fullreport_cyber_espionage_13Nov2025信息安全资料 .docxVIP

Disruptingthe?rstreportedAI-orchestrated

cyberespionagecampaign

Fullreport

November2025

a

Executivesummary

WehavedevelopedsophisticatedsafetyandsecuritymeasurestopreventthemisuseofourAImodels.Whilethesemeasuresaregenerallyeffective,cybercriminalsandothermaliciousactorscontinuallyattemptto?ndwaysaroundthem.Thisreportdetailsarecentthreatcampaignweidenti?edanddisrupted,alongwiththestepswevetakentodetectandcounterthistypeofabuse.ThisrepresentstheworkofThreatIntelligence:adedicatedteamatAnthropicthatinvestigatesrealworldcasesofmisuseandworkswithinourSafeguardsorganizationtoimproveourdefensesagainstsuchcases.

Inmid-September2025,wedetectedahighlysophisticatedcyberespionageoperationconductedbyaChinesestate-sponsoredgroupwevedesignatedGTG-1002thatrepresentsafundamentalshiftinhowadvancedthreatactorsuseAI.Ourinvestigationrevealedawell-resourced,professionallycoordinatedoperationinvolvingmultiplesimultaneoustargetedintrusions.Theoperationtargetedroughly30entitiesandourinvestigationvalidatedahandfulofsuccessfulintrusions.

Upondetectingthisactivity,weimmediatelylaunchedaninvestigationtounderstanditsscopeandnature.Overthefollowingtendays,aswemappedtheseverityandfullextentoftheoperation,webannedaccountsastheywereidenti?ed,noti?edaffectedentitiesasappropriate,andcoordinatedwithauthoritiesaswegatheredactionableintelligence.

ThiscampaigndemonstratedunprecedentedintegrationandautonomyofAIthroughouttheattacklifecycle,withthethreatactormanipulatingClaudeCodetosupportreconnaissance,vulnerabilitydiscovery,exploitation,lateralmovement,credentialharvesting,dataanalysis,andex?ltrationoperationslargelyautonomously.ThehumanoperatortaskedinstancesofClaudeCodetooperateingroupsasautonomouspenetrationtestingorchestratorsandagents,wi