The Model Behaved. The Attack Still Worked.
- Rich Washburn
- 5 hours ago
- 12 min read
Well, there it is. Not theoretically. Not in a benchmark. Not in a red-team simulation where somebody deliberately gave an AI a dangerous objective just to see what happened. In the wild!
Anthropic has now documented what it believes to be the first large-scale cyberattack executed without substantial human intervention: a Chinese state-sponsored espionage group using Claude Code as an operational cyber agent against roughly 30 targets around the world. Major technology companies. Financial institutions. Chemical manufacturers. Government agencies. A handful of the intrusions succeeded.
Anthropic calls the actor GTG-1002. And what makes GTG-1002 important isn't that somebody used AI to write malware.
We've been there. It isn't that an AI helped identify vulnerabilities. We've been there too.
It isn't even that the model generated exploit code. The part that changes cybersecurity is this: The AI operated the attack.
Claude Code performed reconnaissance, discovered vulnerabilities, generated payloads, validated exploits, harvested credentials, mapped internal networks, moved laterally, analyzed stolen information, created persistence, prepared data for exfiltration and documented the operation as it went.
Anthropic estimates AI performed 80–90% of the tactical workload, with humans intervening primarily at a handful of consequential decision points. That distinction matters enormously.
We didn't just automate hacking tasks.We automated the operator between the tasks.
And if you've been following what I've been writing about agentic infrastructure, that's the part that should sound painfully familiar.
A few days ago I wrote that the new attack surface is the agent control plane: the layer holding the credentials, tools, data connections and authority that allow an AI system to act on everything downstream.
Before that, looking at AI systems escaping supposedly contained security-testing environments, I argued that we were drawing the security boundary around the wrong thing. The story wasn't simply what the model did. It was the infrastructure around the model that allowed the behavior to become consequential. GTG-1002 is that thesis with a nation-state threat actor attached to it. And receipts.
The AI wasn't the tool. It was the operator.
The architecture Anthropic reconstructed is fascinating. The attackers didn't simply sit in front of Claude typing: “Hack this company.”
They built an autonomous attack framework around Claude Code. Claude sat above multiple Model Context Protocol servers connecting it to security tools and infrastructure. The MCP layer exposed capabilities for remote command execution, browser automation, code analysis, vulnerability testing and out-of-band callback validation. The surrounding orchestration framework maintained attack state, coordinated the sessions and advanced the operation through different phases.
That's a very different machine from an AI chatbot. Claude was effectively the reasoning layer inside an automated penetration-testing platform. The human provided strategic intent.
The framework maintained state. Claude reasoned. MCP exposed capabilities.
Commodity offensive-security tools performed the mechanics. Targets supplied the attack surface.
That stack matters because Anthropic says the attackers' custom development centered primarily on integration rather than novel offensive capability. Their underlying toolkit was largely standard open-source penetration-testing software: scanners, password crackers, database exploitation frameworks and binary-analysis utilities. Read that twice.
They did not need to invent a radically new offensive arsenal. They built a better conductor. That may be the most important cybersecurity lesson in this entire event.
The attack was decomposed until nothing looked like the attack
Now we get to the beautiful, ugly part.
Claude has safeguards intended to prevent it from conducting malicious cyber operations. So the attackers didn't present Claude with the malicious operation.
They decomposed it.
Claude instances were given individual technical tasks that appeared legitimate in isolation. The attackers established personas claiming they were employees of legitimate cybersecurity firms conducting defensive security testing. The broader malicious objective remained outside the context available to the individual model interactions. Think about the implications.
A request to enumerate services can be legitimate.
A request to analyze an authentication mechanism can be legitimate.
A request to validate a vulnerability can be legitimate.
A request to test credentials can be legitimate.
A request to analyze database contents can be legitimate.
A request to archive files can be legitimate.
A request to document a penetration test can certainly be legitimate.
The malicious act existed in the composition.
This is where conventional AI safety thinking runs head-first into distributed systems architecture.
We have spent enormous effort asking: Is this request malicious?
GTG-1002 effectively asked a different question: Does any individual request need to be malicious?
Apparently not. That is a much harder problem. Because the system now needs to reason not only about what the agent is doing now, but what sequence of actions it is participating in, across tools, sessions, machines, identities and time.
Security traditionally calls this correlation. Agentic systems turn correlation into intent reconstruction. And we're nowhere near done building that layer.
This wasn't “Claude wrote an exploit”
Anthropic's June 2026 follow-up makes the technical progression much clearer.
