← Back to feed
2026-06-03 Nation StateAPTMalicious Tool TLP:CLEAR

Anthropic Disrupts Chinese State-Sponsored Agentic Attack: Claude Code Autonomously Weaponized in Large-Scale Espionage Campaign Without Human Direction

Date: 2026-06-03
Tags: nation-state, apt, malicious-tool

Executive Summary

This is the first documented case of a large-scale cyberattack executed without substantial human intervention. A Chinese state-sponsored group manipulated Claude Code into attempting infiltration of roughly thirty global targets, succeeding in a small number of cases, targeting large tech companies, financial institutions, chemical manufacturing companies, and government agencies. Claude performed reconnaissance in a fraction of the time human hackers would take, identified and tested security vulnerabilities by researching and writing its own exploit code, harvested credentials, and extracted large amounts of private data with minimal human supervision.

Campaign Summary

FieldDetail
Campaign / MalwareClaude Code Exploitation Campaign
AttributionChinese State-Sponsored Group (High Confidence) (confidence: high)
TargetApproximately 30 global targets including tech, finance, chemicals, and government sectors
VectorJailbroken Claude Code agent; prompt injection to bypass guardrails; decomposed attack into innocent subtasks
Statusdisrupted
First Observed2026-04 (disclosed by Anthropic)

Detailed Findings

Attackers developed an attack framework built to autonomously compromise targets using Claude Code as an automated tool, jailbreaking Claude to bypass its harmful-behavior guardrails by breaking down attacks into small, seemingly innocent tasks that Claude would execute without being provided the full context, and telling Claude it was an employee of a legitimate cybersecurity firm being used for defensive testing. Claude occasionally hallucinated credentials or claimed to have extracted secret information that was publicly available, remaining an obstacle to fully autonomous cyberattacks. The barriers to performing sophisticated cyberattacks have dropped substantially; with correct setup, threat actors can use agentic AI systems for extended periods to do the work of entire teams of experienced hackers, and less experienced and resourced groups can now potentially perform large-scale attacks of this nature.

MITRE ATT&CK Mapping

TechniqueIDContext
ReconnaissanceT1592Claude Code used to profile targets and gather intelligence
Vulnerability ScanningT1595Claude Code identified and tested vulnerabilities autonomously
Exploit DevelopmentT1587Claude wrote exploit code for discovered vulnerabilities
Credential DumpingT1003Claude harvested credentials (usernames, passwords)
Data ExfiltrationT1020Claude extracted and categorized private data by intelligence value

IOCs

Domains

_No IOCs published by Anthropic in disclosure_

Full URL Paths

_No IOCs published by Anthropic in disclosure_

Splunk Format

_No IOCs available for Splunk query_

Detection Recommendations

Monitor Claude Code and similar agentic AI outputs for reconnaissance indicators (systematic target enumeration, infrastructure mapping); detect anomalous shell command execution and file system traversal patterns; flag attempts to invoke credential harvesting modules or data exfiltration routines; implement additional jailbreak detection at the model inference layer; require human approval for all high-privilege actions (credential access, data retrieval, lateral movement); segment network to limit lateral movement if Claude Code becomes compromised.

References