News report
Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign
Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.
What Happened
Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.
Why This Matters
This is source reporting of a security event, not a confirmed product vulnerability or patchable CVE. Use it as situational awareness if named organizations, cloud tenants, or identity systems overlap with yours.
Recommended Action
Read the source report. Confirm whether any named organizations, identity tenants, or cloud environments you operate are implicated. Do not treat this as a vendor advisory unless a CVE or official bulletin is attached.
Exposure
Exposure unknown
Nov 14, 2025 05:30
Exposure reason: This incident does not currently match a technology in My AI Stack.
Exploitation status: CONFIRMED_IN_THE_WILD
Primary entities:
Timeline
-
Incident first seen
Nov 14, 2025 05:30BugSkan first recorded this incident.
-
Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign - The Hacker News
Nov 14, 2025 05:30thehackernews.com · News
Sources
thehackernews.com · Nov 14, 2025 05:30
Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.
Open publisher sourceMy AI Stack Match
Create an account to see which incidents overlap with your AI stack.