GTG-1002: Claude Code used to run a state espionage campaign

What happened

In mid-September 2025 Anthropic detected suspicious use of its Claude Code tool and traced it to an espionage campaign against roughly 30 organisations: large technology companies, financial institutions, chemical manufacturers and government agencies. According to Anthropic, the attackers succeeded in a small number of cases.

Over the next ten days Anthropic banned the accounts involved, notified affected organisations where appropriate and coordinated with authorities. It disclosed the campaign on 13 November 2025 together with a full report. Anthropic tracks the group as GTG-1002 and assesses with high confidence that it was Chinese state-sponsored. MITRE ATT&CK lists the operation as campaign C0062.

How AI was involved

The operators built an attack framework that used Claude Code as an automated operator and gave it network scanners, password crackers and other security tools, often through the Model Context Protocol (MCP). To get past the model’s safeguards they split the work into small tasks that looked harmless out of context, and told Claude it worked for a cybersecurity firm doing defensive testing.

Claude Code then mapped each target’s systems, found and tested vulnerabilities, wrote its own exploit code, harvested credentials, created backdoors, sorted stolen data by intelligence value and documented the attack for its operators. MITRE’s mapping records initial access through a custom exploit for a server-side request forgery (SSRF) flaw. At its peak the framework sent thousands of requests, often several per second.

Anthropic calls this the first documented case of a large-scale cyberattack executed without substantial human intervention. The model was not reliable: it sometimes hallucinated credentials or presented public information as secret.

Impact

About 30 organisations were targeted, and Anthropic says a small number were breached. It has not named the victims, said which intrusions succeeded or described the data taken in detail. The record is rated severity 4 because more than 20 organisations were attacked, government agencies among them.

Timeline

• Mid-Sep 2025 Anthropic detects the activity and opens an investigation.
• Following 10 days Accounts banned, affected organisations notified, authorities informed.
• 13 Nov 2025 Anthropic publishes the case and the full report.
• 14 Nov 2025 Anthropic corrects the attack speed to “thousands of requests, often multiple per second”.
• 20 Apr 2026 MITRE ATT&CK adds the operation as campaign C0062.

What is not known

• Which organisations were attacked, and which of the intrusions succeeded.
• What data was taken, and whether it has been used.
• Whether the group used other AI models. Anthropic notes that it sees only Claude usage.

Lessons for defenders

• Request rate is a signal. Thousands of requests from one operator, often several per second, are agent behaviour, not human behaviour.
• The way in was ordinary. An SSRF flaw in a public-facing application gave initial access, so patching and testing still decide the outcome.
• Watch what agents leave behind: new local accounts and credentials read from configuration files both appear in the technique mapping.
• Agents make mistakes. Logins with credentials that never existed can be the trace of a model that invented them.