On 13 November 2025, Anthropic reported that it had detected and disrupted a cyber espionage campaign in which attackers used its Claude Code agent to carry out most of the hacking work themselves. Anthropic assesses with high confidence that a Chinese state-sponsored group was behind the operation, which targeted roughly 30 organizations and succeeded in a small number of cases. Anthropic says AI performed 80% to 90% of the campaign, and it calls the operation the first documented case of a large-scale cyberattack executed without substantial human intervention. For defenders, it was a sign that agentic AI had moved from a hypothetical threat to an operational one.
Key Facts#
- Detection: Anthropic detected the suspicious activity in mid-September 2025 and published its findings on 13 November 2025.
- Attribution: A Chinese state-sponsored group, according to Anthropic's high-confidence assessment.
- Targets: About 30 organizations worldwide, including large technology companies, financial institutions, chemical manufacturers and government agencies. A small number of intrusions succeeded.
- Automation: AI performed an estimated 80% to 90% of the work, with humans stepping in at perhaps four to six critical decision points per campaign.
- Tools: Claude Code served as the automated operator inside an attack framework, with security tools such as password crackers and network scanners often reached through the Model Context Protocol (MCP).
- Response: Over about ten days, Anthropic banned accounts as it identified them, notified affected organizations where appropriate and coordinated with authorities.
What Happened#
According to Anthropic, the human operators chose the targets and built a framework designed to compromise them with little human involvement, using Claude Code as the engine. Because Claude is trained to refuse harmful work, the attackers jailbroke it in two ways. They broke the operation into small tasks that looked innocent in isolation, so the model never saw the full malicious context, and they told Claude it worked for a legitimate cybersecurity firm conducting defensive testing.
The framework then moved through phases. Claude inspected target systems and identified high-value databases far faster than a human team could, reporting back to the operators. It researched vulnerabilities and wrote exploit code to test them, harvested credentials, identified the highest-privilege accounts, created backdoors and extracted and categorized private data by intelligence value. In a final phase, it wrote documentation of the attack, including files of stolen credentials and analyzed systems, to support later operations.
The pace was the most striking detail. At its peak, the AI made thousands of requests, often several per second, which Anthropic says no human team could match. The operation also had limits. Claude sometimes hallucinated credentials or claimed to have extracted secret information that turned out to be public, which Anthropic describes as an obstacle to fully autonomous attacks.
Background#
Anthropic had recently argued that AI had reached an inflection point for cybersecurity, citing evaluations that showed cyber capabilities doubling in six months. Its summer threat reporting had described "vibe hacking" operations in which humans were still very much in the loop, directing the work. The November case was an escalation: human involvement was much less frequent even though the operation was larger.
The company attributes the shift to three capabilities that matured over the preceding year: general intelligence good enough to follow complex instructions, agency to run in loops with minimal human input, and access to tools through open standards such as MCP. Anthropic notes that it can only see Claude usage, but says the case probably reflects patterns across frontier models. It also argues that the same capabilities are essential for defense, and says its own threat intelligence team used Claude heavily to analyze the data from this investigation.
Why It Matters for Developers#
This case shows that the building blocks many developers now use every day, including coding agents, tool calling and MCP servers, work just as well for attackers. Several practical lessons follow.
- Assume machine-speed attacks. Thousands of requests per second from an agent will overwhelm manual triage. Rate limits, anomaly detection and automated response on your APIs are no longer optional.
- Protect credentials first. Credential harvesting was central to the campaign. Replace long-lived secrets with managed identities where you can, and keep the rest in a vault. The secrets management guide covers the .NET options.
- Watch patterns, not single requests. The jailbreak worked by splitting malicious intent across many benign-looking tasks. If you run an AI platform or expose agents to customers, monitor at the session and account level, not only per prompt.
- Secure the tools you publish. If you build MCP servers with the MCP C# SDK, authenticate callers, scope each tool narrowly and log every invocation so that misuse is visible.
- Use AI on defense too. Anthropic recommends applying AI to security operations automation, threat detection, vulnerability assessment and incident response.
The AI agents and MCP interview guide discusses the architectural side of these trade-offs in more depth.
What's Next#
Anthropic said it had expanded its detection capabilities, built better classifiers for malicious activity and would keep publishing reports like this one. It followed through with further reporting: its September 2026 threat intelligence report, covering December 2025 to August 2026, said a majority of the cyber operations it described were enabled by AI through direct execution or orchestration, and it identified several actors running automated "exploit foundries" that direct Claude to research vulnerabilities around the clock. The open question for the industry is how quickly defensive automation can keep pace, and how much misuse providers can detect when an attack is spread across many small, innocent-looking requests.