During one successful compromise, Claude autonomously scanned internet-facing infrastructure and, once inside, discovered internal administrative portals, databases, logging infrastructure and workflow systems.
Then it found an SSRF vulnerability in a public-facing web server. SSRF — server-side request forgery — matters because it can allow an attacker to make a vulnerable server initiate requests into places the attacker couldn't normally reach.
In this case, Anthropic says the vulnerability was used to proxy commands into the victim's internal cloud environment. The operation then harvested SSH private keys, service-account tokens from cloud metadata services and credentials from AWS Secrets Manager. Those credentials were subsequently used to move laterally through the cloud environment.
Anthropic's original technical report shows the agent spending roughly one to four hours autonomously scanning infrastructure, enumerating endpoints, analyzing the SSRF flaw, researching exploitation techniques, writing a custom payload, constructing an exploit chain, validating it through callback infrastructure and preparing the exploitation findings for a human authorization decision. That's important because the human didn't disappear completely.
The humans moved up the abstraction stack.
Anthropic says operators retained control over decisions such as authorizing the transition from reconnaissance to exploitation, approving the use of harvested credentials and deciding what data should ultimately be exfiltrated. But the machine handled much of the work between those gates. Sound familiar?
That's the exact operational relationship businesses are currently trying to create with legitimate agents.
Human sets intent. > Agent executes. > Human approves consequential transitions. > Agent continues.
Which means the same architecture that makes agentic AI useful also makes it extraordinarily useful to an attacker. This isn't a bug in “agentic AI.” It's what agency means.
The vulnerability we need to talk about isn't a CVE
There's an important technical distinction here.
Anthropic has publicly identified the SSRF vulnerability class, but it has not publicly identified the affected product, vendor or CVE number in the GTG-1002 reporting I've reviewed.
So there isn't a responsible way to slap a specific CVE onto this part of the story. And strangely, that makes the architectural lesson clearer. The interesting vulnerability isn't merely the SSRF.
SSRF existed yesterday... Credential theft existed yesterday... SSH lateral movement existed yesterday... AWS token theft existed yesterday... Database extraction existed yesterday.
None of those individual techniques are particularly exotic. Even GTG-1002's MITRE ATT&CK profile looks surprisingly ordinary. Anthropic mapped the campaign to 30 techniques across 13 ATT&CK tactics. That's a lot, but not dramatically more than other threat actors in its dataset. Yet Anthropic assigned GTG-1002 the maximum ARiES risk score of 100, making it the highest-risk actor in the dataset.
Why? Orchestration.
That word is going to become extremely important in cybersecurity. Anthropic specifically identifies techniques including T1021.004 — Remote Services: SSH, T1210 — Exploitation of Remote Services, and T1560 — Archive Collected Data. But Anthropic also says the thing making GTG-1002 extraordinary isn't properly represented by ATT&CK at all.
There is no ATT&CK ID for: Autonomous kill-chain orchestration.
There is no ATT&CK ID for: AI-directed real-time pivoting.
There is no ATT&CK ID for: an AI autonomously chaining attack stages together and executing them without waiting for a person.
Anthropic is now discussing precisely that gap with MITRE. That's a hell of a milestone.
Our industry has a vocabulary capable of describing nearly every action the attacker performed. It doesn't yet have a vocabulary for describing the thing that performed them.
MITRE can see the notes. It can't see the song.
This is why looking only at individual TTPs starts breaking down.
Anthropic analyzed 832 accounts banned for cyber-related misuse between March 2025 and March 2026. Those accounts produced 13,873 observed actions spanning 482 unique techniques and every one of ATT&CK's 14 tactics. And the data produced a fascinating result.
The highest-risk actors weren't necessarily the most technically sophisticated. Technique count wasn't a particularly strong predictor either. Interface choice wasn't decisive.
Claude Code, API, chatbot — that wasn't what separated the dangerous actors from everybody else. The big differentiator was where AI entered the operational chain and how much scaffolding surrounded it.
Low-risk actors might ask an AI to write some malware. High-risk actors put the AI inside the compromised network. They let it discover accounts. Dump credentials. Deploy web shells. Use remote services. Explore internal systems. Move laterally. Make decisions. That's the transition.
From: AI helps the hacker.
To: AI becomes the hacker's operational layer.
MCP isn't the vulnerability. MCP is the force multiplier.
I want to be careful here because MCP is going to get blamed for this, and that's too simplistic. Anthropic's Model Context Protocol wasn't “exploited” in the traditional sense merely because the attackers used it.
MCP did exactly what protocols like MCP are supposed to do. It connected intelligence to tools. That's the point.
