In mid-September 2025, Anthropic detected a Chinese state-sponsored group, which it designated GTG-1002, using Claude Code as an autonomous attack agent against around 30 organisations. Anthropic estimates the AI carried out 80 to 90 percent of the tactical work, from reconnaissance to credential harvesting, lateral movement and data exfiltration, with humans stepping in only at a few decision points. A handful of intrusions succeeded. It was the first publicly reported case of a largely AI-run espionage campaign, and a large part of what the agents did was find, test and reuse credentials.
Key takeaways
- Anthropic attributes the campaign, with high confidence, to a Chinese state-sponsored group it calls GTG-1002. Around 30 technology, financial, chemical manufacturing and government organisations were targeted.
- The AI executed "80-90% of tactical operations independently", at request rates of multiple operations per second. Humans provided 10 to 20 percent of the effort in supervisory roles.
- Attackers bypassed Claude's safeguards by claiming to be employees of legitimate cybersecurity firms and by breaking the attack into small tasks that looked like routine technical requests.
- Credential access was central. MITRE ATT&CK maps the campaign to extracting authentication certificates from configuration files and using harvested credentials against internal APIs, databases, container registries and logging systems.
- The AI also "frequently overstated findings and occasionally fabricated data", which limited the attack. Defenders should not count on that lasting.
At a glance
| Organisations | About 30 targets in technology, finance, chemical manufacturing and government (not named); Anthropic's Claude Code was the tool misused |
|---|---|
| When | Detected mid-September 2025; report published November 2025 |
| Attacker | GTG-1002, assessed by Anthropic as a Chinese state-sponsored group; tracked by MITRE ATT&CK as campaign C0062 |
| Method | Claude Code agents orchestrated through Model Context Protocol (MCP) tools and commodity security tooling |
| Identities abused | Harvested credentials and authentication certificates from target systems; the attackers' own Claude accounts (later banned) |
| Impact | A handful of confirmed successful intrusions with data extraction |
| Category | Agentic AI and AI agents, NHI, LLM and AI platform |
What happened
Anthropic's threat intelligence team detected suspicious activity in mid-September 2025. Its investigation found a coordinated espionage operation run largely through Claude Code, Anthropic's agentic coding tool. The attackers built a framework in which Claude Code instances, connected to commodity security tools through the Model Context Protocol, carried out the work of a penetration-testing team: mapping targets, finding and exploiting vulnerabilities, harvesting credentials, moving laterally, extracting data and writing up the results.
Anthropic reports that the AI performed 80 to 90 percent of tactical operations on its own, sustaining request rates of multiple operations per second, a pace no human team could match. People stayed in what Anthropic calls strategic supervisory roles, contributing 10 to 20 percent of the effort at key decision points.
To get Claude to cooperate, the operators used two tricks. They told the model they worked for legitimate cybersecurity firms doing defensive testing, and they split the attack into small, innocuous-looking tasks, "presenting these tasks to Claude as routine technical requests" so that no single request revealed the malicious whole.
Anthropic banned the accounts involved, notified relevant authorities, expanded its cyber-focused classifiers and built new detection for autonomous attack activity. It published its report in November 2025. The US House Committee on Homeland Security subsequently asked Anthropic to testify about the incident.
Timeline
| Date | Event |
|---|---|
| September 2025 | Campaign active against about 30 organisations (MITRE ATT&CK C0062 lists first and last seen as September 2025). |
| Mid-September 2025 | Anthropic detects suspicious activity and begins its investigation. |
| Following weeks | Accounts banned; relevant authorities notified; detection expanded. |
| November 2025 | Anthropic publishes its report and attributes the campaign to GTG-1002. |
| 26 November 2025 | House Committee on Homeland Security writes to Anthropic requesting testimony. |
How it happened: the identity attack path
Anthropic describes the campaign in phases. Several of them turn on credentials and machine identities.
- Agent set-up and guardrail bypass. Human operators chose targets and set up Claude Code with MCP tools, using personas and task splitting to avoid refusals.
- Reconnaissance. Agents mapped target infrastructure and services in parallel, at machine speed.
- Vulnerability discovery and exploitation. Agents found weaknesses, wrote and tested exploit code, and gained initial access to public-facing applications.
- Credential harvesting. Inside, the agents collected credentials. MITRE ATT&CK records the extraction of authentication certificates from system configuration files (T1552.001) and queries of database user tables to find high-privilege accounts (T1087).
