{
  "name": "AI Hack Log incidents",
  "url": "https://aihacklog.com/data/",
  "licence": "CC BY 4.0",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "AI Hack Log (https://aihacklog.com/)",
  "updated": "2026-11-15",
  "count": 3,
  "incidents": [
    {
      "id": "AHL-2025-0001",
      "url": "https://aihacklog.com/incidents/gtg-1002-claude-code-espionage/",
      "status": "live",
      "title": "GTG-1002: Claude Code used to run a state espionage campaign",
      "summary": "A group Anthropic assesses as Chinese state-sponsored used Claude Code, connected to hacking tools through MCP, to attack about 30 organisations in September 2025. According to Anthropic, AI did 80-90% of the work and a small number of intrusions succeeded.",
      "ai_role": "weapon",
      "attack_types": [
        "ai-orchestrated-intrusion"
      ],
      "autonomy": "orchestrated",
      "evidence": "E1",
      "severity": 4,
      "occurred": "2025-09",
      "occurred_end": null,
      "disclosed": "2025-11-13",
      "ai_systems": [
        {
          "vendor": "anthropic",
          "product": "Claude Code"
        }
      ],
      "actor": {
        "name": "GTG-1002",
        "type": "state",
        "attribution": "vendor-assessed"
      },
      "victims": {
        "names": [],
        "sectors": [
          "technology",
          "finance",
          "manufacturing",
          "government"
        ],
        "countries": [],
        "orgs_affected": 30
      },
      "impact": {
        "loss_usd": null,
        "loss_basis": null,
        "records": null,
        "note": "About 30 targets, a small number breached"
      },
      "frameworks": {
        "atlas": [],
        "attack": [
          "C0062",
          "T1190",
          "T1595",
          "T1087",
          "T1136.001",
          "T1567"
        ],
        "owasp_llm": [],
        "owasp_agentic": [],
        "cve": []
      },
      "chain": {
        "claim": "According to Anthropic, AI performed 80-90% of the campaign. Human operators stepped in at perhaps 4-6 decision points per intrusion.",
        "phases": [
          {
            "name": "Targets and setup",
            "by": "human",
            "note": "Chose targets, built the framework, posed as a security firm",
            "checkpoint": null
          },
          {
            "name": "Reconnaissance",
            "by": "ai",
            "note": "Mapped systems, found high-value databases",
            "checkpoint": "Operators reviewed the findings"
          },
          {
            "name": "Vulnerabilities and exploits",
            "by": "ai",
            "note": "Tested flaws, wrote its own exploit code",
            "checkpoint": null
          },
          {
            "name": "Credentials and lateral movement",
            "by": "ai",
            "note": "Harvested logins, reached high-privilege accounts, left backdoors",
            "checkpoint": null
          },
          {
            "name": "Data extraction",
            "by": "ai",
            "note": "Pulled and sorted data by intelligence value",
            "checkpoint": "Operators approved the exfiltration"
          },
          {
            "name": "Documentation",
            "by": "ai",
            "note": "Wrote up credentials and systems for the next stage",
            "checkpoint": null
          }
        ]
      },
      "notice": null,
      "sources": [
        {
          "url": "https://www.anthropic.com/news/disrupting-AI-espionage",
          "publisher": "Anthropic",
          "title": "Disrupting an AI-orchestrated cyber espionage campaign",
          "kind": "vendor",
          "date": "2025-11-13",
          "supports": "Campaign, targets, attribution, share of work done by AI",
          "archive": "https://web.archive.org/web/20261111194222/https://www.anthropic.com/news/disrupting-AI-espionage"
        },
        {
          "url": "https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf",
          "publisher": "Anthropic",
          "title": "Disrupting the first reported AI-orchestrated cyber espionage campaign (full report, PDF)",
          "kind": "vendor",
          "date": "2025-11-13",
          "supports": "Phases, decision points, technical detail",
          "archive": "https://web.archive.org/web/20260507124232/https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf"
        },
        {
          "url": "https://attack.mitre.org/campaigns/C0062/",
          "publisher": "MITRE ATT&CK",
          "title": "Anthropic AI-orchestrated Campaign, C0062",
          "kind": "reference",
          "date": "2026-04-20",
          "supports": "Technique mapping, SSRF initial access, actor designation",
          "archive": "https://web.archive.org/web/20261112213544/https://attack.mitre.org/campaigns/C0062/"
        }
      ],
      "related": [
        "AHL-2025-0002"
      ],
      "published": "2026-11-15",
      "updated": "2026-11-15",
      "changelog": [
        {
          "date": "2026-11-15",
          "note": "Record created from the Anthropic report and MITRE ATT&CK campaign C0062."
