Automated espionage by AI agents: Anthropic's report
Hacking and espionage. An AI agent targeted fifty organizations with almost no human intervention.
Anthropic published its fourth threat intelligence report on September 10, and the content is worth reading twice. Of the operations disrupted between December 2025 and August 2026, the majority were executed by the AI itself: multi-agent frameworks chaining reconnaissance, exploitation and data exfiltration. A human picks the target, the AI runs the rest.
GTG-10007: an exploit factory built around Claude
The GTG-10007 case says it all. Chinese operators, two of them undergraduate students, built a genuine exploit factory around Claude. Continuous vulnerability research against a major security product, malware development, intelligence collection. Around fifty organizations targeted: education, energy, healthcare, government agencies. The report also identifies the GTG-10007 operators as undergraduate students, one of them a former intern at a Chinese security vendor.
Campaign memory: espionage that runs 24/7
The differentiator in their strategy is campaign memory. The agents retained target lists, stolen credentials and the state of the operation between sessions. The campaign resumed where it left off, even when nobody was working. This is no longer assisted pentesting — it is an espionage pipeline running 24/7.
On the Russian side: GTG-20006 and automated evasion
Same story on the Russian side with GTG-20006, linked to Midnight Blizzard: their toolkit rebuilt and redeployed itself as soon as an antivirus detected it. The evasion loop is automated too.
Defense: same building blocks, behavioral detection
Offensive frameworks like PentAGI are open source and documented; defenders have access to the same components. The race is the same on both sides — it is simply accelerating faster than expected, and I do get the impression that offense is moving faster than defense.
If an agent rebuilds its malware after every detection, SOCs relying on yesterday's signatures are looking the other way. Move to behavioral detection, and keep trace of what your AI agents are allowed to touch.