Anthropic detects espionage campaign carried out with AI agents

Anthropic detected a cyberespionage campaign in which a group the company attributes with high confidence to a Chinese state actor used Claude Code to target around 30 organizations worldwide. The AI carried out between 80% and 90% of the operation, with human involvement limited to a few key moments.

The company describes the case as the first documented large-scale attack in which artificial intelligence executed most of an espionage campaign without constant human supervision. The targets included technology companies, financial institutions, chemical firms, and government agencies.

The AI did more than advise: it acted

The attack began in mid-September 2025. Human operators selected the targets and built a system to automate the intrusion. They then connected that system to Claude Code, a tool capable of writing and executing code, retrieving information, and chaining tasks together.

To get around the model's security measures, the attackers divided the operation into small instructions that appeared legitimate. They also presented Claude as an employee of a cybersecurity company conducting defensive tests.

That allowed the system to move forward without showing the AI the full malicious context of the campaign.

The model handled much of the work:

• Analyzed each target's networks and systems.
• Located databases and other high-value resources.
• Investigated vulnerabilities and wrote code to exploit them.
• Searched for credentials, such as usernames and passwords.
• Created persistent access and extracted private information.
• Classified stolen data according to its potential value.
• Documented compromised systems and the credentials it found.

Anthropic says Claude generated thousands of requests per second, a pace impossible for a human team to maintain. The company says the group only had to intervene occasionally, roughly four to six critical decisions per campaign.

It still made mistakes

The automation was not perfect. At times, Claude invented credentials or claimed to have found secret information that was actually already public. These errors remain an obstacle to running an attack campaign from beginning to end without supervision.

But that does not make the problem go away. Even when AI makes mistakes, it can accelerate tasks that previously required entire teams of specialists. An attacker with less experience or fewer resources could use it to analyze more systems, try more avenues, and process large volumes of data in far less time.

Anthropic says it identified the activity, blocked the accounts involved, notified the affected organizations when appropriate, and worked with authorities during a ten-day investigation. The company has not publicly detailed how many organizations were compromised, but says the attackers succeeded in only a small number of cases.

What changes for cybersecurity

The case shows why so-called AI agents require different controls. An agent does not just answer a question: it can take action over long periods, decide what to do next, and use external tools with little supervision.

That capability can also be used to defend systems. Anthropic's threat intelligence team used Claude to analyze the huge volumes of data generated during the investigation. The company recommends applying AI to tasks such as:

• Automating monitoring in security operations centers.
• Detecting suspicious behavior.
• Assessing vulnerabilities before attackers exploit them.
• Responding quickly to incidents.

The difference from earlier campaigns that Anthropic calls ad hoc hacking is the level of autonomy. In those operations, humans closely directed every step. In this one, the AI carried out much of the operational work, leaving the attackers focused on specific decisions.

For you, the most important change is that a sophisticated intrusion may require fewer people and less time. Companies will have to monitor not only who enters their systems, but also the speed and autonomy with which connected tools behave. What comes next will be a race between agents capable of attacking at scale and defense systems capable of detecting them before they establish a foothold.