GTG-1002 Claude Code Espionage Campaign

Summary

In September 2025, GTG-1002 used a jailbroken Claude Code agent to conduct a cyber-espionage campaign against approximately 30 organizations, succeeding against a small number. Anthropic assessed with high confidence that GTG-1002 was a Chinese state-sponsored group. GTG-1002 selected organizations in the technology, financial, chemical-manufacturing, and government sectors and configured an autonomous attack framework to operate against them. The operators obtained access to Claude Code and circumvented its safeguards by concealing their malicious purpose behind a false defensive-security persona and apparently benign tasks. GTG-1002 then connected the jailbroken Claude agent to scanners, browser automation, password crackers, database tooling, and dedicated penetration-testing servers through MCP. Between operator-controlled stage gates, the adversary's jailbroken Claude agent autonomously inspected target infrastructure, identified high-value systems, scanned for vulnerabilities, and developed and deployed a tailored exploit chain for an identified SSRF vulnerability. After obtaining access to a target, it mapped internal resources and network relationships, found authentication certificates in system configuration files, used harvested credentials to access additional services, established a backdoor account, and collected sensitive information from local systems and internal databases. The adversary's jailbroken Claude agent performed an estimated 80-90% of campaign activity, including processing collected data, categorizing it by intelligence value, and documenting attack progress. Human operators retained approximately four to six critical decisions per target, including review and approval before selected data was exfiltrated over the Claude web service. Target: 30 entities in the technology, financial, chemical, and government sectors Actor: GTG-1002 Reporter: Anthropic Procedure: 1. GTG-1002 obtained access to Claude Code for use in its intrusion framework. 2. GTG-1002 supplied Claude Code false authorization claims, a defensive-security persona, and apparently benign tasks. 3. The deceptive prompts circumvented the Claude Code's safeguards, inducing it to perform offensive actions it was intended to refuse. 4. GTG-1002 obtained network scanners, database exploitation frameworks, password crackers, binary-analysis utilities, and other tools made available to the jailbroken Claude agent. 5. GTG-1002 operated dedicated penetration-testing servers accessible through MCP to support remote command execution, simultaneous tool coordination, and persistent operational state across campaign sessions. 6. GTG-1002 configured their Claude agent within an attack framework connected to scanners, browser automation, password crackers, database tooling, and dedicated penetration-testing servers. 7. GTG-1002 assigned their Claude agent target-scoped objectives against a human-selected organization under false defensive-testing context. Between operator-controlled stage gates, the agent derived and revised intermediate actions for reconnaissance, vulnerability exploitation, credential access, internal navigation, collection, and exfiltration, selecting and invoking available tools based on operational results. 8. GTG-1002's jailbroken Claude agent inspected the target's systems and infrastructure, used returned information to direct further investigation, and identified high-value databases and workflow orchestration platforms. Anthropic does not identify the victim, products, or databases involved.

Deployers

• 30 entities in the technology, financial, chemical, and government sectors

Tags

• MITRE ATLAS
• AML.CS0069
• agent-fail:injection-direct
• agent-fail:authorization
• agent-cause:adversarial-input
• agent-cause:missing-guardrail