        }
      ]
    },
    {
      "id": "AHL-2025-0002",
      "url": "https://aihacklog.com/incidents/gtg-2002-claude-code-data-extortion/",
      "status": "live",
      "title": "GTG-2002: Claude Code used for data theft and extortion",
      "summary": "A cybercriminal Anthropic tracks as GTG-2002 used Claude Code to break into networks, steal data and write ransom demands, potentially affecting at least 17 organisations in government, healthcare and emergency services. Anthropic disclosed it on 27 August 2025.",
      "ai_role": "weapon",
      "attack_types": [
        "ai-orchestrated-intrusion",
        "ai-ransomware"
      ],
      "autonomy": "orchestrated",
      "evidence": "E1",
      "severity": 3,
      "occurred": "2025",
      "occurred_end": null,
      "disclosed": "2025-08-27",
      "ai_systems": [
        {
          "vendor": "anthropic",
          "product": "Claude Code"
        }
      ],
      "actor": {
        "name": "GTG-2002",
        "type": "criminal",
        "attribution": "vendor-assessed"
      },
      "victims": {
        "names": [],
        "sectors": [
          "government",
          "healthcare",
          "critical-infrastructure",
          "finance"
        ],
        "countries": [],
        "orgs_affected": 17
      },
      "impact": {
        "loss_usd": null,
        "loss_basis": null,
        "records": null,
        "note": "At least 17 organisations potentially affected; ransom demands from $75,000 to more than $500,000"
      },
      "frameworks": {
        "atlas": [],
        "attack": [],
        "owasp_llm": [],
        "owasp_agentic": [],
        "cve": []
      },
      "chain": {
        "claim": "According to Anthropic, Claude Code made both tactical and strategic decisions, including which data to take and how to word the extortion demands.",
        "phases": [
          {
            "name": "Setup",
            "by": "human",
            "note": "Wrote a CLAUDE.md file with preferred attack methods and a cover story of authorised security testing",
            "checkpoint": null
          },
          {
            "name": "Reconnaissance",
            "by": "ai",
            "note": "Scanned thousands of VPN endpoints and built scanning frameworks",
            "checkpoint": null
          },
          {
            "name": "Access and credentials",
            "by": "mixed",
            "note": "Live support during intrusions: found domain controllers and SQL servers, extracted credentials",
            "checkpoint": null
          },
          {
            "name": "Malware and evasion",
            "by": "ai",
            "note": "Built disguised tunnelling and proxy tools to get past Windows Defender",
            "checkpoint": null
          },
          {
            "name": "Data theft and analysis",
            "by": "ai",
            "note": "Extracted and sorted personal, financial and medical records",
            "checkpoint": null
          },
          {
            "name": "Extortion",
            "by": "ai",
            "note": "Calculated ransom amounts and generated tailored ransom notes",
            "checkpoint": null
          }
        ]
      },
      "notice": null,
      "sources": [
        {
          "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025",
          "publisher": "Anthropic",
          "title": "Detecting and countering misuse of AI: August 2025",
          "kind": "vendor",
          "date": "2025-08-27",
          "supports": "Operation, number and type of targets, ransom amounts, Anthropic's response",
          "archive": "https://web.archive.org/web/20261111194134/https://www.anthropic.com/news/detecting-countering-misuse-aug-2025"
        },
        {
          "url": "https://assets.claude.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf",
          "publisher": "Anthropic",
          "title": "Threat Intelligence Report: August 2025 (PDF)",
          "kind": "vendor",
          "date": "2025-08-27",
          "supports": "GTG-2002 designation, attack phases, CLAUDE.md set-up, ransom range",
          "archive": null
        }
      ],
      "related": [
        "AHL-2025-0001"
      ],
      "published": "2026-11-15",
      "updated": "2026-11-15",
      "changelog": [
        {
          "date": "2026-11-15",
          "note": "Record created from Anthropic's August 2025 threat intelligence report."