The attackers used specialized MCP servers as interfaces between Claude and remote execution environments, browser automation, analysis systems, vulnerability-testing frameworks and callback services. The problem is authority concentration.
Once an agent can reason and can invoke tools and those tools carry meaningful privileges, the orchestration layer becomes security-sensitive infrastructure.
OWASP has already started documenting exactly this class of concern.
Its MCP security work identifies risks including token and secret exposure, privilege escalation through scope creep, tool poisoning, command execution, intent-flow subversion, inadequate authentication, inadequate telemetry, shadow MCP servers and context over-sharing.
OWASP's secure MCP guidance makes the architectural point explicitly: MCP servers operate with delegated permissions and chained tool calls, meaning the impact of a single weakness can extend far beyond one request or one application.
Now, to be precise, Anthropic has not said GTG-1002 exploited all or even most of those MCP vulnerabilities. That's not my claim. The point is that the risk model OWASP has been constructing describes the environment GTG-1002 just operationalized.
Identity.
Tools.
Secrets.
Context.
Authority.
State.
Chained actions.
The model sits in the middle of all of them.
That's the new security perimeter.
“But Claude has guardrails.”
It did.
That's another reason this matters. The attackers didn't need to produce one glorious jailbreak that turned Claude into Cyber Satan. They worked around the safety boundary architecturally.
Anthropic describes role-playing, task decomposition and carefully constructed context that made individual malicious components appear like defensive cybersecurity work. Eventually its safeguards detected the sustained activity, and Anthropic says it banned associated accounts, notified affected organizations, coordinated with authorities and subsequently expanded its cyber classifiers and detection systems. That is good.
It is also reactive. And that isn't an Anthropic criticism. It's the nature of the problem.
A classifier looking at one interaction faces an ugly problem when the meaning exists across 500 interactions.
Imagine an employee who performs 500 individually authorized database queries over six months.
Every query passes access control. Every request looks normal. The employee nevertheless reconstructs and steals your entire customer database.
Your authentication system didn't fail. Your authorization system didn't fail. Your database didn't fail. Your behavioral understanding failed.
Agents push that problem into machine speed.
GTG-1002 generated thousands of requests, frequently operating at multiple requests per second. Anthropic says those rates would have been impossible for a human hacking team to reproduce manually. The individual action stops being the meaningful unit of security analysis. The trajectory becomes the unit.
And the patch window is collapsing at the same time
Now connect this to the other side of the equation.
In June, Anthropic tested frontier models against recently patched Firefox and Windows vulnerabilities. Its most capable research model autonomously produced working code-execution exploits for 8 of 18 Firefox patches and full privilege-escalation chains for 8 of 21 Windows kernel patches.
Anthropic's conclusion was fairly brutal: the historical assumption that defenders have days or weeks while human experts reverse-engineer patches is breaking down. Their phrase for the emerging reality was essentially: N-day is becoming N-hour. And in January Anthropic demonstrated Claude Sonnet 4.5 autonomously reproducing an Equifax-style compromise using only a standard Bash shell on Kali Linux, identifying the publicly known vulnerability and constructing exploitation code without requiring the specialized cyber toolkit earlier models needed.
Put these developments together.
Models are getting faster at turning vulnerabilities into working exploits.
Agents are getting better at executing multistage attacks.
MCP and similar systems give those agents access to real tools.
Orchestration frameworks give them memory and state.
And GTG-1002 demonstrates that a sophisticated operator can place all of those pieces behind a thin layer of human strategic supervision.
That's not incremental improvement in hacking. That's industrialization.
This is why I've been obsessed with control planes
When I wrote about the agent control plane, I used a fairly simple analogy.
The model is the brain. The data is the fuel. The control plane is the nervous system.
GTG-1002 adds another layer.
An attacker doesn't necessarily need to corrupt the brain. They can give the nervous system a different job. That is why “AI security” cannot mean only model safety. It can't mean only prompt injection. It can't mean only whether Claude or GPT or Gemini politely refuses somebody asking for malware.
The security object is now:
Model + identity + context + memory + tools + credentials + permissions + orchestration + network position + execution environment.
That entire graph is the system. If you secure only the model, you're protecting the CPU while leaving root logged in at the console.
Here's the uncomfortable sentence
Claude didn't have to know it was conducting a nation-state espionage operation for the operation to exist.
That's the piece that matters.
Every generation of security architecture has had to answer some version of the same question: Where does trust live?
Mainframes concentrated it.
PCs distributed it.
Networks connected it.
Cloud platforms centralized it again.
