In an ominous sign of how AI is changing cybertax, Chinese state-sponsored hackers reportedly used Anthropic’s AI coding tool to try and penetrate about 30 global targets, the company says.
“The operation targeted major tech companies, financial institutions, chemical manufacturing companies and government agencies,” Anthropic added, adding that the attacks were “successful in a very small number of cases.” Notably, “this is the first documented case of agentic AI successfully accessing high-value targets for intelligence gathering, including large technology corporations and government agencies,” the company’s report added.
This tweet is currently unavailable. It is loading or has been removed.
Another troubling part is that Anthropic’s AI helped automate much of the hacking, with a focus on cyber espionage. “We believe this is the first documented case of a large-scale cyberattack executed without human intervention,” the company said.
Anthropic discovered the hacking operation in mid-September. This involved Chinese hackers abusing CloudCode, which uses Anthropic’s AI agent technology for computer coding purposes. The company did not say how it linked China to the AI abuse, only that Anthropic had “high confidence” it was a Chinese state-sponsored group.
Although Cloudcode includes safeguards to prevent abuse, hackers were able to “jailbreak” the AI to cover up the fact that they were orchestrating the breach.
“They break down their attacks into small, seemingly innocuous tasks that Claude will execute without providing the full context of their malicious intent,” Anthropic explained. “They also told Claude that it was an employee of a legitimate cybersecurity firm, and that it was being used in defense testing.”
(Credit: Anthropic)
The tip manipulated cloud code into testing security vulnerabilities in a target’s IT system, including writing computer code to launch attacks, harvesting usernames and passwords during infiltration, and then orchestrating an even deeper breach to steal data.
Get our best stories!
Stay safe with the latest security news and updates
By clicking Sign Up, you confirm that you are 16+ years of age and agree to our Terms of Use and Privacy Policy.
Thanks for signing up!
Your membership has been confirmed. Watch your inbox!
“Highly privileged accounts are identified, backdoors are created, and data is destroyed with minimal human oversight,” the company added. “Overall, the threat actor was able to use AI to execute 80-90% of the campaign, with human intervention only required by ransomware.”
This phenomenon raises concerns that AI agents will make it easier for hackers to automate and pull off all kinds of malicious activities, including sophisticated breaches they would otherwise not be able to achieve on their own. As technology advances, state-sponsored hackers can also build their own AI-powered hacking systems without relying on third-party providers.
Recommended by our editors
“These attacks are only likely to increase in effectiveness,” Anthropic further warned. After discovering the hacking campaign, the company banned Cloudcode accounts that were being used by Chinese hackers and “affected entities were appropriately notified, and coordinated with authorities as we gathered actionable intelligence.”
Still, the company disclosed the incident after Entropic reported a separate hacker had attempted to use its Cloud AI to automate a massive data extortion campaign that targeted 17 organizations. But in this case, the hacker appeared to focus on financial cybercrime, and demanded ransom from victims.
In response, Anthropic says it has built more security measures to prevent misuse and abuse of keycodes. The company is also betting on its AI technology to outpace threats and help automate IT system defenses, bolstering overall cybersecurity rather than contributing to cybercrime.
Anthropic also noted that an interesting limitation is how cloud code will trick Chinese hackers into providing false information, including exaggerating results or fabricating data.
About our expert
Michael Kahn
Senior reporter
Experience
I have been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite Internet services, cybersecurity, PC hardware and more. I am currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s StarLink satellite Internet service, writing 600+ stories on availability and feature launches, but also regulatory battles over expanding satellite constellations, battles with rival providers like AST SpaceMobile and Amazon, and efforts to expand satellite-based mobile service. I’ve combed through FCC filings for the latest news and reached out to remote corners of California to test StarLink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. Earlier this year, the FTC forced Avast to pay $16.5 million for secretly harvesting and selling its personal information to third-party clients, as revealed in my joint Investigation Along with the motherboard
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. Now I’m following how President Trump’s tariffs will affect the industry. I’m always eager to learn more, so please jump into the comments with feedback and send me pointers.
Read full bio
