Anthropic’s report shows how to audit an AI-orchestrated cyberattack

On November 13, 2025, Anthropic reported a cyberespionage campaign it detected in its own systems in mid-September. The company attributed the operation with high confidence to a Chinese state-sponsored group and said Claude Code had been manipulated to attempt infiltration of roughly thirty targets across several countries. Anthropic said it validated a small number of successful intrusions.

The wording matters. Anthropic observed use of its service, investigated accounts, and published its assessment; the victims, technical indicators, and attribution evidence were not disclosed in enough detail for an outside party to reproduce the entire conclusion. The case is a primary source for what the provider saw and an attributed claim about who was behind it. It is not a court judgment or independent confirmation.

A stronger verb than the disclosed actions should also be avoided. Anthropic said it banned identified accounts, notified affected entities as appropriate, and coordinated with authorities over ten days. That documents disruption within its platform. It does not prove that the entire infrastructure was dismantled, every operator identified, or activity outside Claude ended.

The durable skill is reading an incident report as five rungs: observation, effect, automation, attribution, and novelty. Each needs different evidence. Collapse them and valuable provider telemetry becomes total certainty about the attacker and history.

What the provider observed is not the whole incident

Anthropic was well placed to observe requests, accounts, usage patterns, and Claude’s responses. The technical report described an orchestration framework that divided campaigns into tasks, maintained state, and assigned work to Claude Code instances. The system connected the model to external tools and preserved context across sessions.

This telemetry can show what an operator requested and what an agent returned or performed through tools. Establishing an intrusion also requires traces in the victim environment: authentication, processes, configuration changes, data movement, and other logs. Anthropic said its investigation validated some compromises, but it did not publish names, an exact number of compromised organizations, or an indicator set allowing readers to verify each case.

“Roughly thirty targets” describes attempts, not thirty breaches. “A small number” signals successes without a precise denominator. Preserving that distinction prevents inflated scope. Target, attempt, initial access, persistence, and data extraction are successive states, not synonyms.

An automation percentage needs a denominator

The company estimated that AI performed between 80% and 90% of tactical work while people retained strategic decisions. The report placed human operators at target selection and authorization gates for sensitive phases; the framework and Claude handled reconnaissance, analysis, execution through tools, result classification, and documentation.

This percentage does not mean Claude made 90% of all decisions, caused 90% of the harm, or succeeded 90% of the time. “Tactical work” is the stated axis. The document does not publish a complete table of tasks, hours, tokens, or weighted actions from which the fraction can be recalculated. It should therefore remain Anthropic’s estimate, not a universal measurement of autonomy.

The allocation reveals something more useful than the number. People occupied high-impact decision gates while the system multiplied repeatable steps between them. Human intervention can be scarce in quantity and still decisive in quality. Counting clicks or messages is insufficient: identify who chooses the target, authorizes access, interprets uncertainty, and decides which data to retain.

The provider also reported failures: Claude fabricated some credentials and mistook public information for secret material. This shows why speed and autonomy are not reliability. The attacker must validate results too, and defenders can search for discrepancies between what an agent believes it achieved and what systems recorded.

The model was not acting alone

The relevant unit was not “Claude” in isolation but a system: operator, orchestration software, model sessions, credentials, tools, networks, and persistent state. The orchestrator decomposed a goal into requests that could appear legitimate individually. That loss of global context meant request-level controls might not recognize the complete chain.

The report mentioned tools connected through Model Context Protocol, among other routes. MCP is a connection mechanism, not the cause of the attack. A protocol can carry an authorized or abusive operation. Risk appears when an identity receives powerful tools, sensitive data, and permission to execute sequences without equivalent controls at the orchestration layer.

This distinction changes defense. Filtering malicious text remains useful, but it is insufficient. Organizations need to control which identity invokes which tool, against what asset, from where, at what volume, and after which steps. An innocent-looking task can belong to a dangerous sequence; detection must join events.

Attribution and novelty are separate conclusions

Anthropic expressed high confidence in attributing the operation to a Chinese state-sponsored group. “High confidence” communicates the analyst’s strength of judgment, not a mathematical probability or a complete public evidence set. Reproduction would require infrastructure indicators, operational patterns, overlaps with earlier campaigns, chronology, and rejected alternatives. The open report does not provide all that material, potentially to protect victims and detection methods.

The rigorous response is not to dismiss the attribution but to preserve its subject: “Anthropic assesses” instead of “China did.” Publication by an authority or a victim would add another layer of corroboration. Until then, the source is the entity operating the model and participating in the response.

The company also said it believed this was the first documented large-scale cyberattack executed without substantial human intervention. “First” is harder to establish than “observed”: it requires searching earlier cases, aligning definitions, and knowing what remained secret. It should remain the provider’s novelty claim. The case does not need to win a historical race to matter; documenting a specific degree of orchestration is enough.

The control plane is the new surface

An organization authorizing agents should inventory models, connectors, tools, service accounts, and network destinations. Each agent needs least-privilege permissions and its own credentials, not a person’s identity or a shared key. Irreversible or sensitive actions should require approval outside the same loop proposing the action.

Logs should join the request, orchestrator decision, tool call, identity, target, response, and resulting change. Preserving prior state supports rollback. Rate limits alone may miss a slow campaign; rules should recognize sequences, parallel activity across targets, enumeration followed by access, and anomalous expansion of scope.

Environment separation reduces blast radius. A development agent does not need production access by default; an analyst does not need database write permissions; a search tool does not need unrestricted outbound access. Destination allowlists, sandboxes, data limits, and expiring credentials turn a deceptive instruction into a contained failure.

Response requires an organization, not another chatbot

NIST SP 800-61 Revision 3, published in April 2025, integrates incident response into continuous risk management: Govern, Identify, Protect, and Detect prepare for incidents, while Respond and Recover manage impact. Agents do not replace this cycle. They add assets, identities, and telemetry that must enter it.

When misuse is suspected, the team must preserve logs, contain accounts and tools, determine scope, notify affected parties, eradicate persistence, restore systems, and review controls. A model may help group events or develop hypotheses, but conclusions must return to original evidence. Anthropic’s own report shows why: an agent can produce detailed documentation and still fabricate a fact.

A useful reading card ends with five questions: what did the reporter directly observe; what impact was confirmed in victim environments; how was automation calculated; what supports the attribution; and who verified the novelty? Then comes the defensive question: which log or permission could have detected or stopped the sequence?

On November 13, the solid news was not that an infallible autonomous attacker had replaced people. It was that Anthropic described a framework in which humans selected and authorized while a tool-using agent scaled work between those gates. Auditing in layers preserves the gravity of the finding without turning one company’s assessment into greater certainty than its documents support.