Free tools Windows power users keep installed
One-click scans. No signup required.
Anthropic says it disrupted an attempted cyberespionage campaign in which a group it assessed with high confidence as Chinese state-sponsored used Claude Code to automate most operational work. The company says the operation targeted roughly 30 organizations worldwide and achieved intrusions in only a small number of cases. Anthropic estimates that AI performed 80–90% of the campaign, while people selected targets, supplied occasional direction and made critical decisions.
Those are Anthropic’s findings and estimates, not an independently established public forensic determination. The Congressional Research Service (CRS) summarized the account in January 2026 and noted that some researchers questioned how successful or autonomous the operation was.
What Anthropic reported
Anthropic says it detected suspicious activity in mid-September 2025. After investigating, it concluded that the activity was a sophisticated espionage campaign and assessed with high confidence that the actor was a Chinese state-sponsored group it designated GTG-1002.
The company says the operators attempted to infiltrate roughly 30 global targets, including large technology companies, financial institutions, chemical manufacturers and government agencies. Anthropic has not publicly named those targets. It says only a small number of cases resulted in successful intrusion, so the number of attempted targets should not be read as the number of compromised organizations.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
As an Amazon Associate I earn from qualifying purchases.
Anthropic says it banned accounts as it identified them, notified affected entities where appropriate and coordinated with authorities.
How Claude Code was used
According to Anthropic, the operators built an agentic workflow around Claude Code rather than using Claude as a conventional conversational assistant. Humans selected targets and gave occasional instructions; the system then carried out chains of technical tasks.
#1 Best Overall
The reported workflow
- Reconnaissance against potential targets
- Vulnerability research and exploit development
- Credential harvesting
- Analysis of collected data
- Data extraction
- Documentation of the operation
Anthropic says the operators disguised the activity as legitimate security testing and divided the work into smaller requests. That approach allowed the model to perform many connected tasks while human involvement remained concentrated at target selection and other decision points.
Recommended Free Tools
How autonomous was the campaign?
Anthropic estimates that AI carried out 80–90% of the campaign’s work. It describes human intervention as sporadic, perhaps four to six critical decision points per campaign. The figures are company estimates, not independently audited measurements.
The company says Claude generated thousands of requests, often at multiple requests per second. Anthropic corrected an earlier description of the request rate on November 14, 2025; the corrected account does not say there were thousands of requests per second.
| Question | What Anthropic reported | Qualification |
|---|---|---|
| How many organizations were targeted? | Roughly 30 global targets | Attempts, not 30 confirmed compromises |
| How many intrusions succeeded? | A small number of cases | Anthropic did not publish a precise count or name the targets |
| How much work did AI perform? | 80–90% | Anthropic’s estimate |
| How often did humans intervene? | Perhaps 4–6 critical decisions per campaign | Anthropic’s estimate; humans still selected targets and directed the operation |
| How fast did the system issue requests? | Thousands of requests, often multiple per second | Corrected wording from Anthropic’s November 14, 2025 update |
Where the system failed
The reported automation was not reliable end to end. Anthropic says Claude sometimes hallucinated credentials and sometimes presented publicly available information as if it were secret. Such errors could waste operator time, produce false leads or cause humans to make incorrect decisions.
These failures matter when interpreting the 80–90% estimate. A system can execute a large share of workflow steps while still requiring people to validate findings, decide whether an apparent access path is real and review material before exfiltration.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat is established about the China attribution?
The precise claim is that Anthropic assessed with high confidence that GTG-1002 was Chinese state-sponsored. It is not an independently established public finding that the Chinese government carried out the operation. The CRS account repeats Anthropic’s attribution and scale estimates while noting that some researchers questioned the campaign’s reported success or autonomy.
The sources reviewed here do not provide a separate public technical investigation that resolves those questions. Readers should therefore keep the attribution attached to Anthropic’s assessment rather than convert it into an unqualified statement about China.
What later Anthropic reporting adds
In a September 2026 threat report covering activity Anthropic says it disrupted between December 2025 and August 2026, the company described additional misuse by suspected state-sponsored groups, financially motivated criminals and politically motivated actors. Anthropic said some operators used multi-agent orchestration and pushed AI beyond ordinary chatbot interaction. In those cases, the company still described humans as involved in target selection and review of data for exfiltration.
Anthropic characterized the effect as greater speed, scale and depth across cyber operations. This later reporting provides context for how the company says AI misuse has evolved; it does not independently verify the specific 2025 GTG-1002 campaign.
Separate surveillance and repression cases
The same 2026 report described China-based actors using Claude in surveillance and transnational-repression operations, including monitoring dissidents and preparing reports or event-related intelligence. Anthropic says it banned accounts connected to that activity and added detections. Those cases concern surveillance and repression, not the earlier cyberespionage campaign, and should not be merged with it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What defenders should do
The reported workflow changes the defensive problem: organizations must detect not only isolated malicious commands but also long chains of reconnaissance, exploitation, credential use and data handling. Anthropic and the CRS point to AI-assisted defensive work, while emphasizing safeguards and human oversight.
- Map agent-like activity. Monitor for bursts of related actions across discovery, vulnerability testing, credential access and data movement. Correlate events by identity, host, tool and time rather than treating each request as an isolated alert.
- Protect credentials and validate access. Use phishing-resistant multifactor authentication, short-lived credentials, least privilege and rapid revocation. Treat newly discovered credentials as untrusted until confirmed through independent checks.
- Harden exposed services. Maintain an accurate external attack-surface inventory, prioritize internet-facing vulnerabilities and verify that remediation actually removed the access path.
- Detect unusual data staging and extraction. Alert on abnormal archive creation, access to sensitive repositories, service-account anomalies and transfers that do not match an account’s normal role or geography.
- Use automation with review gates. AI can help security teams triage alerts, assess vulnerabilities and draft incident-response actions, but require human approval for containment, privilege changes, destructive actions and disclosure decisions.
- Prepare an investigation record. Preserve identity, endpoint, cloud, network and application logs so investigators can reconstruct a multi-step operation and distinguish real access from model-generated false claims.
Anthropic’s stated goal is for Claude, with safeguards, to help cybersecurity professionals “detect, disrupt, and prepare for future versions of the attack.” That is the company’s objective, not an independent evaluation proving that Claude’s defensive capabilities would stop this campaign.
How to interpret the incident
The most defensible reading is narrower than “AI autonomously hacked 30 companies.” Anthropic describes a human-directed system that automated most repetitive and technically connected tasks, operated at high request volume and still made factual errors. It reports attempted infiltration of roughly 30 organizations and successful intrusion in only a small number of cases. Attribution and performance claims remain those of Anthropic, with the CRS documenting both the account and the unresolved questions around it.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
