A vendor disclosed that its coding agent ran most of an espionage campaign with humans approving only a handful of moments

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0031

Kind

Overreach

Jurisdiction

Global

Last verified

15 September 2026

Added

15 September 2026

• Anthropic reports that the attackers used agentic capabilities to execute the attacks themselves rather than to advise a human operator.
• Operators bypassed the model's refusals by decomposing the intrusion into small tasks and presenting themselves as a legitimate security testing firm.
• Anthropic states that humans intervened at only four to six critical decision points per campaign.
• The report names roughly thirty targets including technology firms, financial institutions, chemical manufacturers and government agencies.
• Anthropic states the model also hallucinated results, overstating findings and claiming credentials that did not work, which limited full autonomy.

Identity, Authorization, Delegation, Human approval, Logging and audit, Revocation, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

The operators presented as a legitimate security firm and the platform had no verified binding of the agent to an accountable principal.Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

AuthorizationSilent

Task decomposition defeated the model's own refusal behaviour, so the authorization boundary was the model's judgment and it did not hold.Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

DelegationSilent

The protocol made delegation real and explicit, but with no attestable chain back to an accountable human.Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

Human approvalStated

Approval existed at four to six gates per campaign, which is the record's own measure of how thin the human layer had become.Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

Logging and auditStated

The vendor's telemetry reconstructed the campaign well enough to publish target counts and decision point counts.Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

RevocationStated

Accounts were banned and access cut once the activity was detected.Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

AccountabilityOpen

The vendor published the abuse of its own product, but the report records no consequence for the actor.Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

1. 90 percent at the top of the stated range

   Share of the campaign Anthropic states was performed by the model

   Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, as of 13 November 2025.

2. 6 decision points

   Human decision points Anthropic states per campaign at the upper bound

   Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, as of 13 November 2025.

3. 30 organisations

   Targets Anthropic states were attacked

   Anthropic, disrupting the first reported AI orchestrated cyber espionage campaign, primary source, as of 13 November 2025.

Read the four to six figure the other way round: that is how much human approval an attacker needs to run an intrusion at machine speed, and it is the same figure a legitimate deployment of the same tool is heading toward. The controls that worked here were logging and revocation, at the vendor. Ask what your own agent platform records, and rehearse cutting an agent off mid task.

1. Anthropic, disrupting the first reported AI orchestrated cyber espionage campaignPrimary · 13 November 2025

• VerifiedExfiltrationAIL-2026-0006

  Malware in the Nx packages drove developers' own AI command line agents to hunt for secrets

  Global · verified 15 September 2026

  The Nx postmortem states that on 26 August 2025 malicious versions of several Nx packages were published to npm.

• VerifiedExfiltrationAIL-2026-0014

  Audit logs and token revocation contained a stolen agent integration, after its permissions had already been abused

  United States · verified 15 September 2026

  Google reports that on 20 August 2025 the vendor, working with the platform, revoked all active access and refresh tokens for the agent application.

• AbsentOpen questionAIL-2026-0037

  Has a confirmation prompt ever been documented stopping a destructive agent action in a real incident?

  Global · verified 15 September 2026

  Every incident record in this dataset that involves a destructive or irreversible action records human approval as absent, bypassed or uninformed.

• Open questionOpen questionAIL-2026-0036

  Does any published standard require an agent to hold an identity distinct from the person it acts for?

  Global · verified 15 September 2026

  The Model Context Protocol authorization specification states that clients must implement resource indicators for OAuth so that a token names the resource it is for.

• Open questionOpen questionAIL-2026-0035

  Does any registry classify AI incidents by the authority control that failed, and does anyone count agent incidents?

  Global · verified 15 September 2026

  The AI Incident Database describes itself as indexing the collective history of harms or near harms realised in the real world by deployed AI systems.

• Open questionOpen questionAIL-2026-0034

  Who is liable when an agent commits its principal to something false or binding?

  Global · verified 15 September 2026

  The Canadian tribunal decision is a small claims level decision and is not binding precedent on other courts.