The first AI-run cyberattack arrives with an asterisk

In November, Anthropic disclosed what it framed as a watershed: a cyber-espionage operation, attributed to a Chinese state-sponsored group, that used its Claude models to automate the bulk of an intrusion campaign against roughly thirty targets across technology, finance and government. The company said the AI handled the overwhelming majority of the work — reconnaissance, exploitation, credential harvesting — with human operators stepping in at only a handful of decision points. It is the clearest account yet of an attacker treating a frontier model not as an assistant but as the labor.

The significance is real, and so is the caveat. Anthropic published the episode without the indicators of compromise or forensic detail that defenders normally expect, which left parts of the security community unable to independently verify the more dramatic autonomy claims. That gap matters, because the same report doubles as an argument for the company’s own products and for its preferred regulatory posture.

When the firm that sells the model is also the firm that discloses the breach, the incident report and the sales pitch begin to share a byline.

Strip away the framing and a durable point remains. The barrier to a competent intrusion has always been skilled human time, and tools that compress that time change the economics of who can attack whom and how often. Whether or not this particular campaign was as hands-off as advertised, the direction is not in dispute — and defenders should plan for the capability regardless of how loudly its vendor announces it.