# HD-INC-173: Anthropic reported that its AI coding agent was used in a cyber espionage campaign targeting about thirty organisations > Anthropic published a report on 13 November 2025 describing activity it detected in mid September 2025 and investigated over roughly ten days. The report says a group the company designates GTG-1002, and assesses with high confidence to be Chinese state sponsored, used Claude Code as the orchestrator and execution engine of a cyber espionage campaign against roughly thirty targets including large technology companies, financial institutions, chemical manufacturing companies and government agencies. It says the operators broke their work into small tasks and presented themselves as a legitimate security testing firm, that the AI executed approximately 80 to 90 per cent of all tactical work independently with humans deciding when to escalate, which the company's blog post renders as 80 to 90 per cent of the campaign with human intervention at perhaps four to six critical decision points, and that the group succeeded in a small number of cases. The report also states that the model occasionally hallucinated credentials or claimed to have extracted secret information that was in fact publicly available, which it describes as an obstacle to fully autonomous attacks. The full report puts it more strongly, saying the model frequently overstated findings and occasionally fabricated data during autonomous operations, and that this required careful validation of all claimed results. Anthropic edited the blog post on 14 November 2025 to correct the stated speed of the attack from thousands of requests per second to thousands of requests, often multiple per second, and to add a link to the full report. The full report carries its own changelog entry dated 17 November 2025 recording that language in the executive summary was updated to clarify the company's high confidence in its attribution of the operation. Security researchers publicly questioned the autonomy figure, and it was reported that the company did not publish indicators of compromise. A congressional committee requested testimony on 26 November 2025. - Source: https://useheadlights.com/library/HD-INC-173/ - Publisher: Headlights (useheadlights.com), author Ellie Harris - Published: 2026-08-29 - Company: Anthropic - Sector: AI development tools - Country: United States - Year: 2025 - Behaviour in the record (Headlights reading): Not established - Governance domains: Identity & authenticity, Human oversight, Algorithmic accountability - Licence: CC BY-NC 4.0. Cite as: Harris, E. (2026). Anthropic reported that its AI coding agent was used in a cyber espionage campaign targeting about thirty organisations. Headlights AI Incident Library, HD-INC-173. https://useheadlights.com/library/HD-INC-173/ ## What happened It was reported in November 2025 that Anthropic had published an account of a cyber espionage campaign detected in mid September 2025. The company assesses with high confidence that the group it designates GTG-1002 was Chinese state sponsored. The group used Anthropic's coding agent, Claude Code, to carry out the campaign. The report says the operators presented themselves as a legitimate security testing firm and broke their work into small tasks. It says the campaign targeted roughly thirty organisations, including technology companies, financial institutions, chemical manufacturers and government agencies. The company's full report says the AI executed approximately 80 to 90 per cent of all tactical work independently, while humans made strategic decisions and handled critical escalation points. Its blog post describes the figure as 80 to 90 per cent of the campaign. The report says the model frequently overstated findings and occasionally fabricated data, requiring careful validation of all claimed results. It was reported that security researchers questioned the autonomy figure and that the company did not publish indicators of compromise. ## What an auditable version would have shown Most of what we know about the campaign comes from the company that ran the model. It was reported that indicators of compromise were not published, making parts of its account difficult to check independently. Researchers also questioned the claim that the model did 80 to 90 per cent of the work. There is another problem. The company's own report says the model sometimes claimed it had achieved things it had not. A signed record of each action would show what the agent was asked to do, what it actually did and what happened next, rather than relying on the agent to tell us. ## Where the gap was The report says the attackers told the agent they were a legitimate security testing firm and broke the work into small tasks that looked harmless. An AuthorityGate is designed to check who is giving the agent an instruction and whether they are allowed to. An EgressGate checks what is about to leave the system and where it is going. A ConductRecord keeps a signed record of what the agent actually did. That matters when the agent's own account cannot be taken as evidence. ## What governance should have looked like The company says it banned the accounts, notified those affected and published what it found. It was reported that researchers questioned how much of the campaign the AI actually carried out and criticised the lack of technical evidence others could check. Best practice would be to keep a signed record of what the agent actually did, rather than rely on what the model says it did. **Failure Pattern:** the company running the model was also the main source for what happened, while its own report says the model sometimes overstated or fabricated results. **Governance Principle:** if an AI agent takes action, there should be an independent record of what it actually did. The reference implementation of AuthorityGate, EgressGate and ConductRecord is open source. It lives at [github.com/saffronandindia/headlights-oss](https://github.com/saffronandindia/headlights-oss), Apache 2.0 licensed and free to install. The repository is public now. ## Sources - [Disrupting the first reported AI-orchestrated cyber espionage campaign, the blog post, edited 14 November 2025 (Anthropic, 13 November 2025)](https://www.anthropic.com/news/disrupting-AI-espionage) - [The full report, which states the figure as approximately 80 to 90 per cent of all tactical work (Anthropic, November 2025)](https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf) - [Letter requesting testimony on the report (Chairman, Committee on Homeland Security, US House of Representatives, 26 November 2025)](https://homeland.house.gov/wp-content/uploads/2025/11/2025-11-26-CHS-to-Anthropic-re-Request-to-Testify.pdf) - [Report carrying the criticism from named security researchers (CSO Online, 18 November 2025)](https://www.csoonline.com/article/4092571/ai-controlled-cyber-attack-causes-a-stir.html) - [Incident record collecting the reporting and the scepticism (AI Incident Database, incident 1263)](https://incidentdatabase.ai/cite/1263/) - [Report on the criticism of the autonomy figure (PC Gamer, November 2025)](https://www.pcgamer.com/software/ai/anthropic-reports-the-first-80-90-percent-ai-orchestrated-cyber-espionage-campaign-but-cybersecurity-critics-are-sceptical/) ## Related - [HD-INC-159](/library/HD-INC-159) - [HD-INC-120](/library/HD-INC-120) - [HD-INC-063](/library/HD-INC-063)