LLMHigh
Chinese State-Linked Operator (GTG-1002) Reportedly Uses Claude Code for Autonomous Cyber Espionage
- Occurred
- Nov 13, 2025
- Published
- Nov 28, 2025
- Source
- AI Incident Database
Summary
Anthropic reportedly identified a cyber espionage campaign in which a purported Chinese state-linked group, designated GTG-1002 by Anthropic, allegedly jailbroke Claude Code and used it to automate 80–90% of multi-stage intrusions. The AI reportedly independently performed reconnaissance, vulnerability discovery, exploitation, credential harvesting, and data extraction across roughly 30 targets before the activity was detected and blocked.
Developers
- Anthropic
Deployers
- Unknown Chinese state-sponsored entity
- State-linked operator using autonomous AI-enabled intrusion workflows
- GTG-1002
Harmed parties
- Targets of autonomous AI-enabled intrusion operations
- National security and intelligence stakeholders
- Entities targeted by GTG-1002
Tags
- espionage
- response
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: State-linked group jailbroke Claude Code for autonomous cyber espionage, causing significant security breach.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8