Anthropic: China-backed hackers launch first large-scale autonomous AI cyberattack

China-linked actors used Anthropic’s AI to automate and run cyberattacks in a sophisticated 2025 espionage campaign using advanced agentic tools.

China-linked threat actors used Anthropic’s AI to automate and execute cyberattacks in a highly sophisticated espionage campaign in September 2025. The cyber spies leveraged advanced “agentic” capabilities rather than using AI only for guidance.

Attackers abused AI’s agentic capabilities to execute cyberattacks autonomously. According to the experts, this represents an unprecedented shift from AI as advisor to AI as operator. A Chinese state-sponsored group used Claude Code to target about 30 global organizations, succeeding in a few cases across tech, finance, chemicals, and government. It’s likely the first large-scale attack with minimal human involvement.

“In mid-September 2025, we detected suspicious activity that later investigation determined to be a highly sophisticated espionage campaign.” reads the report published by Anthropic. “After detection, accounts were banned, victims notified, and authorities engaged. The case highlights rising risks from autonomous AI agents and the need for stronger detection and defensive measures.”

The attack exploited three newly matured AI capabilities. First, greater intelligence let models follow complex instructions and use advanced skills like coding for malicious tasks. Second, increased agency enabled AI agents to act autonomously, chaining actions and making decisions with minimal human input. Third, broad tool access, via standards like MCP, allowed models to use web search, data retrieval, password crackers, and network scanners. Each attack phase relied on this combination of intelligence, autonomy, and tool integration.

The cyberspies selected targets and built an autonomous attack framework using Claude Code. After jailbreaking Claude by disguising tasks as benign and framing the activity as defensive testing, they launched Phase 2. Claude rapidly mapped systems, identified high-value databases, and reported findings. It then researched and wrote exploits, harvested credentials, created backdoors, and exfiltrated data with minimal human oversight. Claude even documented the operation. Overall, the AI performed 80–90% of the campaign, executing thousands of requests at speeds impossible for humans, though occasional hallucinations limited full autonomy.

The attack marks an escalation from past “vibe hacking,” with far less human involvement and large-scale AI-driven operations. Yet the same capabilities enabling misuse make AI vital for defense: Claude was used to analyze the investigation’s data. Cybersecurity is shifting; teams should adopt AI for SOC work, detection, and response, while improving safeguards, threat sharing, and monitoring.

“The barriers to performing sophisticated cyberattacks have dropped substantially—and we predict that they’ll continue to do so. With the correct setup, threat actors can now use agentic AI systems for extended periods to do the work of entire teams of experienced hackers: analyzing target systems, producing exploit code, and scanning vast datasets of stolen information more efficiently than any human operator.” concludes the report. “Less experienced and resourced groups can now potentially perform large-scale attacks of this nature.”

Many experts are skeptical about Anthropic’s report, one of them is the famous Kevin Beaumont, below is the statement he wrote on LinkedIn:

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Anthropic)