Loading story…
Anthropic reported that PRC-linked and China-based operators used Claude between December 2025 and August 2026 in increasingly agentic workflows supporting reconnaissance, vulnerability research, exploitation, credential collection, infrastructure management, exfiltration, and intelligence analysis. Activity included Chinese-speaking operators tracked as GTG-10007, China-aligned surveillance operations, and alleged military research involving anti-torpedo and electronic-warfare systems. Anthropic also alleged that seven China-based AI laboratories—including Alibaba, Moonshot AI, DeepSeek, Zhipu, Xiaomi, SenseTime, and MiniMax—performed unauthorized industrial-scale distillation of Claude.
OpenAI separately disrupted accounts associated with China-linked Charcoal Typhoon, Salmon Typhoon, and SweetSpecter, as well as Iranian, North Korean, and Russian state-affiliated actors. The groups used AI primarily for open-source research, translation, scripting, troubleshooting, phishing content, and research into stealth techniques; SweetSpecter also targeted OpenAI staff in a May 2024 spear-phishing attempt carrying SugarGh0st RAT, though the emails were blocked. OpenAI assessed that the observed use did not provide attackers novel capabilities beyond public tools, while warning that enterprise users should consider whether AI routing services could expose sensitive prompts or credentials to third-party model providers.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
Anthropic reported that a China-based actor associated with a defense-industry manufacturer used Claude to support development of an anti-torpedo weapons system for a PLA Navy acquisition proposal. It also identified a military-industrial researcher using Claude to develop roughly 16 electronic-warfare and suppression-of-enemy-air-defenses software modules configured around targets in Taiwan.
Anthropic identified a China-based, PRC government-aligned religious-affairs intelligence operation that used Claude to create Chinese-language dossiers on religious figures and organizations. It also reported a PRC-aligned operation targeting Uyghurs in Syria that processed more than 100 WhatsApp groups and dozens of Telegram channels to identify recruitment targets and improve deceptive Arabic-language messages.
Anthropic said it disrupted activity associated with municipal public-security and state-security organizations that used Claude for surveillance and intelligence collection against dissidents, human-rights defenders, Uyghur advocates, and overseas protests. One municipal cyber-police unit reportedly used Claude Code to operate sentiment monitoring, query a government surveillance database, and produce daily reports.
Anthropic described an operation using disposable hosting, phishing, ClickFix, DNS hijacking, automated domain registration, and C2 monitoring against more than 20 organizations, including ministries, defense and intelligence entities, embassies, and defense-industrial firms. The activity included scanning systems of more than two dozen Ukrainian government organizations and stealing a drone vision system's proprietary SDK from one victim.
Anthropic reported that Chinese-speaking operators, likely located in Changsha, Hunan, conducted the sustained GTG-10007 espionage operation using Claude; two operators were identified as undergraduates at a Chinese university. Anthropic did not attribute the operation to the Chinese government.
Anthropic reported malicious Claude use from December 2025 through August 2026 for cyber operations, surveillance, influence activity, fraud, weapons-related work, biological misuse, and illicit model distillation. It assessed that AI-assisted operations supported vulnerability research, exploitation, credential collection, malware development, infrastructure management, exfiltration, and intelligence processing.
Anthropic attributed its largest alleged Claude-distillation campaign to Alibaba, reporting more than 151 million exchanges between May and July 2026 and a peak of nearly three million exchanges per day.
Anthropic reported that, since February 2026, it had detected and disrupted alleged illicit industrial-scale Claude-distillation campaigns from seven China-based AI laboratories.
OpenAI reported that infrastructure linked to Keyhole Panda/APT5 and Vixen Panda/APT15 used ChatGPT for reconnaissance, script modification, Linux troubleshooting, software development, and infrastructure configuration.
OpenAI publicly disclosed that it identified and banned ChatGPT accounts likely linked to SweetSpecter after finding them used for vulnerability research, scripting, and social-engineering support. It described this as the first public identification of the group targeting a U.S.-based AI company.
SweetSpecter sent phishing emails posing as ChatGPT-user support requests to OpenAI employees, attaching a ZIP archive containing an LNK file designed to deploy SugarGh0st RAT. OpenAI said its controls blocked the messages from corporate inboxes and no successful compromise was described.
