Chinese State Group Runs Espionage Through Claude Code

Software agent · Coding agent · Found first by developer

A group Anthropic assessed as Chinese state-sponsored used Claude Code to run a largely automated espionage campaign against about 30 organizations. The developer's own monitoring caught a state group using its coding agent as an attack platform, but only after some intrusions had succeeded.

Timeline of Chinese State Group Runs Espionage Through Claude Code: Sep 2025, Anthropic detects the campaign; Nov 13, Anthropic publishes its report; Nov 26, House asks Amodei to testify. Below, the reporting rules that applied: California SB 53, not in force; Voluntary disclosure, voluntary. FROM DETECTION TO DISCLOSURE OCT 1 NOV 1 SEP 2025 Anthropic detects the campaign NOV 13 Anthropic publishes its report NOV 26 House asks Amodei to testify REPORTING RULES AND THIS INCIDENT California SB 53 TOOK EFFECT 2026 NOT IN FORCE Voluntary disclosure REPORT AND NOTIFICATIONS VOLUNTARY
Agent class
Software
Developer
Anthropic
Operator
GTG-1002, assessed as Chinese state-sponsored
Found first by
Developer
Date
Sep 2025
Targets
About 30

What happened

Claude Code Did Most of an Espionage Campaign

  • Targets: large tech companies, financial institutions, chemical manufacturers and government agencies.
  • Automation: AI did 80 to 90 percent of the work, with humans deciding at four to six points per target.
  • Method: operators split attacks into small tasks and posed as a security firm doing defensive testing.
  • Limits: Claude often overstated findings and sometimes invented credentials that did not work.

Timeline

Detected in September, Disclosed in November

Timeline
DateEventSource
Mid-September 2025Anthropic detects the campaign on its platformAnthropic
November 13, 2025Anthropic publishes its report on the campaignAnthropic
November 26, 2025The House Homeland Security Committee asks Dario Amodei to testifyCyberScoop

Controls that failed

Safeguards Saw Each Task, Not the Attack

Controls that failed
ControlCompanyWhat failed137AI page
Misuse classifiersAnthropicAttacks split into small tasks looked like routine technical workMonitoring and Anomaly Detection
Early detection of agent operationsAnthropicThe campaign reached high-value targets before it was stoppedMonitoring and Anomaly Detection

Reporting

Anthropic Disclosed With No Rule Requiring It

Reporting rules and this incident
RuleStatusWhy
California SB 53Not in forceThe law took effect on January 1, 2026, after the campaign
Voluntary disclosureVoluntaryAnthropic published a report, notified targets and worked with authorities

Every rule tracked is on Incident Reporting Rules and Registries.

Response

Accounts Banned and Congress Asked Questions

  • Regulators and courts: On November 26, 2025, the House Homeland Security Committee asked Anthropic CEO Dario Amodei to testify.
  • Remediation: Anthropic banned the accounts, notified targets, coordinated with authorities and expanded its cyber classifiers.

Record

Incident Record

Incident ID
2025-09-GTG-1002
AI Incident Database
Incident 1263
Sources
Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (November 2025); The Register (November 2025); CyberScoop (November 2025)
Last verified
October 2026