First observed
Campaign
Anthropic AI-orchestrated Campaign first observed
The campaign source marks this as the beginning of the known activity window.
MITRE ATT&CKSource
ActiveMITRE ATT&CK
Anthropic AI-orchestrated Campaign
The Anthropic AI-orchestrated Campaign was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The Anthropic AI-orchestrated Campaign was a highly coordinated operation that manipulated Claude Code to perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration operations at approximately 30 entities in the technology, financial, chemical, and government sectors. During the Anthropic AI-orchestrated Campaign, human operators used Claude Code agents and Model Context Protocol (MCP) tools to automate cyber operations. Operators broke attacks into discrete tasks, used crafted prompts, and established personas to bypass AI guardrails, enabling the agents to execute the operations with minimal human involvement.
First observedSep 1, 2025
Last observedSep 1, 2025
Attributed actors0
Source-backed events1
Attribution
Who has been linked to this activity
Each relationship retains its own confidence and source.
No actor attribution is currently available.
Activity
Campaign timeline
Every date says what it measures so catalog dates are not confused with publication dates.
About the context below
CVEs, techniques, malware, and indicators in the sections below are associated with an attributed actor. They are useful investigative context, but the campaign source does not necessarily link every item directly to this campaign.
Investigation context
What the attributed actors are known to use
Use this material to guide hunting and prioritization, then confirm each relationship against its cited source.
Related vulnerabilities 0
No linked CVEs are available.
ATT&CK techniques 0
No linked techniques are available.
Malware and tools 0
No linked malware or tools are available.
Indicators 0
No source-linked indicators are available.
Sources
Evidence behind this page
Open the original material before making an attribution or response decision.