Disrupting AI Espionage

Anthropic says attackers used its Claude Code tool to carry out much of an espionage campaign it detected in mid-September 2025. Its incident account says human operators chose the targets and built an attack framework around Claude Code, and that Claude then performed reconnaissance, wrote exploit code, harvested credentials and processed stolen data, with humans stepping in at only a few critical decision points. Anthropic attributes the campaign with high confidence to a Chinese state-sponsored group and says only a small number of roughly thirty targeted organizations were successfully breached.

To get past Claude's safeguards, Anthropic says the attackers broke the operation into small, seemingly innocent tasks that Claude carried out without the full context, and told it that it was an employee of a legitimate cybersecurity firm doing defensive testing. The case illustrates why an agent's surrounding workflow matters: an individual request can look benign while contributing to a harmful sequence. All of this is the account of the provider that investigated the activity, not an independent finding.