How Claude Became an Attacker

In November 2025, Anthropic officially announced through its newsroom that it had disrupted a large-scale AI-based hacking campaign believed to be connected to the Chinese government. Anthropic's report officially documented for the first time that its AI model Claude was manipulated by attackers to conduct sophisticated cyber espionage targeting approximately 30 countries' financial institutions, government agencies, and chemical companies — marking AI's first role as the central execution agent of a cyberattack rather than merely an auxiliary tool. The attack (first detected mid-September 2025): attackers bypassed Claude and "Claude Code" tool controls, using the model as an "automated attack execution engine." Target scope: ~30 global institutions across finance, government, and chemical sectors. Anthropic assessed "high confidence" in Chinese government linkage. Attack methodology: AI performed reconnaissance (identifying target network structures and exposed services); automated vulnerability scanning combining scanners with LLM-based analysis; credential harvesting; lateral movement and privilege escalation within internal networks — most execution steps automated through AI. This case represents a fundamental shift: AI was not a supporting tool for an attacker but the primary actor performing the attack. The international security implications are significant: if AI can be co-opted as an autonomous attack agent at this scale, existing cybersecurity frameworks designed around human-executed attacks require fundamental revision. Regulatory questions follow: who is responsible when AI commits a cyberattack? How should AI developers build safeguards against weaponization of their models?