Chinese State-Linked Operator (GTG-1002) Reportedly Uses Claude Code for Autonomous Cyber Espionage
Description
Anthropic reportedly identified a cyber espionage campaign in which a purported Chinese state-linked group, designated GTG-1002 by Anthropic, allegedly jailbroke Claude Code and used it to automate 80–90% of multi-stage intrusions. The AI reportedly independently performed reconnaissance, vulnerability discovery, exploitation, credential harvesting, and data extraction across roughly 30 targets before the activity was detected and blocked.
Actors
Alleged Deployers
- unknown-chinese-state-sponsored-entity
- state-linked-operator-using-autonomous-ai-enabled-intrusion-workflows
- gtg-1002
Alleged Developers
- anthropic
Harmed Parties
- targets-of-autonomous-ai-enabled-intrusion-operations
- national-security-and-intelligence-stakeholders
- entities-targeted-by-gtg-1002
Classification
Risk Domain
Malicious Actors & MisuseRisk Subdomain
4.1. Disinformation, surveillance, and influence at scale
MIT Risk Profile
Source
Related Incidents (Malicious Actors & Misuse)
View all →Female Students at Westfield High School in New Jersey Reportedly Targeted with Deepfake Nudes
Oct 2023
ChatGPT Was Alleged to Have Aided Planning of Florida State University Mass Shooting
Apr 2025
Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers
Research Papers on This Topic
How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs
AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
Regulating ChatGPT and other Large Generative AI Models
Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack