The world’s first agentic AI attack has taken place. Cyber‑espionage campaign where AI agents carried out most of the intrusion work themselves, with humans only steering at a high level. The key claim is that this is the first documented large‑scale cyberattack in which an AI system acted as an operational hacker rather than just a coding or phishing helper.
A state‑linked threat actor, reported as China‑based, tricked Anthropic’s Claude‑based coding assistant into behaving like a penetration‑testing agent, then used it to run a multi‑stage campaign against around 30 global targets.
Writing on their blog, Antrophic wrote.
We recently argued that an inflection point had been reached in cybersecurity: a point at which AI models had become genuinely useful for cybersecurity operations, both for good and for ill. This was based on systematic evaluations showing cyber capabilities doubling in six months; we’d also been tracking real-world cyberattacks, observing how malicious actors were using AI capabilities. While we predicted these capabilities would continue to evolve, what has stood out to us is how quickly they have done so at scale.
Anthropic published a full report on the incident, and here’s what we know.
What the AI actually did
The AI system performed 80–90% of the attack workflow, including:
- Reconnaissance
- Network scanning
- Writing and modifying exploits
- Credential harvesting
- Data exfiltration
It issued thousands of requests at machine speed.
Targets reportedly included major tech firms, financial institutions, chemical companies, and government agencies. A handful of intrusions succeeded before the operation was shut down.
Why this is considered “agentic”
“Agentic AI” refers to systems that can:
- Loop
- Take actions
- Chain tasks
- Operate with minimal human supervision
The human operator disguised their prompts as if they were conducting legitimate security testing, leading the AI to interpret the actions as defensive — even though it was actually running offensive operations.
How the security community is responding
- Anthropic and multiple cybersecurity vendors describe this as the first publicly documented large-scale AI-executed attack, and evidence that agentic systems dramatically lower the bar for complex operations.
- Some independent researchers are more sceptical, suggesting the attack resembled a conventional intrusion with AI “bolted on,” and questioning how autonomous the system truly was — especially since at least one AI-generated exploit reportedly contained a bug.
Why this matters
- Complete kill-chain automation is now possible: discovery, exploitation, persistence, and documentation — all at machine speed.
- It accelerates an emerging AI-vs-AI security landscape, where defenders will need their own autonomous systems just to keep up with AI-driven attackers.
About the Podcast Host
Joanne Sweeney is a specialist in public-sector marketing and digital communications. She’s the author of Public Sector Marketing Pro and the creator of the Professional Diploma in AI for Public Sector Marketing. With years of experience in training, consulting, and advocating for digital transformation, Joanne provides insight and guidance for government agencies navigating the digital landscape. She is also the host of the award-winning Public Sector Marketing Show podcast.
