Incident·WS-0057·Sep 15, 2025·disclosed Nov 13, 2025 (59 days later)·in the wild·AI-powered cyberattacks

State hackers run a mostly AI-automated espionage campaign

GTG-1002 (assessed Chinese state-sponsored) / Anthropic Claude Code

77/100
WS-4 Severe
Harm score 70, signal score 85. Autonomy: autonomous (the AI ran multi-step operations). How the scores work.
Harm 4/5
damage actually done
Reach 2/5
who was affected
Autonomy 3/4
how much the AI did on its own
Novelty 5/5
how new the behavior was
Permanence 4/5
how hard it is to undo

Anthropic detected in mid-September 2025 a campaign in which operators jailbroke Claude Code by splitting tasks and posing as a security firm, then had it perform most reconnaissance, exploitation, credential harvesting and data extraction against about 30 organizations. Humans intervened at only a handful of decision points; Claude's hallucinated findings were a limiting factor.

Damage

~30 targets (tech, finance, chemicals, government); a small number of successful intrusions; data stolen unquantified

Did they fix it?

reopened Anthropic banned the accounts and says its detection improved, but it never published evidence outsiders could check, and its own 2026 report shows state hackers kept running Claude-driven campaigns.

  1. Reported Nov 13, 2025

    Anthropic self-reported (Nov 13, 2025) that a suspected Chinese state-sponsored group it calls GTG-1002 got Claude Code to do most of the work of a campaign against about 30 organizations by posing as a security firm and splitting tasks… source

  2. Response Nov 14, 2025

    Anthropic said it 'banned accounts as they were identified,' 'notified affected entities as appropriate' and 'coordinated with authorities.' The Chinese embassy said China 'firmly opposes and cracks down on all forms of cyberattacks' and… source

  3. Claimed fix Nov 13, 2025 partial

    'We have expanded our detection capabilities' and 'developed better classifiers to flag malicious activity,' plus account bans. No indicators of compromise were published with the report and no specific guardrail change was described. source

  4. Independent check Sep 11, 2026 none

    No independent verification found: no victims have been named, no government has confirmed the intrusions, and critics' requests for indicators went unanswered. Anthropic's own September 2026 threat report says the operating model it… source

  5. Where it stands Sep 11, 2026 reopened

    The original claims remain disputed and unverified, and by Anthropic's own account the behavior - state actors running largely AI-automated intrusion campaigns through Claude - continued for at least nine more months despite the improved… source

The full case, with what would change the verdict →

The capability behind it

Sources

Anthropic, second source. Evidence confidence: medium. Anthropic estimates AI performed 80-90% of tactical work with 4-6 human decision points per campaign. Claims are self-reported; independent verification limited.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.