September 2025. Anthropic detected suspicious activity on Claude. Started investigating.

Turns out it was Chinese state-sponsored hackers. They used Claude Code to hack into roughly 30 companies. Big tech companies, Banks, Chemical manufacturers, and Government agencies.

The AI did 80-90% of the hacking work. Humans only had to intervene 4-6 times per campaign.

Anthropic calls this "the first documented case of a large-scale cyberattack executed without substantial human intervention."

The hackers convinced Claude to hack for them. Then Claude analyzed targets -> spotted vulnerabilities -> wrote exploit code -> harvested passwords -> extracted data, and documented everything. All by itself.

Claude's trained to refuse harmful requests. So how'd they get it to hack?

They jailbroke it. Broke the attack into small, innocent-looking tasks. Told Claude it was an employee of a legitimate cybersecurity firm doing defensive testing. Claude had no idea it was actually hacking real companies.

The hackers used Claude Code, which is Anthropic's coding tool. It can search the web, retrieve data run software. Has access to password crackers, network scanners, and security tools.

So they set up a framework. Pointed it at a target. Let Claude run autonomously.

The AI made thousands of requests per second; the attack speed impossible for humans to match.

Anthropic said "human involvement was much less frequent despite the larger scale of the attack."

Before this, hackers used AI as an advisor. Ask it questions. Get suggestions. But humans did the actual work.

Now? AI does the work. Humans just point it in the right direction and check in occasionally.

Anthropic detected it, banned the accounts, notified victims, and coordinated with authorities. Took 10 days to map the full scope.

  
[https://www.anthropic.com/news/disrupting-AI-espionage](https://www.anthropic.com/news/disrupting-AI-espionage)

China just used Claude to hack 30 companies. The AI did 90% of the work. Anthropic caught them and is telling everyone how they did it.