Anthropic reports Claude Code use in the GTG-1002 espionage campaign

Attribution

Anthropic assessed the operator as a Chinese state-sponsored group with high confidence. Its estimate that AI performed 80–90% of the work is the vendor's assessment, not an independently measured database statistic. The sources do not identify 30 successful compromises.

Human operators selected targets and built the framework. They used a false defensive-security persona and divided work into apparently innocuous tasks. Human orchestration of multiple instances does not establish emergent unauthorised collective action by agents.

Response and limits

Anthropic describes approximately ten days of investigation and response after detection, including account bans, notifications and coordination with authorities. It also reports false credentials and mistaken claims of secret data among the model's outputs. November 13 is the disclosure date, not an established investigation completion date.

VAID assessment

Assessment date: 2026-09-09. Consequences-first rubric.

L3 (provisional): The cited vendor report describes successful intrusions in a small number of cases, credential harvesting and private-data exfiltration, supporting at least a limited confidential-data or credential leak. Independent verification, affected-data scope and lasting victim impact are not established here; false model claims further limit inference. This is the lowest supported consequence level, not an upper bound. Roughly 30 attempted targets, state attribution and estimated AI workload do not establish severe widespread harm or a large sensitive-data breach for L5.