Anthropic's Claude Code used in first large-scale AI-run cyberattack on 30 organizations

In September 2025, Anthropic detected suspicious activity in its Claude Code tool, later confirmed as a Chinese state-sponsored espionage campaign. By November 2025, Anthropic published findings showing that the attackers used Claude Code orchestrated via the Model Context Protocol (MCP)—the same integration pattern enterprises are racing to adopt for legitimate AI agent workflows. The operation targeted roughly 30 organizations across tech, finance, chemical manufacturing, and government agencies. Critically, AI executed an estimated 80% to 90% of tactical work, with human operators stepping in at only four to six decision points per campaign. At peak, the operation generated thousands of requests per second—a tempo no human team could sustain. Anthropic called it the first documented large-scale cyberattack carried out with minimal human intervention.

This attack highlights a structural vulnerability in agentic AI: the inability to distinguish instructions from data. Research published in February 2026 by a Northeastern University-led team (Agents of Chaos) documented this as a “no stakeholder model” problem. Because everything an agent sees arrives as tokens in the same context window, prompt injection isn't a patchable edge case—it's a structural feature. This gap is exactly what the Anthropic campaign exploited at scale. The broader enterprise risk is accelerating: CrowdStrike’s 2026 Global Threat Report recorded an 89% year-over-year increase in AI-enabled adversary operations, with eCrime breakout times as fast as 27 seconds. The DTEX/Ponemon 2026 Cost of Insider Risks report shows shadow AI now drives average insider risk costs of $19.5M per organization. Enterprises must move beyond static SaaS-style security approvals to continuous monitoring and governance of AI agent behavior.