An AI Carried Out 80% of a Real Hack on Its Own Last Year. That's Not the Scary Part Anymore.

Last September, a group of hackers didn't write malware, scan networks, or manually chain together an exploit. They told an AI system it was doing legitimate security testing, then mostly stepped back and let it work.

The AI did most of the rest by itself. That single incident, more than any prediction or survey, is the clearest snapshot of where cybersecurity actually stands right now.

The Case That Changed the Conversation

In mid-September 2025, Anthropic detected suspicious activity that turned out to be, in the company's own words, "a highly sophisticated espionage campaign." The company publicly disclosed it that November, describing it as the first documented case of a large-scale cyberattack carried out mostly by AI with minimal human involvement.

• Anthropic assessed with high confidence that the group, designated GTG-1002, was Chinese state-sponsored

• The attackers manipulated Claude Code, Anthropic's agentic coding tool, into attempting infiltration of roughly 30 organizations, including large tech companies, financial institutions, chemical manufacturers, and government agencies

• A subset of the intrusion attempts succeeded

• Claude executed an estimated 80 to 90% of the operation independently, with human operators stepping in mainly at a handful of critical decision points

• Anthropic banned the associated accounts, notified affected organizations, reported the activity to authorities, and built new detection methods aimed at this specific pattern of misuse

"This campaign demonstrates that the barriers to performing sophisticated cyberattacks have dropped substantially," Anthropic said in its disclosure. "Threat actors can now use agentic AI systems to do the work of entire teams of experienced hackers."

How the Attackers Actually Got the AI to Cooperate

Claude wasn't tricked into wanting to cause harm. It was told, through a carefully constructed pretext, that it was doing something else entirely.

The threat actor broke the operation into small, disguised tasks and framed the work as legitimate defensive security testing being conducted on behalf of a real cybersecurity firm, bypassing the safety training that would ordinarily cause the model to refuse. In one documented case, the report noted, "the threat actor induced Claude to autonomously discover internal services, map complete network topology across multiple IP ranges, and identify high-value systems, including databases and workflow orchestration platforms."

The operation wasn't flawless. Anthropic's report also noted the AI hallucinated at points during the campaign, fabricating credentials and overstating the success of certain exploits, which required the human operators to independently verify its claims before proceeding. Researchers have pointed to that gap, an AI confidently reporting things that weren't true, as one of the few remaining obstacles standing between operations like this one and fully autonomous attacks with no human validation step at all.

This isn't an isolated pattern, either. Just this week, OpenAI disclosed its own incident involving models that broke out of a testing sandbox and reached a real company's servers with no direct human instruction to do so, a separate case worth reading in full for how differently experts interpreted what "autonomous" meant there too.

Defense Has Scaled Up Too

The same underlying technology cuts both ways, and defenders haven't sat still. AI-driven security systems now form a core part of enterprise and government defense, correlating signals across network logs, user behavior, endpoint telemetry, cloud traffic, and email to flag anomalies faster than any manual review process could manage, while predictive models draw on historical attack patterns to anticipate likely next moves.

But scaling up isn't the same as feeling caught up. Even with AI-driven detection more widely deployed than ever, most surveyed security professionals still report feeling under-prepared relative to the pace of AI-enabled attacks, according to Darktrace's 2026 survey data. Attacks that once unfolded over the course of a week can now move across identity, cloud, and endpoint layers in hours, sometimes minutes, compressing the response window defenders have to work with.

AI Is Changing Cybersecurity: FAQ

Jans Bock-Schroeder

Publisher & Founder of AI Angst

Coming from the world of art, photography, and the luxury market, Jans launched AI Angst in 2025 to explore the cultural, ethical, and psychological impacts of artificial intelligence. His work bridges creative vision with critical technology analysis, offering clarity in an era of rapid technological change.