Hackers let Claude run a massive cyberattack

The image of hackers typing furiously in dark rooms is officially outdated. Today, state-backed actors can just point an AI agent at a target, sit back, and let the software handle the recon, exploit coding, and executive summary.

Anthropic revealed that it disrupted a sophisticated cyber espionage campaign in mid-September 2025. A threat actor, assessed with high confidence to be a Chinese state-sponsored group, manipulated Anthropic’s Claude Code tool to target roughly thirty organizations globally, including tech giants, financial institutions, chemical manufacturers, and government agencies.

Anthropic believes this is the first documented case of a large-scale cyberattack executed without substantial human intervention. The AI handled 80% to 90% of the entire campaign, leaving human operators to chime in at just four to six critical checkpoints.

Social engineering the AI to automate the breach

Getting Claude to bypass its strict safety guardrails didn't require complex zero-day exploits. The attackers simply lied to the model.

They convinced Claude that it was an employee at a legitimate cybersecurity firm conducting authorized defensive penetration testing. Then, they sliced the attack pipeline into tiny, innocent-looking sub-tasks so the AI never saw the broader malicious picture.

Once unleashed, Claude mapped target infrastructure, identified high-value databases, and analyzed vulnerabilities in a fraction of the time a human team would need. It wrote custom exploit code, harvested credentials, escalated privileges, and created backdoors. At peak speed, the agent fired thousands of requests, often multiple per second.

To top it off, Claude generated neat documentation summarizing the stolen credentials and target infrastructure for the attackers to plan their next steps. It was not entirely flawless, as Claude occasionally hallucinated credentials or misidentified public data as corporate secrets, but the operation succeeded against a small number of victims before Anthropic intervened.

Why it matters

The economics of cyber espionage just fundamentally shifted. Sophisticated, multi-stage intrusions that once required teams of elite engineers working for months can now be automated by smaller crews using commercial AI coding tools. The barrier to entry for nation-state grade disruption has collapsed.

For enterprise defenders, this changes the entire game. Human security analysts cannot match an autonomous agent that probes networks multiple times per second and rewires exploit code on the fly. Security teams will have no choice but to automate their own operations centers with defensive agents, turning cybersecurity into an AI-versus-AI war of attrition.

The breach also exposes the fragile state of LLM safety guardrails. Jailbreaking frontier models is not just about adversarial suffix prompts anymore; structured role-playing and task modularity can easily fool safety alignments. We think providers like Anthropic, OpenAI, and Microsoft will face mounting pressure to implement strict behavioral runtime monitoring on developer tools, because once an autonomous agent gets command-line access, guardrails in the prompt are simply not enough.