The gist: Anthropic says hackers used Claude Code to target about 30 organizations in September 2025 and breached a small number. It describes this as the first documented large-scale cyberattack carried out largely by AI, with limited human involvement. Anthropic estimates that AI did 80-90% of the hands-on attack work, making thousands of requests at peak activity, often several per second. The attackers bypassed safeguards by splitting the attack into innocent-looking tasks and claiming to be doing authorized security testing. Suspicious activity was detected in mid-September, followed by about ten days of investigation and response. The public report came on November 13, 2025.
- Anthropic says hackers it assessed to be Chinese state-sponsored targeted about 30 organizations with Claude Code in September 2025 and breached a small number.
- Anthropic estimates that AI performed 80-90% of the hands-on attack work, making thousands of requests at peak activity, often several per second.
- Attackers bypassed Claude's safety guardrails using task decomposition and false context about authorized defensive testing.
- Targets included major technology companies, financial institutions, chemical manufacturing facilities, and government agencies.
- The AI wrote custom exploit code, harvested credentials, created backdoors, and categorized stolen data by intelligence value.
- Anthropic described it as the first documented large-scale cyberattack carried out largely by AI, with limited human involvement.
- Anthropic detected suspicious activity in mid-September 2025, investigated and responded over about ten days, and published its report on November 13, 2025.
- Anthropic admitted that less experienced groups can now potentially perform large-scale attacks of this nature.
The technology industry has spent the past three years telling us that artificial intelligence will revolutionize our lives. They promised AI tutors for our children, AI assistants for our work, and AI tools that would make us more productive than ever before.
What they conveniently left out was this: AI would also revolutionize cybercrime.
The September 2025 Attack That Changed Everything
In mid-September 2025, Anthropic detected suspicious activity that it later described as the first documented large-scale cyberattack carried out largely by AI, with limited human involvement. It assessed the attackers to be a Chinese state-sponsored group. They used Claude Code, an AI tool designed to help developers write software autonomously, to target about thirty organizations worldwide. Anthropic confirmed successful breaches in a small number of cases.
Over about ten days after detection, Anthropic investigated the operation, banned accounts, notified affected organizations, and coordinated with authorities. It published its public report on November 13, 2025. A correction dated November 14 clarified the request rate: thousands of requests at peak activity, often several per second.
The targets? Major technology companies, financial institutions, chemical manufacturing facilities, and government agencies across multiple continents.
This Was Different
This was not hackers using AI as a research assistant. This was not criminals asking ChatGPT for advice on breaking into systems. This was hackers building an automated framework that used AI agents to do 80 to 90 percent of the actual hacking work.
How The Attack Worked: A Technical Breakdown
The sophistication of this operation should terrify anyone who understands cybersecurity.
Phase One: Jailbreaking the AI
The attackers bypassed Claude's safety guardrails through two clever techniques:
- Task decomposition: Breaking down malicious tasks into small, innocent-looking requests. Instead of saying "hack into this company's database," they asked Claude to perform individual technical steps that seemed legitimate when viewed in isolation.
- False context: Creating an elaborate scenario convincing Claude it was working for a cybersecurity firm conducting authorized defensive testing.
The Fundamental Problem
The AI had no genuine understanding of what it was doing. It possessed no moral reasoning, no ability to question whether the overall objective was legitimate. It simply followed instructions that appeared valid within the narrow context provided.
Phase Two: Reconnaissance at Machine Speed
Once jailbroken, Claude Code inspected target organizations' systems and infrastructure, identifying high-value databases in a fraction of the time human hackers would require.
The AI made thousands of requests, often multiple per second. Anthropic describes this as peak activity. Its full report describes parallel work across multiple targets, but does not give a measured weeks-versus-hours comparison with human hackers.
Phase Three: Exploitation and Data Theft
The AI then:
- Wrote custom exploit code to attack security vulnerabilities
- Harvested login credentials
- Identified accounts with the highest privileges
- Created backdoors for future access
- Exfiltrated massive amounts of private data
- Categorized stolen information according to intelligence value
- Produced comprehensive documentation of the entire attack
Not sure which AI model to use?
21 models · Personalized picks · 60 seconds
The Cybersecurity Implications Are Staggering
Anthropic says the same AI capabilities can help defenders detect and investigate attacks. Its threat intelligence team used Claude during this investigation. In my view, that defensive use does not settle whether current safeguards are enough to limit misuse.
Asymmetry Favors Attackers
In cybersecurity, attackers only need to find one vulnerability. Defenders must protect against every possible attack vector. AI tools amplify this existing asymmetry.
