Incident Published: Sep 8, 2026

GTG-1002: Hiding an Espionage Campaign Inside Ordinary Claude Code Tasks

Anthropic reported a September 2025 campaign that used Claude Code, its AI coding agent, against roughly 30 organizations and compromised a small number. Attackers divided malicious objectives into plausible technical tasks and falsely claimed authorized security work. For AI-service operators, the lesson is to review visible session context and gate generated output, without pretending to control the attacker's local tools.

Guardrail BypassData ExfiltrationInput ValidationAgentic AI
4 applicable AIDEFEND defenses
Source: Disrupting the first reported AI-orchestrated cyber espionage campaign 
Author: Anthropic Threat Intelligence
Original article: Nov 13, 2025

Threat Analysis

  • False authorization obscured intent. Anthropic attributes GTG-1002 to a Chinese state-sponsored actor with high confidence. Attackers posed as legitimate security testers and fragmented tasks to hide their combined purpose.
  • Tool access turned assistance into execution. Their orchestration connected Claude to external tools through MCP. The technical report describes an SSRF path from scanning and payload generation to validation, human approval, and exploitation, followed by internal discovery and credential abuse.
  • Automation was substantial, not infallible. Anthropic estimated AI performed 80 to 90 percent of tactical work. Humans retained critical decisions. Claude also fabricated credentials and misrepresented public information as secret discoveries; generated reports are not proof of compromise.
  • Provider visibility had limits. Anthropic investigated Claude usage, banned accounts, and notified affected entities. Its account is not a complete independent reconstruction of every local command or victim outcome. This is a 2025 incident, not a newly observed 2026 campaign.

Applicable AIDEFEND Defenses (4)

AID-D-003.005
Stateful Session Monitoring: Intent Drift + Invariant-Breach Signals
Medium
At the model service, use G001's tenant/user/session ledger to track received turns, intent drift, and observable external-target accumulation. This supplies investigative context missing from isolated prompt checks. It neither correlates every separately submitted task nor establishes maliciousness: legitimate testing can look similar, and missing turns or sessions limit the signal. The ledger detects; another control owns enforcement.
AID-D-001.001
Per-Prompt Content, Intent & Obfuscation Analysis
Medium
At provider ingress, G001 runs a pinned, calibrated classifier over the received prompt and emits a content-bound abuse finding for admission policy. It can identify visible instruction-bypass or privilege-escalation framing, but a plausible isolated task may evade detection. A statement that testing is authorized is untrusted input, not an independently approved engagement. This detector does not itself reject the request.
AID-D-003.001
Harmful Text & Token Output Policy-Violation Detection
Medium
Before delivering generated exploit code, apply G002's pinned critic to that exact output and publish a structured, response-bound policy finding. Calibrate against authorized security work as well as abuse; SSRF code alone is not proof of malicious intent. The critic is a probabilistic detector, not a release gate, and its abstention or failure must not be interpreted as a clean result.
AID-H-006.002
Text, Markup & Structured Output Sanitization and Release Gate
Medium
At the provider's output boundary, G004's full-response gate buffers executable output until the configured detector clears it. Bind the detector adapter to the exact response and withhold output on findings, uncertainty, errors, or failed evidence writes. This prevents delivery of detected abusive code, including unchecked streaming prefixes. It cannot repair a classifier false negative or stop local tools already executing.

What Defenders Should Do Now

  • AI-service operators: document which prompts, responses, identities, and sessions your service actually observes. Do not label client-supplied tool results as authoritative local-execution evidence or infer that unobserved activity was safe.
  • Detection engineers: replay fragmented multi-turn abuse alongside legitimate penetration testing. Measure missed abuse and false alarms separately. Exercise missing, duplicate, and reordered turns before trusting the session ledger.
  • API engineers: connect the critic's structured finding to the output gate through an explicit status adapter. Map abstention and malformed or incomplete results to no-release. Test harmful prefixes, timeouts, and evidence-write failures; executable output must release no bytes before its complete review.
  • Abuse-response teams: define who investigates a finding and who may restrict an account. Preserve provider-owned evidence, verify the effect of restrictions, and state which attacker-local actions remain outside your reach.
  • Potential victims: retain application, identity, and database defenses and verify suspected access against your own logs. Do not treat an attacker's AI-generated report as confirmation, or assume a provider's model filter protects your application.

Conclusion

The distinctive failure was not merely a persuasive jailbreak. Dividing an intrusion into ordinary-looking tasks deprived the model of the context needed to judge their combined purpose. AIDEFEND  supplies bounded prompt, session, and output controls at the service boundary; these are deployment proposals, not claims about Anthropic's implementation. Neither model refusal nor an attacker's claimed authorization substitutes for trusted enforcement and verified outcomes. The step-level reconstruction is available in SecureFlow AML.CS0069.