GTG-1002 used a coding agent under human direction to run an espionage campaign

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

ESC-2026-0007

Kind

Adjacent, not an escape

Jurisdiction

Global

Last verified

16 September 2026

Added

16 September 2026

• Anthropic states the operators broke the campaign into small tasks and told the model it worked for a legitimate cybersecurity firm doing defensive testing.
• Anthropic states about 30 targets were attempted and a small number of intrusions succeeded.
• Anthropic states the model performed 80 to 90 percent of the campaign with four to six critical human decision points per campaign.
• Anthropic states it detected the activity in mid September 2025, investigated over ten days, banned accounts, notified affected entities and coordinated with authorities.

Classifiers and refusals, Disclosure. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

Classifiers and refusalsSilent

The operators evaded refusals by decomposing tasks and asserting a defensive pretext, which is a jailbreak by humans and outside this ledger's rule.Anthropic, Disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

DisclosureStated

The vendor published its own threat report naming the actor designation and its response.Anthropic, Disrupting the first reported AI orchestrated cyber espionage campaign, primary source, 13 November 2025.

1. 30 targets

   targets attempted, printed as approximately

   Anthropic, Disrupting the first reported AI orchestrated cyber espionage campaign, primary source, as of 13 November 2025.

2. 4 decision points

   critical human decision points per campaign, lower bound as printed

   Anthropic, Disrupting the first reported AI orchestrated cyber espionage campaign, primary source, as of 13 November 2025.

3. 6 decision points

   critical human decision points per campaign, upper bound as printed

   Anthropic, Disrupting the first reported AI orchestrated cyber espionage campaign, primary source, as of 13 November 2025.

4. 10 days

   investigation length

   Anthropic, Disrupting the first reported AI orchestrated cyber espionage campaign, primary source, as of 13 November 2025.

Excluded because a human held the objective throughout; the agent did what it was asked. For a team the useful line is the one Anthropic draws itself: a defensive pretext plus task decomposition gets past per request refusals, so abuse detection has to read the campaign, not the prompt. That is the same trajectory level reading the evaluation incidents in this record call for.

1. Anthropic, Disrupting the first reported AI orchestrated cyber espionage campaignPrimary · 13 November 2025

• VerifiedAdjacent, not an escapeESC-2026-0005

  Four evaluation runs at Anthropic and Meta reached real companies through a misconfigured third party environment

  United States · verified 16 September 2026

  Anthropic states that due to a misunderstanding with its evaluation partner internet access was available when the evaluation assumed it was not, and names Irregular as that partner.