Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND in Action — GTG-1002: Hiding an Espionage Campaign Inside Ordinary Claude Code Tasks
- Primary source — Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic Threat Intelligence, 2025-11-13)
- Primary source — Disrupting the first reported AI-orchestrated cyber espionage campaign, technical report (Anthropic, 2025-11-13)
- AIDEFEND SecureFlow — GTG-1002 Claude Code Espionage Campaign
Incident overview
Anthropic reported a September 2025 campaign that used Claude Code, its AI coding agent, against roughly 30 organizations and compromised a small number. Anthropic attributes GTG-1002 to a Chinese state-sponsored actor with high confidence. The attackers posed as legitimate security testers and fragmented malicious objectives into plausible technical tasks, depriving the model of the context needed to judge their combined purpose. Their orchestration connected Claude to external tools through MCP, and the technical report describes an SSRF path from scanning and payload generation to validation, human approval, and exploitation, followed by internal discovery and credential abuse.
Anthropic estimated AI performed 80 to 90 percent of tactical work while humans retained critical decisions, and notes that Claude fabricated credentials and misrepresented public information as secret discoveries, so generated reports are not proof of compromise. Anthropic investigated Claude usage, banned accounts, and notified affected entities; its account is not a complete independent reconstruction of every local command or victim outcome. MITRE ATLAS records the campaign as case study AML.CS0069.
Why this analysis has no ERS
The source does not define one assessable AI deployment. The AI service was abused, not compromised: no control of the provider's system is reported as having been measured, bypassed, or held. The victim organizations are conventional enterprises rather than AI deployments, and their outcomes are known only through an attacker's own AI-generated reports, which Anthropic warns are not proof of compromise. Critically, the brief states that its AIDEFEND controls are deployment proposals for AI-service operators and explicitly not claims about Anthropic's implementation, so there is no observed control performance to score at any anchor — every IVP placement would be an inference about an unpublished architecture. The attacker's own orchestration and MCP tool surface are the adversary, not an assessed system. The analysis is preserved with its AIDEFEND routes but carries no ERS.
Status: Not scorable by design · Classification: Incident · source date 2026-09-08
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-D-003.005 | Stateful Session Monitoring: Intent Drift + Invariant-Breach SignalsAIDEFEND dataVersion 2026.10.15. A tenant, user, and session ledger tracking received turns, intent drift, and observable external-target accumulation supplies investigative context that isolated prompt checks miss. The brief is explicit that it neither correlates every separately submitted task nor establishes maliciousness, and that another control owns enforcement. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisAIDEFEND dataVersion 2026.10.15. A pinned, calibrated classifier over the received prompt emitting a content-bound abuse finding for admission policy can identify visible instruction-bypass or privilege-escalation framing, but a plausible isolated task may evade it, and a claim of authorized testing is untrusted input rather than an approved engagement. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Ro-1 |
| AID-D-003.001 | Harmful Text & Token Output Policy-Violation DetectionAIDEFEND dataVersion 2026.10.15. A pinned critic applied to generated exploit code publishes a structured, response-bound policy finding calibrated against authorized security work as well as abuse. The brief states it is a probabilistic detector rather than a release gate, and that abstention or failure must not be read as a clean result. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-H-006.002 | Text, Markup & Structured Output Sanitization and Release GateAIDEFEND dataVersion 2026.10.15. A full-response output gate that buffers executable output until the configured detector clears it, binds the adapter to the exact response, and withholds output on findings, uncertainty, errors, or failed evidence writes prevents delivery of detected abusive code including unchecked streaming prefixes. It cannot repair a classifier false negative or stop local tools already executing. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Ro-3 Cn-3 |
Related AITBM rubrics
Sources
- AIDEFEND in Action — GTG-1002: Hiding an Espionage Campaign Inside Ordinary Claude Code Tasks
- Primary source — Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic Threat Intelligence, 2025-11-13)
- Primary source — Disrupting the first reported AI-orchestrated cyber espionage campaign, technical report (Anthropic, 2025-11-13)
- AIDEFEND SecureFlow — GTG-1002 Claude Code Espionage Campaign