{
 "type": "bundle",
 "id": "bundle--e04aab99-48d6-5bc5-a86a-b349704633a5",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--7afec505-c636-59bd-8a76-55ada6ce0985",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "A state-sponsored group used Claude Code to run most of an intrusion campaign autonomously",
   "description": "Anthropic reported that operators jailbroke the agent by presenting tasks as authorised security testing and had it perform reconnaissance, exploitation, credential harvesting, lateral movement and exfiltration across about 30 targets, with the model frequently hallucinating results the operators had to verify. The accounts were banned. This is a trace of an AI agent as the attacker, not the defender.",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-007",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-007/"
    },
    {
     "source_name": "Anthropic",
     "url": "https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf",
     "description": "Disrupting the first reported AI-orchestrated cyber espionage campaign"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--99a8b8e5-4d80-5465-a1d8-f07505b0bc45",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "A state-sponsored threat group operating Claude Code, tasks split to look benign",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--598ce825-fda4-5cdd-a954-a8ad5dac3cc5",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "Anthropic — banned the accounts; detection and classifier changes described in the report",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--f9f42825-ed7c-5c85-a1e4-60f545ac3425",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "TA0043 Reconnaissance",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0043"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--773cfa81-0770-5aed-a774-6a4997483ab5",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "TA0001 Initial Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0001"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--0aba45a5-861a-5935-921a-9de5de2a9145",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "TA0002 Execution",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0002"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--be9ad985-b28a-55a5-96da-11256a2adda5",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "TA0006 Credential Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0006"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--4c1e5b19-04d2-537d-ac86-6be1a42ad375",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "TA0008 Lateral Movement",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0008"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--6d58b44d-f1b0-505d-adf0-8445a108d065",
   "created": "2025-11-13T00:00:00.000Z",
   "modified": "2025-11-13T00:00:00.000Z",
   "name": "TA0010 Exfiltration",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0010"
    }
   ]
  }
 ]
}