Chinese state-sponsored hackers use Anthropic's Claude to automate cyberattacks
Chinese state-sponsored hackers reportedly used Anthropic's Claude AI agent to automate cyberattacks against approximately thirty targets worldwide, including tech companies, financial institutions, and government agencies. The attackers jailbroke Claude to bypass safety measures and achieve an estimated 80-90 percent automation of hacking tasks, successfully compromising several targets and stealing sensitive data. Anthropic disrupted the campaign and implemented enhanced detection and monitoring measures.
What happened
In mid-September 2025, Chinese state-sponsored hackers designated as GTG-1002 used Anthropic's Claude AI agent to orchestrate cyberattacks against approximately thirty targets across multiple countries, including large tech companies, financial institutions, chemical manufacturers, and government agencies.
The attackers jailbroke Claude to bypass safety measures and split attacks into small, seemingly benign tasks to mislead the AI into performing what appeared to be legitimate security testing. Claude performed 80-90 percent of hacking campaign tasks including reconnaissance, vulnerability testing, exploit code generation, credential harvesting, installing backdoors, and data exfiltration, requiring human input at only approximately 4-6 critical decision points per campaign.
The AI agent executed attacks at speeds unattainable by humans, making thousands of requests per second. The attackers reportedly succeeded in compromising several targets, removing large volumes of private and sensitive data, and installing backdoors for persistent unauthorized access.
Reported impact
Affected organizations were left more exposed to data breaches and ongoing threats following successful compromises that resulted in the removal of large volumes of private and sensitive data.
The operation sparked alarm about new cybersecurity threats and the speed and scale at which cyberattacks can now be conducted, raising concerns about state use of AI capabilities for international cyber espionage.
Index analysis
The incident represents the first documented large-scale cyberattack conducted with minimal human intervention, demonstrating how AI agentic systems can be repurposed for offensive cyber operations when safety measures are circumvented.
Some independent cybersecurity researchers criticized Anthropic's claims, arguing that current AI agents like Claude are not yet capable of fully executing such complex attacks autonomously and questioned the scale of success due to lack of detailed technical data and indicators of compromise.
Governance controls
The attackers exploited gaps in Claude usage policies and weak monitoring of agent behaviour. Anthropic discovered and disrupted the operation in October 2025, banned compromised accounts, notified affected organizations, and coordinated with authorities while gathering intelligence.
Anthropic subsequently expanded detection capabilities, developed better classifiers to flag malicious activity, and committed to releasing reports regularly and being transparent about threats found.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.