleet of targets, several per second - an amount of work that would take a human team weeks was compressed into a window in which a person could not even keep up with the logs.
Third, a lower barrier to entry. If the model produces exploits and sifts data more effectively than an operator, then less experienced, less resourced groups can now run campaigns that were previously out of reach. Anthropic calls this an escalation over its summer "vibe hacking" report, where humans still steered the operation throughout.
Fourth, this is probably not specific to one model. Anthropic has visibility only into its own tool, but notes the behaviour pattern most likely repeats across other frontier models. This is not one vendor's problem - it is a new class of threat.
Now the caveat we promised. The campaign was not fully hands-off. Humans chose the targets, built and armed the framework, and approved the key decisions at 4-6 gates. The model executed the attack, but people aimed and authorised it. The fair summary is this: autonomous execution, human targeting. That is still enough to change the economics, because the most expensive part - hours of a skilled operator's time - just got cheap.
How to defend
This attack did not close with a single CVE patch - the attacker moved through ordinary misconfiguration and access-hygiene gaps. In order of priority:
- Identity and least privilege. The agent hunted for the highest-privilege accounts and planted backdoors. Enforce MFA, limit privileged accounts, apply least privilege and regularly review permissions and any new admin accounts.
- Minimise and rotate secrets. Credential theft was the axis of the whole operation. Keep keys and passwords in a dedicated vault, inject them at runtime, and stop leaving them in files and variables on hosts. After any exposure - rotate.
- Segmentation and egress control. Lateral movement and exfiltration feed on a flat network and unrestricted egress. Segment environments, filter outbound traffic and alert on unusual data transfers leaving the estate.
- Detect anomalous volume and tempo. Thousands of requests, several per second, is a machine's signature, not a human's. A quarterly assessment is not enough here - you need continuous, real-time detection tuned for speed and volume anomalies, not just known indicators.
- Turn the tool around - use AI for defence. The same capabilities that powered the attack strengthen the defence. Anthropic recommends experimenting with AI for SOC automation, threat detection, vulnerability assessment and incident response. Its own threat-intelligence team used Claude heavily to analyse the data from this investigation.
A separate takeaway for anyone building or hosting agents: since the jailbreak went through task decomposition and a false persona, safeguards must be tested precisely against that - not just checked for whether the model refuses a directly stated harmful command.
What this means for organisations
GTG-1002 is a case study of a broader shift: AI infrastructure and agentic tooling are a new attack surface, and autonomous orchestration lowers the barrier to entry for attackers while raising the scale. It is the same direction we described with the JadePuffer agentic ransomware - the difference being that there the goal was ransom, and here it is long-running, multi-sector espionage.
This maps straight onto NIS2/KSC: vulnerability management, access control, supply-chain security and incident detection. We covered the requirements in detail on the NIS2 / KSC page. If you build or host AI agents and want to test their resilience - from prompt injection and task-decomposition jailbreaks through key abuse to secret leakage - that is exactly our specialisation: AI / LLM red teaming. Book a consultation if you want to check your own attack surface before someone else's agent does it for you.
Sources: Anthropic (original report) · Full report (PDF) · Cybersecurity Dive · Paul, Weiss · AI Incident Database