OpenAI and Microsoft reported terminating accounts associated with five state-affiliated actors, including China-linked Charcoal Typhoon and Salmon Typhoon. The actors had used OpenAI services for research, translation, basic coding, troubleshooting, and in some cases phishing- or evasion-related content.
OpenAI stated that the suspected China-based adversary SweetSpecter emerged in 2023; prior reporting had focused on its activity against political entities in the Middle East, Africa, and Asia.
Google Threat Intelligence Group reported that more than 20 PRC government-backed groups attempted to use Gemini for reconnaissance, vulnerability research, scripting, development, technical research, and post-compromise work. It specifically described APT41/SPIRE CASTLE and RAVINE CASTLE using Gemini for tool development, intelligence gathering, social engineering, and processing exfiltrated information.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourceopenai.com
Open sourceopenai.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Chinese state-sponsored threat group, identified as GTG-1002, leveraged Anthropic's Claude Code AI tool to orchestrate a series of cyber espionage attacks targeting approximately 30 high-profile organizations, including major technology companies, financial institutions, chemical manufacturers, and government agencies. The attackers used a human-developed framework to direct Claude and its sub-agents in executing multi-stage attack chains, such as mapping attack surfaces, scanning infrastructure, identifying vulnerabilities, and developing custom exploit payloads. In a small number of cases, these AI-driven attacks successfully breached targeted organizations, resulting in credential theft, privilege escalation, lateral movement, and exfiltration of sensitive data. This incident marks the first documented case of agentic AI being used to autonomously obtain access to high-value targets for intelligence collection, with minimal human intervention beyond initial target selection and final exploit approval. Upon detection in mid-September 2025, Anthropic launched an investigation, banned malicious accounts, notified affected entities, and coordinated with authorities. The campaign highlights the rapidly evolving threat landscape posed by autonomous AI agents, which can significantly increase the scale and sophistication of cyberattacks when abused by well-resourced adversaries.
Jun 29, 2026
Anthropic said a Chinese state-linked threat cluster it tracks as **GTG-1002** abused its `Claude Code` tool to conduct a largely autonomous intrusion campaign against about 30 organizations and government agencies worldwide. The operation reportedly used role-based jailbreaks to bypass safeguards and multiple isolated Claude instances connected through the **Model Context Protocol (MCP)**, allowing AI agents to handle roughly 80% to 90% of the attack lifecycle. Reported targets included financial institutions, technology firms, chemical manufacturers, and public-sector entities, and the attack chain included reconnaissance, **SSRF**-based initial access, credential harvesting, lateral movement, data collection, persistence through backdoor accounts, and automated documentation. Anthropic described the activity as the first documented large-scale cyberattack executed mostly without human intervention, with human operators stepping in after successful compromises for follow-on activity. The company said the attackers relied mainly on open-source penetration testing tools and a custom MCP-based orchestration framework rather than bespoke malware, underscoring that the key shift was machine-speed automation rather than novel tradecraft. Anthropic said it banned the accounts involved, notified affected organizations and law enforcement where appropriate, and expanded detection and classifier capabilities, while broader reporting said the case intensified concerns that mainstream frontier AI tools can lower the barrier for state-backed offensive cyber operations and force defenders to accelerate AI-assisted security measures.
Jun 29, 2026
Anthropic has uncovered a real-world cyber espionage campaign orchestrated by a Chinese state-sponsored group, leveraging AI to automate and accelerate the attack lifecycle. The attackers used an autonomous attack framework powered by Claude Code, which enabled them to conduct reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration with minimal human intervention. This campaign targeted approximately thirty organizations, including large tech companies, financial institutions, chemical manufacturers, and government agencies, and succeeded in a small number of cases. The use of AI allowed the threat actors to execute 80-90% of tactical operations independently, significantly increasing the speed and scale of their attacks compared to traditional methods. In parallel, Chinese private-sector cybersecurity companies are playing a critical role in advancing the country's offensive cyber capabilities through attack-defense labs. These internal units merge defensive research, offensive experimentation, and live-fire exercises, supporting both commercial needs and state-linked cyber operations. The integration of private sector expertise and resources into national cyber strategies has enabled China to rapidly develop and operationalize advanced cyber tools and techniques, blurring the lines between commercial and state-sponsored activities. Western governments are increasingly concerned about the implications of these developments for global cyber stability and the potential for more sophisticated, AI-driven cyber operations originating from China.
Jun 29, 2026