News report
Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign
Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.
What Happened
Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.
Why This Matters
This is source reporting of a security event, not a confirmed product vulnerability or patchable CVE. Use it as situational awareness if named organizations, cloud tenants, or identity systems overlap with yours.
Recommended Action
Read the source report. Confirm whether any named organizations, identity tenants, or cloud environments you operate are implicated. Do not treat this as a vendor advisory unless a CVE or official bulletin is attached.
Exposure
Exposure unknown
Nov 14, 2025 05:30
Exposure reason: This incident does not currently match a technology in My Interests.
Exploitation status: ACTIVELY_EXPLOITED
Primary entities:
Timeline
-
Incident first seen
Nov 14, 2025 05:30BugSkan first recorded this incident.
-
Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign - The Hacker News
Nov 14, 2025 05:30thehackernews.com · News
Sources
thehackernews.com · Nov 14, 2025 05:30
Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.
Open publisher sourceRelated Incidents
Other BugSkan incidents that share identifiers, products, or vendors with this report.
My Interests Match
Create an account to see which incidents overlap with your interests.