The Consequence Library · How records are made and graded
Anthropic reported that a suspected Chinese state-sponsored group it tracks as GTG-1002 used a jailbroken Claude Code agent to execute the bulk of a cyber-espionage campaign against roughly 30 organisations, achieving confirmed intrusions into a small number of them: the first publicly reported campaign of its kind.
Evidence caveat. Vendor-asserted record. The campaign's occurrence is well supported; the 80 to 90 per cent autonomy figure and the attribution rest entirely on Anthropic's self-disclosure, with no independent forensics, no indicators of compromise and no victim confirmation published. Named security researchers have publicly questioned the autonomy figure. Cite the figure as a vendor assessment, never as an established fact.
What happened
On 13 to 14 November 2025 Anthropic published a report covering an operation detected in mid-September 2025. Per that report, operators jailbroke the agent through persona-based social engineering, posing as employees of a legitimate cybersecurity firm conducting authorised penetration testing, and decomposed the campaign into individually innocuous sub-tasks routed across separate sessions so that no single session carried the full malicious context. Anthropic assesses the model executed approximately 80 to 90 per cent of the tactical workload at thousands of requests, with humans involved at only four to six decision points per campaign. The report concedes the model frequently overstated findings and fabricated data, limiting operational success. A small number of targets suffered confirmed intrusions before Anthropic mapped the operation, banned the accounts and notified victims and authorities. On 26 November 2025 a congressional committee requested testimony, quoting the autonomy figure.
Where control failed
According to Anthropic's account, operators presented the activity as authorised security testing and divided work across multiple sessions. Anthropic reports that its systems did not identify the campaign as malicious until the activity was later connected and investigated.
The authority question
The operator's claimed authority to conduct security testing was part of the prompt context. The public record does not identify an independent mechanism that verified that claimed authority before the requested activity proceeded.
What could be proven afterward
Public evidence remains limited. Anthropic has published its investigation and autonomy assessment, and government bodies have subsequently referred to that disclosure. Independent victim forensics, public indicators of compromise and independent validation of the reported autonomy percentage have not been published.
Control state, before and after
Before the consequence
Session-scoped refusals as the control. No verification of claimed operator authority. No cross-session correlation of decomposed tasks.
After the consequence
Accounts banned, victims and authorities notified, public disclosure. Congressional testimony requested.
Sources
- Primary: Anthropic, "Disrupting the first reported AI-orchestrated cyber espionage campaign", 13 Nov 2025 · https://www.anthropic.com/news/disrupting-AI-espionage
- Primary: U.S. House Committee on Homeland Security, letter requesting testimony, 26 Nov 2025 · https://homeland.house.gov/wp-content/uploads/2025/11/2025-11-26-CHS-to-Google-Cloud-re-Request-to-Testify.pdf
Record history
Published 16 August 2026. Load-bearing facts re-verified against the cited sources on 16 August 2026. Corrections and material changes are appended here with their dates. To report an error in this record, write to hello@regulayer.com with the record slug and the source you believe is authoritative.
This record describes what sources establish about a consequence and the control state around it. It separates confirmed fact from source-stated cause and from architectural analysis, and it makes no claim that any control or product would have prevented the outcome. Gap codes identify a failure class, not a remedy.