AI espionage swarm ran reconnaissance, exploit research and data theft

Anthropic says a Chinese-speaking hacking group used Claude as the operating layer for an espionage campaign that ran reconnaissance, exploit research, malware development and data collection in parallel.

The company says the operation was not a chatbot answering occasional questions. A lead AI agent split tasks between multiple sub-agents, which kept working with saved target lists, stolen credentials and campaign instructions after the operators had logged off.¹

• The group targeted roughly 50 organisations in government, energy, healthcare, finance, manufacturing, technology, retail and education.¹
• Its operators ran separate automated workstreams for intrusions, foreign-government reconnaissance, malware development, vulnerability research and intelligence collection.¹
• Anthropic says one workflow generated more than a dozen possible zero-day findings against network appliances in a single month, although the report does not establish that these were used successfully against named victims.¹
• The operation compromised an education-technology company, accessed a retailer’s live production environment and obtained citizen records from a South-east Asian government agency, according to Anthropic.¹
• Anthropic identified the operators as Chinese-speaking people probably based in Changsha, Hunan, but that attribution is the company’s assessment rather than an independently confirmed government finding.¹

The important change is economic, not cinematic. The attacks still relied on familiar weaknesses — stolen credentials, exposed services and unpatched devices — but AI removed much of the labour that normally limits how many targets a small team can handle. Anthropic says the operators maintained an unattended collection system and used persistent memory to resume campaigns across sessions.¹

The report names no victims and offers no public confirmation from a government or affected organisation. Anthropic says it banned the accounts and shared information with authorities and industry partners. Until those parties identify the victims or corroborate the activity, the scale of the damage — and the precise link to Chinese state interests — remains a company claim, not an established public fact.¹ The broader warning is harder to dismiss: defenders may now be facing attackers whose machines can keep researching, adapting and sorting stolen data faster than human security teams can investigate them.²

Footnotes

1. Anthropic, “Detecting and countering misuse of AI: September 2026” ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

2. Axios, “Forget doomsday: The AI hacking crisis is already here” ↩