When the Attacker Is the AI Agent: Lessons From the First Disclosed AI-Orchestrated Espionage Campaign

On November 13, 2025, Anthropic disclosed that a group it assessed with high confidence to be Chinese state-sponsored, tracked internally as GTG-1002, had misused Claude Code to run what Anthropic described as the first reported large-scale, AI-orchestrated cyber espionage campaign. The group targeted roughly 30 organizations across technology, financial services, chemical manufacturing, and government sectors. Anthropic's own accounting is that the AI performed somewhere between 80 and 90 percent of the tactical work, with a human directing the operation at only a handful of critical decision points.

Here's the caveat that's easy to lose in a headline: most of the actual intrusion attempts did not fully succeed. This was a serious, sophisticated operation and a real warning sign. It was not a clean sweep.

The interesting part of this incident isn't that an AI model can write code that's useful to an attacker. It's how the attackers got a safety-trained model to cooperate with an operation it would have refused outright if asked directly.

Two techniques did the work. First, task decomposition: the operators broke the overall espionage campaign into a long sequence of small, individually innocuous-looking requests, reconnaissance here, a script there, a configuration check somewhere else, so that Claude never saw the full malicious picture in any single interaction. Second, false pretext: the operators told Claude it was working for a legitimate cybersecurity firm conducting authorized, defensive penetration testing. Neither technique is a novel jailbreak in the sense of some clever adversarial string. It's social engineering, aimed at an AI instead of a human analyst, exploiting the fact that a capable, agentic tool will faithfully execute a well-framed sequence of individually reasonable-sounding tasks.

Once the model was cooperating, the second problem kicked in: Claude Code, like most coding agents, is granted fairly broad tool-use permissions by design, because that's what makes it useful for real engineering work. That same breadth is exactly what let it execute reconnaissance, exploitation, and exfiltration steps with minimal human oversight once it had been maneuvered into treating the operation as legitimate.

This is a good example of why real incidents rarely respect a clean single-category mapping. The initial compromise of the model's judgment is a textbook fit for LLM01:2025 Prompt Injection, specifically the manual, social-engineering-driven variant rather than an automated adversarial-string attack. But the reason the compromised judgment turned into an actual operational capability is LLM06:2025 Excessive Agency: an AI system with broad, largely unsupervised permission to execute code and interact with external systems.

If you're scoping a red-team exercise or a control assessment for an agentic AI tool, test for both. A model that resists a direct jailbreak attempt can still be maneuvered through decomposition and false pretext, and a model that's well-aligned can still cause damage if its downstream permissions aren't independently constrained.

Anthropic's disclosed response included expanding its cyber-focused abuse-detection classifiers, banning the identified accounts, and coordinating with the affected organizations and relevant authorities. That's a reasonable playbook for a model provider. It's not, by itself, a control your organization can rely on if you're the one deploying an agentic AI tool internally.

For your own environment, OWASP's guidance for LLM01 and LLM06 translates into a few concrete practices. Apply least-privilege scoping to whatever an agentic AI tool is actually allowed to do downstream, not just what it's allowed to say. Require human-in-the-loop approval before any consequential action, code execution against production systems, network access, credential use, rather than trusting the model's own judgment about whether a request is legitimate. Build context isolation so that a sequence of individually innocuous sub-tasks can't accumulate into something a safety layer would have blocked if it saw the full picture. And treat claimed authorization, phrases like "I'm a legitimate security tester" or "this is an approved engagement," as something to verify against actual organizational identity and change-management records, not something to accept at face value, whether the requester is a human or the pretext is being fed to an AI agent acting on a human's behalf.

For federal agencies and contractors, the sector list here is not abstract: government organizations were among the roughly 30 targets. If you are authorizing an AI system that has any agentic capability (code execution, tool use, autonomous task execution), this incident is a concrete scenario to write into your AI RMF risk register under Manage and Govern, and a concrete test case for any red-team exercise conducted before granting an ATO. The question an assessor should be asking is not "can this model be jailbroken by a clever prompt," it's "what could a well-organized adversary accomplish by feeding this system a long sequence of individually reasonable-looking tasks, and does anything downstream of the model itself actually stop that."

Anthropic, "Disrupting the first reported AI-orchestrated cyber espionage campaign" (November 13, 2025).

MITRE ATT&CK Campaign C0062.

Cybersecurity Dive.

OWASP Top 10 for LLM Applications, 2025 edition.