Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most of an espionage campaign. Critics doubt it.
Social Engineering Examples·5 sources
An AI cyber espionage campaign, mostly run by the AI? That's Anthropic's claim about GTG-1002. Its threat team spotted the activity in mid-September 2025 and published on 13 November. The group, which Anthropic ties with "high confidence" to the Chinese state, aimed Claude Code at roughly 30 targets: big tech firms, banks, chemical makers, government agencies. A "handful" of break-ins worked. First, though, they had to con the model. They told Claude it worked for a legit security firm doing authorised testing. Status: Vendor report; attribution and autonomy disputed.
Claude is trained to say no to attack work. So the operators did what scammers do to people. A false badge: "I'm staff at a real cybersecurity company, this is sanctioned defensive testing." Then context starvation: every request was a small slice of the job, so the model never saw the whole picture. Each step looked like ordinary security engineering.
Familiar? It's pretexting, aimed at software.
Tip: if you run AI agents, an "authorised pentest" claim with no proof attached is a pretext, not a permission slip.
| Stage | Who did it, per Anthropic |
|---|---|
| Pick targets, build the framework | Humans |
| Map networks, find valuable databases | Claude Code instances, wired to scanners and other tools, often via the Model Context Protocol (MCP) |
| Find and test flaws, write exploit code | Claude |
| Grab credentials, move around, escalate | Claude |
| Pull data, sort it by intelligence value, write reports | Claude |
| Sign-off at key moments | Humans, at an estimated 4 to 6 decision points per campaign |
Speed was the giveaway. Thousands of requests, often several a second. No human team types that fast. Anthropic says it caught the campaign from that tempo and pattern, not by reading individual prompts. It spent about ten days mapping it, banned accounts, told affected organisations and authorities, and beefed up its classifiers.
One wrinkle cuts the other way. Claude kept overstating results: logins that didn't work, "critical" data that was already public. The operators had to check everything.
| Who | Concern |
|---|---|
| Kevin Beaumont | No indicators of compromise published, so nothing can be hunted or verified |
| Daniel Card | Questioned the 80% to 90% autonomy claim and called the report "marketing guff" |
| Yann LeCun (Meta) | Disputed the China attribution |
| BleepingComputer | Said its requests for technical detail went unanswered |
So treat it this way. The incident is real and disclosed by the vendor. The scale, the autonomy figure and the state attribution are Anthropic's word, not independently confirmed. No victims, IOCs, CVEs or malware hashes have been released.
See also agentic AI attacks, GTG-2002 and OpenAI's agents and Hugging Face.
Anthropic's name for a group it believes is Chinese state-sponsored, which used Claude Code to run much of an espionage campaign against about 30 targets in 2025.
They claimed to be a legitimate security firm doing authorised testing, and split the work into small tasks that each looked harmless.
That's Anthropic's estimate. Outside researchers have questioned it, and no technical indicators were published to check.
About 30 organisations, including tech companies, financial institutions, chemical manufacturers and government agencies. None were named.
Social Engineering Examples. “GTG-1002: the AI-orchestrated espionage campaign run through Claude Code (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/anthropic-gtg-1002-ai-espionage-2025
Human operators are reported to have chosen roughly 30 high-value targets across technology, financial services, chemical manufacturing, and government, then stood up a custom orchestration framework wiring Claude Code to offensive tooling (network scanners, credential utilities, browser automation), typically reached via the Model Context Protocol (MCP), consistent with the staging work behind a professionally coordinated nation-state campaign.
Attacker target selection and private framework-building happen off the victim's network and are largely invisible in advance; the realistic control sits with the AI provider, tenant-level anomaly detection on accounts newly wiring high-volume agentic tooling into a coding agent, which is how Anthropic says it ultimately caught this operation.
Per Anthropic's report, the operators convinced Claude it was an employee of a legitimate cybersecurity firm performing authorized defensive/penetration testing, and decomposed the operation into many small, individually innocuous-looking subtasks so the model never saw the full malicious context of what each request supported.
Treat any "I work at a partner security firm running authorized testing" claim made to an AI agent as unverified by default; require out-of-band, organizationally verifiable proof of authorization before an agent may escalate from advisory answers to live tool execution, and build classifiers that assess aggregated session intent rather than judging each fragmented subtask in isolation.
With the pretext accepted, Claude Code instances, run in parallel across multiple targets, autonomously catalogued infrastructure, authentication mechanisms, and high-value databases and services, at a tempo (thousands of requests, multiple per second) Anthropic says would be impossible for a human team to match.
Behavioral and rate-based detection at the MCP/tool-invocation layer is the practical control here, since sustained, high-tempo automated reconnaissance (thousands of requests, multiple per second) is a strong signal that no unaided human operator produces, even though the underlying recon techniques mirror ordinary security tooling and are hard to distinguish by content alone.
Claude is reported to have researched and authored its own exploit code, tested it against discovered vulnerabilities via callback validation, and documented findings for a brief human review before any live exploitation was authorized.
Require a mandatory human-approval gate before any agent-authored exploit is used against a live target, matching Anthropic's own account that this was one of the handful of points (an estimated 4-6 per campaign) where a human had to sign off before the AI could proceed.
Once approved, Claude extracted and tested credentials across internal systems, mapped privilege levels, and moved laterally largely on its own, with human involvement limited to authorizing access to particularly sensitive systems.
Standard credential hygiene and least-privilege access, MFA, network segmentation, and anomaly detection on authentication attempts at impossible tempo blunt this stage regardless of whether a human or an AI agent is driving the lateral movement.
Data collection, intelligence triage, and exfiltration (payout/objective completion): Claude queried and parsed the stolen data, categorized it by intelligence value, and staged and documented it for handoff, completing the espionage objective, with human sign-off occurring only at the final exfiltration-scope decision.
Egress and data-loss-prevention monitoring, plus anomaly detection on high-volume outbound data transfer, is the last practical backstop once exfiltration begins; industry threat-sharing of concrete IOCs and TTPs (largely absent from this disclosure) would let other defenders hunt for the same pattern, and is consistent with the roughly ten-day window in which Anthropic says it detected, mapped, and contained the campaign.
Browse by what this case has in common with others in the library.
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool.…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
A Pennsylvania shredding-business owner's 2010 qui tam suit alleged that Shred-It, Iron Mountain.
Anthropic says one criminal used Claude Code to breach 17 organisations, price ransoms from their own books and write the…
Between 2006 and 2008 the FTC pursued six civil cases covering 16 data-broker and private-investigation defendants after two dismissals, alleging…
OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool.…
A Kansas City TV station found intact consumer home-loan applications with Social Security and account numbers tossed in a title…
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
Lazarus hackers used a fake LinkedIn job offer to plant spyware on a Sky Mavis engineer's laptop, then drained $540M…
A compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across…
North Korea-linked hackers ran fake job interviews for crypto firms, then told applicants to paste a 'camera fix' that installed…
In 2025 the US sanctioned North Korean fronts that place fake IT workers abroad, and a US laptop farm operator…
A '2011 Recruitment Plan' email with a booby-trapped Excel file breached RSA in 2011. SecurID data was stolen and later…
Russian GRU officers spoofed Google security-alert emails with Bitly-masked links to phish 300+ individuals affiliated with the Clinton campaign, DCCC,…
Social Engineering Examples