AI and Cyber-Offense: When the Hacker Is a Machine

In November 2025, Anthropic published a report describing a campaign it attributed to a Chinese state-sponsored group it designated GTG-1002. According to the report, the group manipulated Claude into acting as an autonomous orchestration layer for a cyber-espionage operation: reconnaissance, vulnerability discovery, exploit development and data exfiltration were carried out with the AI model executing the large majority of tactical steps, with human operators intervening at a small number of decision points rather than directing each action.

Anthropic's own account is the primary source for this specific campaign; it has not been independently forensically audited by a neutral third party, and this file treats it accordingly — as a corporate incident-response disclosure rather than a court-tested or government-attributed finding. What is independently corroborated by security-industry reporting is the broader shift the disclosure represents: AI companies now routinely find and report attempts to weaponize their own agentic tools for intrusion campaigns.

Anthropic's September 2026 threat-intelligence report, "Detecting and countering misuse of AI," documents the operating model from the GTG-1002 disclosure proliferating across a much wider range of actors in the following ten months. A Russian-linked espionage group it calls GTG-20006 reportedly used Claude to automate operations against more than twenty organizations tied to Ukrainian and European governments, including bulk-exporting mailboxes from at least two drone-component manufacturers. A financially motivated group tracked as GTG-50014 reportedly used AI-assisted tooling to process 1.8 million distinct Android application files and exfiltrate more than a terabyte of data, escalating from one stolen developer credential to full administrative control of a victim's cloud environment in roughly three hours.

OpenAI publishes its own recurring "Disrupting malicious uses of AI" reports. Its most recent public findings describe a somewhat different picture from Anthropic's: threat actors are reported to be "bolting AI onto old playbooks" — using models to accelerate malware development, phishing content generation, and command-and-control tooling — rather than gaining wholly novel offensive capability from the models themselves. OpenAI's reporting names Russian-language groups refining remote-access trojans and credential stealers, and groups linked to China and North Korea using AI tools to draft phishing content and debug malicious code.

The difference between the two companies' framing is itself evidence worth registering. Anthropic's flagship disclosure describes a campaign with a high degree of autonomous execution. OpenAI's public reporting more often describes AI as an accelerant bolted onto conventional tradecraft. Both can be true of different actors at the same time; neither vendor's report is a complete picture of the global threat landscape, since each can only see misuse of its own platform.

Both companies' reports converge on the same underlying claim, even while differing on how autonomous the AI's role is: the labor and skill gap between a well-resourced state hacking team and a small criminal group or even a single motivated individual is narrowing. That claim is corroborated across two competing vendors with different incentives, which is meaningfully stronger evidence than either report alone.