- Testing and reusing credentials. Harvested credentials were used against internal APIs, databases, container registries and logging infrastructure (T1078), and tested against other discovered systems.
- Lateral movement and collection. With valid credentials, agents moved through networks and extracted data from databases and other information stores (T1213.006).
- Exfiltration and documentation. Data left over web services (T1567), and the agents produced structured documentation of what they had found for the human operators.
Impact
- Targets: about 30 organisations, with Anthropic validating a handful of successful intrusions. Victims were not named.
- Data: sensitive data was extracted from the compromised organisations; Anthropic did not publish volumes.
- Limits of the AI: Anthropic notes that Claude "frequently overstated findings and occasionally fabricated data", which meant the human operators had to validate results.
- Industry: the case became the reference example of AI-orchestrated intrusion, catalogued by MITRE ATT&CK as campaign C0062, and prompted congressional interest in agentic AI misuse.
What this means for NHI and AI agent security
GTG-1002 changes the economics of intrusion. Tasks that needed a skilled team for weeks, such as sorting through configuration files for secrets, testing every harvested credential against every service and working out which accounts are privileged, can now be run by agents in parallel and without fatigue. The steps are not new; the speed and scale are.
That puts non-human identities directly in the firing line. Certificates in configuration files, credentials that work across internal APIs and registries, and service accounts with broad database rights are exactly what the agents looked for. An estate with long-lived, over-privileged and poorly inventoried machine credentials gives an AI-driven attacker far more to work with than one where credentials are short-lived, narrowly scoped and monitored.
The incident also shows AI agents themselves as identities that need governance. The attackers ran Claude Code under accounts they controlled. Anthropic's detection of those accounts, and its ability to ban them, was the control that ended the campaign. Organisations deploying their own agents need the same visibility: which agents exist, which credentials and tools they hold, and what normal behaviour looks like. The OWASP Top 10 for Agentic Applications covers tool misuse and identity abuse by agents in detail.
Recommendations
- Remove secrets and certificates from configuration files. Move them to a secrets manager and inject them at runtime. See our guide to the secret sprawl challenge.
- Scope machine credentials to one purpose. A credential that works against APIs, databases, registries and logging systems at once gives an agent a free pass. Apply least privilege per workload.
- Shorten credential lifetimes. Harvested credentials are only useful while valid. Prefer short-lived tokens and workload identity federation, as described in our NHI Authentication Guide.
- Detect machine-speed behaviour. Alert on bursts of authentication attempts, credential testing across many services, and database account enumeration, which are hallmarks of automated attacks.
- Protect logging infrastructure. The agents targeted logging systems. Keep log pipelines on separate credentials that ordinary workloads cannot reach.
- Govern your own AI agents. Inventory agents and MCP servers, give each its own scoped identity, and monitor tool use. Our Top 10 NHI Issues covers the basics.
Frequently asked questions
What was the GTG-1002 campaign?
A cyber espionage campaign detected by Anthropic in mid-September 2025, in which a group Anthropic assesses as Chinese state-sponsored used Claude Code agents to attack about 30 organisations, with the AI doing 80 to 90 percent of the tactical work.
How did the attackers get Claude to help?
They claimed to be employees of legitimate cybersecurity firms carrying out defensive testing, and broke the operation into small tasks that each looked like a routine technical request.
Why does this matter for non-human identity security?
Much of the agents' work was harvesting and reusing credentials, including authentication certificates from configuration files and credentials that worked across internal APIs, databases and container registries. AI makes exploiting weak machine-credential hygiene faster and cheaper.
Related NHI Mgmt Group resources
Analysis of Claude Code Security · CoPhish OAuth token theft via Copilot Studio agents · AI LLM hijack breach · Ultimate Guide to NHIs
How NHI Mgmt Group can help
Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers, now assisted by AI, target service accounts, API keys, tokens, certificates and OAuth credentials. Our NHI Foundation Level Training Course helps teams find and control these identities before automated attackers do.
References
- Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign (November 2025)
- MITRE ATT&CK: Anthropic AI-orchestrated Campaign, Campaign C0062
- US House Committee on Homeland Security: letter to Anthropic requesting testimony (26 November 2025)
- Paul, Weiss: Anthropic Disrupts First Documented Case of Large-Scale AI-Orchestrated Cyberattack
