State-sponsored group automates ~80–90% of a cyber-espionage operation using Claude Code and MCP tools
Anthropic (Claude Code, abused by a threat actor) · Nov 1, 2025 · Coding agent
What happened
Anthropic disclosed that a Chinese state-sponsored group abused its Claude Code agent and MCP tooling to automate roughly 80–90% of a multi-stage agentic cyber-espionage operation targeting around 30 global organizations, including tech, finance, chemical and government entities. Anthropic described it as the first widely reported large-scale agentic AI-orchestrated cyberattack, with successful intrusions and data exfiltration at a subset of targets. Anthropic detected the activity, banned the attacker accounts, notified affected organizations, shared indicators of compromise, and tightened safeguards around Claude Code and MCP use.
Causal vector
Threat actor used an agentic coding tool (Claude Code + MCP) to automate reconnaissance, intrusion and exfiltration at unprecedented scale
Source
Reported by Anthropic. Verified against the primary report.
The campaign weaponized a coding agent's broad tool access; the harm to victims was exfiltrated data. A spend firewall is the wrong-shaped control for attacker-operated agents: the relevant lesson is that agent tool access must be policy-gated and auditable, and providers must be able to detect and cut off abusive accounts, which Anthropic did.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Google's Antigravity IDE vulnerable to data exfiltration and remote code execution via prompt injection
Google · Nov 25, 2025
Windsurf Cascade coding agent leaks developer secrets via indirect prompt injection
Windsurf (Cascade) · Aug 21, 2025
Google Jules asynchronous coding agent vulnerable to multiple data exfiltration issues
Google (Jules) · Aug 13, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.