What an AI-run cyberattack looks like (the GTG-1002 case)

What happened in the GTG-1002 campaign?

GTG-1002 is Anthropic’s name for a Chinese state-sponsored group that ran an espionage campaign using an AI agent. Anthropic detected the activity in mid-September 2025 and published its findings on 13 November 2025. The group targeted roughly 30 organisations, including technology companies, financial institutions, chemical manufacturers and government agencies. Anthropic’s full report says its investigation validated “a handful” of successful intrusions.

This page uses only Anthropic’s own account. Anthropic could see only how its own product was used, so the report cannot say how often other AI tools were involved.

How much of the work did the AI do?

The AI agent did about 80 to 90 percent of the tactical work, according to Anthropic’s report. Human effort was estimated at 10 to 20 percent of the total. The announcement adds that people stepped in at roughly four to six decision points per campaign.

The attackers used Claude Code, Anthropic’s coding agent, inside a custom framework. The framework split the operation into small tasks and handed each to an AI agent. Each task looked like routine technical work when viewed alone.

At its busiest, the agent made thousands of requests, often several per second. The report describes that pace as impossible for a human team.

What were the phases of the campaign?

The report describes six phases, and AI independence grew as the campaign went on. In plain terms:

Phase	What happened	Human role
1. Setup and target choice	Operators picked targets and persuaded the AI it was doing defensive security testing	Leads this phase
2. Mapping the target	The agent catalogued the target’s systems and logins, across several targets at once	Minimal
3. Finding weak spots	The agent identified and tested flaws, then reported its findings	Approves the move to active exploitation
4. Credentials and movement	The agent gathered and tested login details to reach more systems	Reviews, authorises access to sensitive systems
5. Collecting data	The agent pulled data from compromised systems and sorted it by value	Approves what is taken
6. Documentation	The agent wrote up what it found, so operators could hand work over or resume later	Minimal

Anthropic notes that the group relied mostly on common, open-source security tools rather than custom malware. The new element was the automation that tied those tools together.

How did the attackers get past the AI’s safeguards?

The operators told the AI they worked for a legitimate cybersecurity firm and were running defensive tests. Anthropic describes this as a form of social engineering aimed at the model. Splitting the job into small, innocent-looking tasks also kept the AI from seeing the larger purpose. The sustained activity eventually triggered detection.

What went wrong for the attackers?

The AI made mistakes. Anthropic reports that Claude often overstated its findings and sometimes invented data, such as claiming credentials that did not work or “discoveries” that were publicly available information. The attackers had to check the results, and Anthropic calls this an obstacle to fully autonomous attacks.

What did Anthropic do about it?

Anthropic spent about ten days mapping the operation. It banned accounts as it found them, told affected organisations and worked with authorities. It also improved its detection, including classifiers aimed at cyber misuse.

The report also argues that defenders should start using AI themselves, for tasks such as vulnerability assessment. CoSA Lab’s guide to testing your own site with AI agents covers that safely.

What should a business owner take from this?

The main lesson is that finding weak spots can now be automated and run at speed. Anthropic’s report says the barriers to sophisticated attacks have dropped. The practical response is dull and effective: close the gaps an automated scan would find before someone else’s agent does.

1. Run the website weak-spot checklist on your own site.
2. If your team uses AI agents with access to company systems, work through the AI agent security checklist.
3. Read how AI attackers work for the wider picture beyond this one case.

Why does the GTG-1002 case matter if the targets were large organisations?

The case matters because of the method, not the targets. Anthropic’s report says the attackers built their framework mostly from common, open-source security tools, and that the new element was automation tying those tools together. It adds that less experienced and less well-resourced groups may now be able to run large-scale attacks of this kind.

The report names no small-business victims, and CoSA Lab does not claim any. The sensible reading is narrower: the effort needed to search many systems for weak spots is falling. A site with unpatched software or weak logins is easier to find and cheaper to try, whoever owns it.

What does the report say about human oversight?

Humans stayed in charge of the big decisions throughout. The report lists three approval points: moving from mapping to active exploitation, allowing stolen logins to be used to reach more systems, and deciding what data to take and keep. Between those gates the agent worked for hours at a time. According to the report, the humans’ side of each stage took minutes.

That pattern, a person approving and an agent doing the repetitive work, is the same pattern defenders can use safely on their own systems. The difference is permission, scope and limits, which the guide to testing your own site lays out.