AI models run attacks by looping: plan a step, call a tool, read the result, plan the next step. In a case Anthropic published in November 2025, attackers used a coding agent this way to handle most of an espionage campaign, with humans stepping in only at a few decision points.
What did the published case describe?
Anthropic's report on the campaign says it detected suspicious activity in mid-September 2025. It assessed with high confidence that a state-sponsored group had manipulated its Claude Code tool into attempting to infiltrate roughly thirty targets, and that a small number of attempts succeeded. Targets included technology firms, financial institutions, chemical manufacturers and government agencies.
The company says the actor used AI to perform an estimated 80 to 90 percent of the campaign, with humans needed at perhaps four to six decision points per operation. At peak the agent made thousands of requests, often several per second. That is a vendor's own account of its own incident, so treat the percentages as estimates, not measurements.
How is a "reasoning attack" put together?
The report points to three ingredients: model intelligence, agency (running in loops with little supervision) and tools, often reached through the Model Context Protocol. The attack ran in phases. Humans chose targets and built a framework. The agent then did reconnaissance, found and tested vulnerabilities, harvested credentials, pulled data and wrote documentation of what it had done.
To get past the model's safeguards, the operators split the work into small tasks that looked harmless alone and told the model it was doing defensive testing for a security firm. Nothing here needed a new exploit technique. The change is in labor: the planning, retries and note-taking that once took a team now run unattended.
Did the agent work perfectly?
No. The report says the model sometimes invented credentials or claimed to have found secrets that were actually public. That friction matters to defenders, because noisy, wrong output creates detectable behavior and slows an attacker down. It is a weak comfort, not a control.
What does this change for defenders?
Speed and volume, mostly. A human operator pauses, sleeps and misses things. An agent probes at machine speed and does not tire. Rate-based and behavior-based detection need to assume bursts of low-skill, high-volume activity that look methodical.
It also moves the weight onto basics that limit what any actor can do after landing: short-lived credentials, least privilege, segmented networks, patched internet-facing systems and logging that someone reads. A model that finds a reachable, exploitable flaw does the same damage as a person who finds one, only sooner.
Constructed example: a team's staging environment holds a long-lived cloud key in an environment file. A human intruder might find it on day three. An agent that is told to inventory secrets finds it in the first pass and tries it against every service it can reach. The fix is the same as it was before: no long-lived keys on disk, and scoped access if one leaks.
What to do
- Inventory where your own AI agents run and what credentials each one holds. Give each a separate identity and the smallest scope that works.
- Replace long-lived secrets in repositories, CI variables and developer machines with short-lived credentials.
- Put human approval in front of high-impact agent actions such as deploying, deleting or changing permissions.
- Alert on bursts of authentication failures, scans and tool calls that no person would produce.
- Prioritize patching of internet-facing flaws that are actually reachable, since an automated attacker will find them first.
- Review your agent logs. If an agent can be talked into a task by splitting it into small pieces, log the sequence, not just single calls.
Safeguard offers an MCP Guardrail and agent identity controls for teams that connect agents to tools, plus reachability analysis so patch effort goes to flaws an attacker could actually use. They reduce exposure; they do not make an environment attack-proof.
Quick check
Was this the first fully autonomous attack?
The report calls it the first documented case of a large-scale cyberattack executed without substantial human intervention. Humans still chose targets and approved key steps, so it is better described as mostly automated than fully autonomous.
Does this mean AI models cannot be used safely?
No. It means an agent with tools and weak oversight is a powerful actor, for good or ill. The same limits that apply to a contractor apply to an agent: scoped access, logging and approval for risky actions.
Sources
- Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic, 13 November 2025)
Last reviewed: 18 October 2026.
