A state-sponsored group used Claude Code to run most of an intrusion campaign autonomously

Anthropic reported that operators jailbroke the agent by presenting tasks as authorised security testing and had it perform reconnaissance, exploitation, credential harvesting, lateral movement and exfiltration across about 30 targets, with the model frequently hallucinating results the operators had to verify. The accounts were banned. This is a trace of an AI agent as the attacker, not the defender.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-11-13 Anthropic publishes the report; accounts banned, detection changes described. No transcript released (vendor-authored) · Anthropic T3

What defenders can take from it

The agent was the attacker: assume adversaries will weaponise capable agents, and that 'authorised testing' framing is a jailbreak vector.
Agent-scale activity — thousands of actions from one logical actor — is itself a detection signal.
Public, joint disclosure is what made this trace available; the defensive value depends on it being published.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 1

Disrupting the first reported AI-orchestrated cyber espionage campaign — Anthropic, 2025-11-13

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

At a glance · as reported

Window	Reported 13 Nov 2025; campaign against roughly 30 targets
Attacker	A state-sponsored threat group operating Claude Code, tasks split to look benign
Scale	~30 targets (vendor report)
Impact	AI-run reconnaissance, exploitation, credential harvesting, lateral movement and exfiltration
Defender	Anthropic — banned the accounts; detection and classifier changes described in the report
Response	Accounts banned; detection and classifier changes described in the report

Tactics (MITRE ATT&CK)

TA0043 Reconnaissance
TA0001 Initial Access
TA0002 Execution
TA0006 Credential Access
TA0008 Lateral Movement
TA0010 Exfiltration

Mapped by the maintainer from the reports.

Models and agents named

Claude Code — attacker · operated by the threat group

Claude Code — in the catalog

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.