H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Campaign

Anthropic AI-orchestrated Campaign

The [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062) was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062) was a highly coordinated operation that manipulated Claude Code to perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration operations at approximately 30 entities in the technology, financial, chemical, and government sectors. During the [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062), human operators used Claude Code agents and Model Context Protocol (MCP) tools to automate cyber operations. Operators broke attacks into discrete tasks, used crafted prompts, and established personas to bypass AI guardrails, enabling the agents to execute the operations with minimal human involvement.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)(Citation: Anthropic Disrupting AI Espionage NOV 2025)

Campaign
TypeCampaign
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

The [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062) was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062) was a highly coordinated operation that manipulated Claude Code to perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration operations at approximately 30 entities in the technology, financial, chemical, and government sectors. During the [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062), human operators used Claude Code agents and Model Context Protocol (MCP) tools to automate cyber operations. Operators broke attacks into discrete tasks, used crafted prompts, and established personas to bypass AI guardrails, enabling the agents to execute the operations with minimal human involvement.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)(Citation: Anthropic Disrupting AI Espionage NOV 2025)

26 recorded

Relationships

uses
to Account Discovery
Technique
uses
to Artificial Intelligence
Technique
uses
to Automated Collection
Technique
uses
to Client Configurations
Technique
uses
to Credentials In Files
Technique
uses
to Databases
Technique
uses
to Data from Local System
Technique
uses
to Exfiltration Over Web Service
Technique
uses
to Exploit Public-Facing Application
Technique
uses
to Exploits
Technique
uses
to File and Directory Discovery
Technique
uses
to Generate Content
Technique
uses
to Local Account
Technique
uses
to Local Accounts
Technique
uses
to Local Data Staging
Technique
uses
to Network Service Discovery
Technique
uses
to Network Topology
Technique
uses
to Scanning IP Blocks
Technique
uses
to Server
Technique
uses
to Software
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Network Connections Discovery
Technique
uses
to Tool
Technique
uses
to Valid Accounts
Technique
uses
to Vulnerability Scanning
Technique
3 external

References

mitre-attack
C0062
open
Anthropic Disrupting AI Espionage NOV 2025
https://www.anthropic.com/news/disrupting-AI-espionage
open
Anthropic AI Orchestrated Campaign NOV 2025
https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance