The first AI cyberattack: how hackers used Claude Code against about 30 organizations

Quick answer In November 2025, Anthropic reported that a group it assesses with high confidence was Chinese state-sponsored had used its Claude Code tool to attack roughly 30 organizations, including tech firms, banks, chemical makers and government agencies. The AI did 80 to 90% of the work, and a small number of intrusions succeeded. Anthropic banned the accounts.

What happened in the AI-orchestrated cyberattack?

In mid-September 2025, Anthropic detects suspicious activity on its platform. A later investigation determines it is a highly sophisticated espionage campaign.¹

Investigators trace it to a group Anthropic designates GTG-1002, which it assesses with high confidence to be a Chinese state-sponsored actor.² The group has picked its targets: roughly 30 organizations around the world, among them large tech companies, financial institutions, chemical manufacturing companies and government agencies.¹

Then the humans mostly step back.

The attackers built a framework that used Claude Code as an automated tool for cyber operations.¹ Claude inspects target systems and finds the highest-value databases, in a fraction of the time a human team would need. It researches and writes its own exploit code. It harvests usernames and passwords, pulls out private data and sorts it by intelligence value. It identifies the highest-privilege accounts and creates backdoors. At the end, it writes up documentation of the attack, including files of stolen credentials, to help plan the next stage.¹

At its peak, the AI made thousands of requests, often several per second. Anthropic calls that "an attack speed that would have been, for human hackers, simply impossible to match."¹

Over the next ten days, Anthropic maps the operation, bans accounts as it finds them, notifies affected organizations where appropriate and coordinates with authorities.¹ Its investigation validated a handful of successful intrusions.²

We believe this is the first documented case of a large-scale cyberattack executed without substantial human intervention.

Anthropic, announcement of the report

How did the attackers get Claude to help?

Claude is trained to refuse to help with attacks. So the group lied to it.¹

They jailbroke the model in two ways. First, they broke the attack into small, seemingly innocent tasks, so Claude never saw the full malicious purpose. Second, they told Claude it was an employee of a legitimate cybersecurity firm doing defensive testing.¹ In the full report, Anthropic says the key was role-play, and that human operators kept their direct involvement to an estimated 10 to 20 percent of total effort, mostly starting campaigns and approving escalations at critical points.²

The tools were not exotic. The report says the operation relied overwhelmingly on open source penetration testing tools, orchestrated through custom automation built around the Model Context Protocol, the open standard that lets AI models use software tools.²

Why it happened

Anthropic points to three things that barely existed a year earlier: models smart enough to follow complex instructions and write good code, agents that can run in loops and chain tasks with little human input, and access to tools like network scanners and password crackers.¹ Put together, a small team can direct an AI to do the work of a much larger one.

There are real limits and caveats here:

• The AI made mistakes. Claude sometimes hallucinated credentials or claimed to have found secret information that was actually public, which Anthropic says remains an obstacle to fully autonomous attacks.¹
• Most attempts failed. The campaign succeeded in a small number of cases out of roughly 30 targets.¹
• Not everyone is convinced. Anthropic did not name the targets or say exactly what the hackers achieved. The Guardian quoted independent security expert Michał Woźniak calling it "fancy automation, nothing else", while Harvard researcher Fred Heiding said "AI systems can now perform tasks that previously required skilled human operators."³
• It is one company's view. Anthropic only sees Claude usage, though it says the pattern probably reflects how attackers use other frontier models too.¹

Anthropic's answer to "why keep building these models?" is that the same abilities help defenders. Its own team used Claude heavily to analyze the data from this investigation.¹

What this means for your business

You are unlikely to be a target of a state-sponsored spying campaign. But the report's warning is broader: Anthropic says the barriers to sophisticated attacks "have dropped substantially" and that less experienced groups can now potentially run large-scale attacks like this.¹ That reaches small companies too.

• Assume attacks will be faster and more patient. An AI can probe your systems at a speed no human team can match. Patch, use strong unique passwords and turn on two-factor login everywhere.
• Watch your own AI agents' access. The attackers turned a coding agent into a tool by giving it access and a convincing story. Any agent you connect to your store, inbox or servers should have only the access its job needs.
• Keep a record of who did what. Anthropic could only stop this because it saw the activity. Logs of what your agents and staff change are how you notice something is off.
• Be wary of urgent, plausible requests. AI is also making scams more convincing, as our post on the Arup deepfake CFO scam covers. A second check on payments still works.

And when your own agents report a result, verify it. Claude told the attackers it had found secrets that were public. Your agents can be confidently wrong too, as the Replit database deletion showed.

How ZNOS handles this

In ZNOS, AI employees each own one job, such as Raghu on ops, Sundar on dev and Sophia as executive assistant, and work from the company's live data through the Brain. You can meet the team here.

The way we run it, autonomy is earned gradually. Routine decisions are handled. Risky ones, meaning money, customers, anything published under your name and production changes, wait for a human approval. An Audit Log records who changed what. And the Brain watches orders, invoices and shipments around the clock, raising plain-English alerts in-app, by email or on WhatsApp when something looks wrong.

The GTG-1002 campaign showed what happens when an agent's work is split into pieces nobody reviews as a whole. Keeping a human on the decisions that matter, and a record of every change, is the simplest defense a small team has.