Anthropic disrupted an espionage campaign that used Claude Code as the operator

Anthropic says it has cut off a campaign in which a Chinese state-sponsored group used Claude Code to run most of a cyber-espionage operation against about thirty targets. The company is calling it the first large attack executed without substantial human intervention at every step.

Treat vendor framing with the usual caution. The operational claim is still sharp: a coding agent did the looping.

The campaign, as disclosed

Anthropic’s designation is GTG-1002. Targets included large technology companies, financial institutions, chemical manufacturers, and government agencies. A small number of intrusions succeeded.

The important sentence in the write-up is about agency. Attackers did not only ask Claude how to hack. They pointed Claude Code at reconnaissance, exploit work, internal mapping, and extraction, with humans stepping in at a handful of decision points per campaign. Anthropic’s estimate was that the model performed the large majority of the work.

That is a different picture from 2023’s “employee pasted source into ChatGPT.” The model is not the place secrets went. The model is the thing running commands.

What “AI-orchestrated” should mean in a SOC

It should not mean the model grew a motive. It should mean:

• The attacker’s bottleneck moved from writing exploits to steering an agent.
• Scale comes from parallelism, not from hiring.
• Logs that only capture human keystrokes will miss the real actor.

If a coding agent can shell out, read files, and call tools, it is part of your compute estate. It needs the same class of question you already ask of unsanctioned scripts: what did it run, against which host, and what left the box?

Practical takeaway

State-linked crews will keep using whatever commercial agent is convenient until the vendor bans the accounts. You will not get a courtesy call before they point that agent at you.

You can still instrument the agents you allow. Claude Code is exactly the surface Ecliptica Replay watches: commands, files, URLs, a rebuildable session, detection rules that stay on the machine. That does not stop GTG-1002. It tells you whether a Claude Code run on a developer laptop just started looking like an intrusion set instead of a refactor.