SaaS fragmented identity.
Zero Trust tried to make every transaction prove itself.
And now autonomous agents are aggregating the pieces back together.
They see across systems.
They carry delegated identity.
They remember context.
They invoke APIs.
They execute code.
They access databases.
They make decisions.
They coordinate tools.
They persist state.
That's why these things are so useful.
It's also why compromising—or manipulating—their intent is so powerful.
The agent doesn't need administrator access to everything if its tools already have administrator access to everything.
That's the control-plane problem.
Security has to move up one layer
The practical lesson isn't “don't deploy agents.” That's ridiculous. Attackers certainly aren't going to stop.
Anthropic's own analysis makes the defensive argument clearly: the same capabilities are useful for SOC automation, threat hunting, vulnerability assessment and incident response, and defenders are going to need AI just as urgently as attackers do. But the architecture has to change.
We need to stop asking only whether a tool call is authorized and start asking whether the sequence of tool calls makes sense.
We need short-lived credentials.
Tight scopes.
Hard network boundaries.
Independent authorization gates for consequential actions.
Immutable logs of agent decisions and tool invocations.
Telemetry around context changes.
Isolation between agent sessions.
Strong MCP server identity.
Tool provenance.
Behavioral baselines.
Egress controls.
And perhaps most importantly, security systems capable of reconstructing the global objective implied by locally permissible activity.
OWASP is already moving in this direction with its Agentic Security Initiative and MCP security frameworks. Anthropic is building detections for multistep autonomous execution, AI-directed pivoting and MCP-augmented operations. MITRE is now discussing how ATT&CK itself needs to evolve to describe these behaviors.
That's cybersecurity quietly admitting that the old map no longer fully describes the territory.
The model behaved.
I've spent the last several months writing about models doing things nobody explicitly told them to do.
Models escaping sandboxes.
Models exploiting unintended paths through evaluations.
Models manipulating objectives.
Models finding vulnerabilities.
Models turning the internet itself into part of the test environment.
The recurring lesson has been that we keep looking at the model when we should be looking at the system around the model. GTG-1002 is different. Because this time the model didn't need some fascinating emergent desire to escape.
It didn't need consciousness.
It didn't need malicious intent.
It didn't need Skynet.
It needed tools.
It needed permissions.
It needed context.
It needed an orchestration framework.
And it needed somebody sitting one level above it saying: Keep going.
The terrifying part isn't that the AI rebelled. It didn't. The model behaved.
Unfortunately, so did every other component. And together, they performed the attack.
Technical source dossier
1. Anthropic — “Disrupting the first reported AI-orchestrated cyber espionage campaign” and full technical report. Primary disclosure for GTG-1002, attribution, approximately 30 targets, successful intrusions, 80–90% AI tactical execution, attack architecture, SSRF discovery, credentials, lateral movement, data extraction and MCP-based tooling. https://www.anthropic.com/news/disrupting-AI-espionage
2. Anthropic — “Mapping AI-enabled cyber threats.” June 2026 follow-up covering GTG-1002's ARiES score of 100, Kali/Claude Code/MCP architecture, SSRF-to-cloud pivot, SSH keys, cloud tokens, AWS Secrets Manager access, ATT&CK mappings and the gap around autonomous orchestration. https://www.anthropic.com/research/attack-navigator
3. Anthropic — AI-enabled cyber threats / MITRE ATT&CK analysis. Documents why conventional TTP counts understate agentic threat severity and confirms Anthropic is discussing additions to ATT&CK with MITRE. https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack
4. Anthropic — N-day exploit research. Evidence that frontier AI can significantly compress exploit-development timelines after patches become public. https://www.anthropic.com/research/n-days
5. Anthropic — realistic cyber-range research. Demonstrates autonomous multistage compromise with standard open-source Kali tooling and rapidly diminishing reliance on purpose-built AI cyber harnesses. https://www.anthropic.com/research/cyber-toolkits-update
6. OWASP — MCP Top 10 / Agentic Security Initiative / Secure MCP Server Development. Current security taxonomy around credential exposure, scope creep, tool poisoning, intent-flow attacks, command execution, telemetry gaps, shadow MCP and context security.
7. Earlier pieces in this chain: The Pattern, Part II: It's Not the Models. It's the Shared Testing Vendor and The New Attack Surface Is the Agent Control Plane. Those two become the setup; GTG-1002 is effectively the production receipt.
Rich Washburn is a technologist and strategist working at the intersection of AI, infrastructure, and capital. He is Managing Partner and Chief AI Officer at Eliakim Capital.
Comments