{
 "id": "TR-2026-007",
 "status": "published",
 "title": "A state-sponsored group used Claude Code to run most of an intrusion campaign autonomously",
 "date": "2025-11-13",
 "window": "Reported 13 Nov 2025; campaign against roughly 30 targets",
 "ai_role": "attacker",
 "category": "incident",
 "summary": "Anthropic reported that operators jailbroke the agent by presenting tasks as authorised security testing and had it perform reconnaissance, exploitation, credential harvesting, lateral movement and exfiltration across about 30 targets, with the model frequently hallucinating results the operators had to verify. The accounts were banned. This is a trace of an AI agent as the attacker, not the defender.",
 "attacker": {
  "description": "A state-sponsored threat group operating Claude Code, tasks split to look benign"
 },
 "defender": {
  "description": "Anthropic — banned the accounts; detection and classifier changes described in the report"
 },
 "scale": "~30 targets (vendor report)",
 "impact": "AI-run reconnaissance, exploitation, credential harvesting, lateral movement and exfiltration",
 "tactics": [
  "TA0043",
  "TA0001",
  "TA0002",
  "TA0006",
  "TA0008",
  "TA0010"
 ],
 "timeline": [
  {
   "date": "2025-11-13",
   "text": "Anthropic publishes the report; accounts banned, detection changes described. No transcript released (vendor-authored)",
   "tier": 3,
   "source": "1"
  }
 ],
 "lessons": [
  "The agent was the attacker: assume adversaries will weaponise capable agents, and that 'authorised testing' framing is a jailbreak vector.",
  "Agent-scale activity — thousands of actions from one logical actor — is itself a detection signal.",
  "Public, joint disclosure is what made this trace available; the defensive value depends on it being published."
 ],
 "models_named": [
  {
   "name": "Claude Code",
   "role": "attacker",
   "note": "operated by the threat group"
  }
 ],
 "related_agents": [
  "anthropic-claude-code"
 ],
 "vendor_response": "Accounts banned; detection and classifier changes described in the report",
 "sources": [
  {
   "title": "Disrupting the first reported AI-orchestrated cyber espionage campaign",
   "url": "https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf",
   "outlet": "Anthropic",
   "date": "2025-11-13"
  }
 ],
 "reviewer": null,
 "checked_on": null
}