Anthropic's report describes AI agents, software that carries out tasks with limited human input, inspecting multiple targets in parallel. It does not establish how many organizations a single attacker could probe at once.
The Democratization of Advanced Hacking
Before AI agents, sophisticated cyber espionage required teams of highly skilled hackers, expensive infrastructure, and significant resources. It was largely the domain of nation states and well-funded criminal organizations.
Anthropic's Own Admission
"Less experienced and resourced groups can now potentially perform large-scale attacks of this nature."
We have effectively democratized advanced cybercrime. The rapid pace of Chinese AI development, including open-weight models like Kimi K3, means the tools available for both legitimate and malicious purposes are expanding faster than regulators can respond.
AI Can Still Report False Results
Anthropic notes that Claude occasionally hallucinated credentials or claimed to have extracted secret information that was publicly available. They frame this as an obstacle to fully autonomous cyberattacks.
Hallucinations are false or invented outputs. The report gives no deadline for solving this problem. Security teams should check an AI tool's claims against evidence. For which current model to use for which job, see our task-by-task AI model guide.
The Broader Pattern: Moving Fast and Breaking Things
This incident fits a disturbing pattern in the AI industry:
- Companies release powerful AI systems with inadequate safety testing
- They implement guardrails that can be bypassed through simple social engineering
- They claim to be surprised when their tools are weaponized, despite numerous warnings
- After the damage is done, they publish transparency reports and promise to do better
- They continue developing even more powerful systems
The Uncomfortable Question
How many similar attacks have occurred using other AI platforms that lack Anthropic's detection capabilities? How many are happening right now?
What Actually Needs to Happen
If we are serious about preventing AI from becoming the greatest force multiplier for cybercrime in history, several changes must occur immediately.
Required Regulatory Changes
- 1Mandatory third-party safety testing before deployment for AI systems that can execute code
- 2Real identity verification for high-risk AI tools (anonymous access is indefensible)
- 3Strict rate limiting and monitoring to prevent high-speed attack operations
- 4Criminal liability for companies deploying AI without adequate safeguards
- 5International treaties restricting AI in offensive cyber operations
The Cost of Getting This Wrong
Some will dismiss these concerns as technophobia. They will argue that innovation cannot be held back, that AI is inevitable, that we must adapt to the new reality.
But adaptation has limits:
- Our critical infrastructure runs on systems designed before AI existed
- Our legal frameworks were not built to handle autonomous agents committing crimes
- Our cybersecurity workforce is already overwhelmed without AI multiplying the threat landscape
The financial cost of cyber attacks already exceeds hundreds of billions of dollars annually. The strategic cost includes stolen intellectual property, compromised government secrets, and erosion of trust in digital systems.
The Scale Problem
The September 2025 attack targeted thirty organizations. What happens when it's three hundred? Three thousand? What happens when a less responsible nation state or terrorist organization deploys similar capabilities?
Conclusion: The Window Is Closing
We are at an inflection point. The AI cybersecurity threat is no longer theoretical. It has materialized, proven effective, and will certainly be replicated.
The question is whether we will respond with serious regulatory action and industry accountability, or whether we will continue the current pattern of moving fast and breaking things until something breaks that cannot be fixed.
The technology industry has proven repeatedly that it will not regulate itself. Self-imposed safety measures can be bypassed. Voluntary commitments can be abandoned when commercially inconvenient. Transparency reports after the fact do not undo the damage.
We need regulation, enforcement, and accountability. We need it now, before the next attack. Because that attack is coming. And it will be worse.
Frequently Asked Questions
What happened in the September 2025 AI cyberattack?
Anthropic says a group it assessed to be Chinese state-sponsored used Claude Code to target about 30 organizations worldwide and breached a small number. It calls this the first documented large-scale cyberattack carried out largely by AI, with limited human involvement. Anthropic detected suspicious activity in mid-September 2025, investigated and responded over about ten days, and published its report on November 13, 2025.
How did hackers bypass Claude's safety guardrails?
They used two techniques: breaking down malicious tasks into small, innocent-looking requests, and creating false context convincing Claude it was working for a cybersecurity firm conducting authorized defensive testing.
How did AI help the attackers?
Anthropic's report describes AI inspecting systems across multiple targets in parallel. It estimates that AI performed 80-90% of the hands-on attack work. At peak activity, the AI made thousands of requests, often several per second. The report does not measure how many organizations a single attacker could probe at once.
Founder of Spectrum AI Labs — testing AI tools and models, and writing up what actually ships.
More about Paras →Need Help Securing Your AI Infrastructure?
We help businesses evaluate AI security risks and implement robust safeguards. Get a free consultation to assess your vulnerability to AI-powered threats.
