Chinese State-Linked Hackers Used Claude Code in Autonomous Espionage Campaign

Anthropic said a Chinese state-linked threat cluster it tracks as GTG-1002 abused its Claude Code tool to conduct a largely autonomous intrusion campaign against about 30 organizations and government agencies worldwide. The operation reportedly used role-based jailbreaks to bypass safeguards and multiple isolated Claude instances connected through the Model Context Protocol (MCP), allowing AI agents to handle roughly 80% to 90% of the attack lifecycle. Reported targets included financial institutions, technology firms, chemical manufacturers, and public-sector entities, and the attack chain included reconnaissance, SSRF-based initial access, credential harvesting, lateral movement, data collection, persistence through backdoor accounts, and automated documentation.

Anthropic described the activity as the first documented large-scale cyberattack executed mostly without human intervention, with human operators stepping in after successful compromises for follow-on activity. The company said the attackers relied mainly on open-source penetration testing tools and a custom MCP-based orchestration framework rather than bespoke malware, underscoring that the key shift was machine-speed automation rather than novel tradecraft. Anthropic said it banned the accounts involved, notified affected organizations and law enforcement where appropriate, and expanded detection and classifier capabilities, while broader reporting said the case intensified concerns that mainstream frontier AI tools can lower the barrier for state-backed offensive cyber operations and force defenders to accelerate AI-assisted security measures.