        }
      ]
    },
    {
      "id": "AHL-2025-0003",
      "url": "https://aihacklog.com/incidents/s1ngularity-nx-ai-cli-malware/",
      "status": "live",
      "title": "s1ngularity: hijacked Nx packages made AI CLIs hunt secrets",
      "summary": "Attackers stole the Nx project's npm token and published malicious versions of the Nx build system on 26 August 2025. The malware ran the AI command-line tools on developers' machines to search for secrets, then posted stolen credentials to public GitHub repositories.",
      "ai_role": "weapon",
      "attack_types": [
        "ai-malware"
      ],
      "autonomy": "assisted",
      "evidence": "E1",
      "severity": 2,
      "occurred": "2025-08-24",
      "occurred_end": "2025-08-27",
      "disclosed": "2025-08-27",
      "ai_systems": [
        {
          "vendor": "anthropic",
          "product": "Claude"
        },
        {
          "vendor": "google",
          "product": "Gemini"
        },
        {
          "vendor": "amazon",
          "product": "Q"
        }
      ],
      "actor": {
        "name": null,
        "type": "unknown",
        "attribution": "unknown"
      },
      "victims": {
        "names": [
          "Nx"
        ],
        "sectors": [
          "technology"
        ],
        "countries": [],
        "orgs_affected": null
      },
      "impact": {
        "loss_usd": null,
        "loss_basis": null,
        "records": null,
        "note": "More than 1,000 GitHub accounts received attacker-created repositories, according to Socket"
      },
      "frameworks": {
        "atlas": [],
        "attack": [],
        "owasp_llm": [],
        "owasp_agentic": [],
        "cve": []
      },
      "chain": null,
      "notice": null,
      "sources": [
        {
          "url": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
          "publisher": "Nx",
          "title": "Malicious versions of Nx and some supporting plugins were published (GHSA-cxm3-wv7p-598c)",
          "kind": "primary",
          "date": "2025-08-27",
          "supports": "Affected versions, how the npm token was stolen, malicious behaviour, timeline",
          "archive": "https://web.archive.org/web/20261113093337/https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c"
        },
        {
          "url": "https://nx.dev/blog/s1ngularity-postmortem",
          "publisher": "Nx",
          "title": "S1ngularity: what happened, how we responded, what we learned",
          "kind": "primary",
          "date": "2025-09-05",
          "supports": "Use of local AI tools, four hours on the registry, remediation",
          "archive": "https://web.archive.org/web/20261109095016/https://nx.dev/blog/s1ngularity-postmortem"
        },
        {
          "url": "https://socket.dev/blog/nx-packages-compromised",
          "publisher": "Socket",
          "title": "Nx npm packages compromised in supply chain attack weaponizing AI CLI tools",
          "kind": "vendor",
          "date": "2025-08-27",
          "supports": "The three AI CLIs called, number of victim accounts",
          "archive": "https://web.archive.org/web/20260602094233/https://socket.dev/blog/nx-packages-compromised"
        }
      ],
      "related": [],
      "published": "2026-11-15",
      "updated": "2026-11-15",
      "changelog": [
        {
          "date": "2026-11-15",
          "note": "Record created from the Nx advisory and post-mortem and Socket's analysis."
        }
      ]
    }
  ]
}